{ "Event": { "published": true, "date": "2026-07-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-02", "timestamp": 1783036981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e86d7cf4-e256-4868-8752-2692bd2121eb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f093bb45-75ff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987753, "uuid": "8f6ed68f-513b-48b2-999d-533b889228e9", "comment": "Malware payload (Mirai)", "value": "e7a4cee44ba8d2c7bca48716574f267c", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987753, "uuid": "5b767f0c-0d25-46b4-a646-f8ab8005fb00", "comment": "Malware payload (Mirai)", "value": "001c49bfc21b23c78a4bd408e252a9c54528f85b53c95c96fd2542ad1fdda76c", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987753, "uuid": "1312e8a1-7506-45c8-bc68-016425e32f7f", "comment": "Malware payload (Mirai)", "value": "a7b08eb994117d35a9f3a4f3561c75080c038293", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987753, "uuid": "3e67b772-06d6-4c39-b9df-bee1d3c85f5e", "comment": "Malware payload (Mirai)", "value": "f1ad9d3fff744953f161df892846d3dbf7fb6c43902d265bfc25bb635dc62c432e9131c8f5939670b7d36e054daf8882", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987753, "uuid": "e0533e3f-bee9-4742-a307-1c1bd52b96f4", "value": "T1CBB35A46FAA3E0F1F4930170111BE7AA8F34EE354011CA4AFB593B70EDB16859A9E35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987753, "uuid": "5bd75775-aacb-4ca7-ba0f-8d59c15217c2", "value": "3072:CEZJeYZxk1fs6j1Do8aXEni0RlSHL2AMRhl9ca6YTdS3kDy:HJFZx4fs6j1Da0sL2AqpuJ3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987753, "uuid": "e399c90c-756f-4def-994e-c5fbaae404d5", "value": 115812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987753, "uuid": "f7172013-887c-463b-b6e0-3f7717561e64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987753, "uuid": "8390fbb0-159a-4087-94f7-e929464bb71d", "value": "001c49bfc21b23c78a4bd408e252a9c54528f85b53c95c96fd2542ad1fdda76c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f47a62-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966605, "uuid": "5c9baa91-8b99-4017-8792-d90db6c97eb3", "comment": "Malware payload (Mirai)", "value": "c8940b6a615ea873829a737b1b40122d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966605, "uuid": "40a6b4e8-4dbc-45ec-bdae-db8d8c1898bc", "comment": "Malware payload (Mirai)", "value": "01467634dee8365d372e015ba94b8998d9ea0aceb2831092ca55bbbe5796cb39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966605, "uuid": "5a8ed19f-34ca-43e8-acd6-13bfa8eefb63", "comment": "Malware payload (Mirai)", "value": "d3cca9bef6fdabe08ce4955af91528c6704e50b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966605, "uuid": "f641b6af-f0bb-4420-b8df-d2b2232ba66d", "comment": "Malware payload (Mirai)", "value": "e1636560fc9f915c8a0a98554bfd34169565be948698d461b62872228cddd08a14c3999ab6f5dbc570c29ae1d2edf8ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966605, "uuid": "1fd532e3-e03e-4f71-b363-1007bf3ab5f7", "value": "T12293B61E3E258FBCF79D823547B78E229648378A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966605, "uuid": "c9357e36-cd9f-47c6-9ab4-e3dca45ece67", "value": "1536:bK/QR35eT0Ata6s8QpTy4OVDZZUHWm5XSWYkhoh9m:ke3sTPutO4OVNZXm5XSWXhaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966605, "uuid": "8e458ce2-7d46-4097-91b4-96900a259352", "value": 89628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966605, "uuid": "82722a9e-23e2-4aa9-a24a-201d62fad78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966605, "uuid": "394f27f3-0bc0-496b-a293-92c2d245e522", "value": "vcimanagement.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2ee4fa-764c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783020849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783020849, "uuid": "af59089b-b12d-4d04-a2f7-e964ebb76c3b", "comment": "Malware payload", "value": "3542f2e27fa10e348e726fdc3a743b47", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783020849, "uuid": "fbf95f21-857a-4802-abbb-5c3f08d64663", "comment": "Malware payload", "value": "015a389e5c97ec1e545978359e19c08050ce2b3d23c88557ec9f4a540a4c6c51", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783020849, "uuid": "d8f64764-a812-4303-89fe-cd7b49f35805", "comment": "Malware payload", "value": "ec8d4c78813660130325eb681bee334e54b28452", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783020849, "uuid": "f9a7d431-001b-46a4-9ff7-8e75eb35ea7f", "comment": "Malware payload", "value": "f9f478f457753f8335a82ea0004bf7d066f659abf679178ee548afc49b90e135fd5e23ba97130477add1ba5ef40a82db", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783020849, "uuid": "fc390abc-c8f2-4048-9250-8f03924188b7", "value": "T13DC5331533E438EAE635177C89F3418B5473BC921B3562EF10C5AAB56A27A92D432F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783020849, "uuid": "69196cbf-bb5c-4dd2-9d48-64173bd03258", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783020849, "uuid": "f81f228d-e04b-48e9-97a2-1ba55bbad693", "value": "49152:5uFGKd/UoZtVG6bGcqzI0NQF2BwVCKn82pgVJD6NyRbHpqOjkKER20C+phnxGyjw:WjdfnU6bxhZVCcaVcNybqiX0nfnZjtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783020849, "uuid": "4eb00e10-716b-4859-8a7f-a40c10acdace", "value": 2719744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783020849, "uuid": "9f6174ad-08b5-4f6b-b11d-aab4a00bf5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783020849, "uuid": "6a26accd-e89d-4f77-ac40-481f71dddfb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b666c1-760d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782993486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993486, "uuid": "93b625b5-48ad-4b78-a227-ef90a047d1e5", "comment": "Malware payload", "value": "a8974ab9daf6d21ff67f7bbe28fbb43b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993486, "uuid": "05dd658a-2667-4f9f-8420-6c2f597003a2", "comment": "Malware payload", "value": "01bba66a32b0e4d4a09adb4c12336b234fe9d44a8858d9e3dd76c289089d78ad", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993486, "uuid": "bd7f9951-9136-4720-a936-cc5054f5e1ee", "comment": "Malware payload", "value": "57362bfc9d3abf8f30c238b4019877c0ce7ee51f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993486, "uuid": "0b42df96-84aa-45fd-a1e4-cc70b0dfe5bd", "comment": "Malware payload", "value": "76bb54d17ab5dc0cba78f624ab229b3bfd11e475160ad84c22b62a30e09a4dcc3426f452911fcb5297825692b00311de", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993486, "uuid": "d9569d19-0ef0-48c6-9eba-87714ac539b7", "value": "T18E32B5E158BB16F75E362A54DD0973E26626EEDF35E87842443C8B0A9828FD101C3A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993486, "uuid": "09a92c63-ed33-4927-ac1e-34c34dbbb5f0", "value": "192:/HWNi+e5d6YxSFJKIfCoVQU8GWnEIm8XnD6SRiV:+9ejxseCoD6zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782993486, "uuid": "ae03109c-93ca-4400-95fa-b1bfc56ab338", "value": 11065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782993486, "uuid": "f32bffdc-ca18-4be9-8448-42323303d2c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993486, "uuid": "60236b69-8357-4f43-b1f8-642cbafb1a0d", "value": "CircleK_Fleet_Card_20250430_FACPJ982004695_.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128bdb93-75de-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782973207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973207, "uuid": "3636d08a-c00f-48db-80a0-0fae1795663a", "comment": "Malware payload", "value": "9c790e187ebfa718ca8242f3dad3e467", "object_relation": "md5", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973207, "uuid": "23139b24-825e-4e55-a36a-e29d6266f876", "comment": "Malware payload", "value": "01e7b30de2c759f502e0eb0fb4a86c6ed1c7c33b636e5f0e7a3e32b1a9fec697", "object_relation": "sha256", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973207, "uuid": "b04c6397-3ed4-47d8-97ca-40ff0851bc98", "comment": "Malware payload", "value": "1a115489bf455587388d4c4a3b89367618a23790", "object_relation": "sha1", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973207, "uuid": "192b3962-eeb0-4814-89d6-ef147bdf3091", "comment": "Malware payload", "value": "204f06fe164e4429defd1f1e227e05bba01d9b7b5c2f616dbbd9e06807428356393930c60bca175d1e5f471a3965e6d8", "object_relation": "sha3-384", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973207, "uuid": "b4fedc08-a1db-4788-a004-c288c9800114", "value": "T1AA92E91333B608E702C226E89ACED509F719816F605A1D90B8DCD786EF7252E83F57A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973207, "uuid": "29d0e2c0-e8de-48bb-ae2f-62324d08ce2e", "value": "192:gQSid91QHeKAEzbmObexbYYGYbzsD/bjbY6vmAQ7QDbSIJSIGFa0QtyxHkI6oYo1:b1IDL6QnrGkoLgytEd4tXJDMJT5b5MzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782973207, "uuid": "b855043a-ce45-485c-9912-b8d442afb699", "value": 19430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782973207, "uuid": "2c61ff75-e74e-457c-aa39-babbad3eec02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973207, "uuid": "2acffacf-3d02-4449-b183-a444abb20283", "value": "bonuo-expo.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149e4ec1-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783003276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003276, "uuid": "fe63893b-b911-4fe8-8c3e-d3d10138d61f", "comment": "Malware payload (Formbook)", "value": "370ed8646f719d4e9c06a078f6515fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003276, "uuid": "5df40e27-a950-4781-953d-e1b29f9b54ea", "comment": "Malware payload (Formbook)", "value": "0220916d9e01ad27a30af87ce47a792d11b0e2f64a189390fe72b330ace56ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003276, "uuid": "62a9d028-63c7-4c3f-a8ca-e6f2cc369dcd", "comment": "Malware payload (Formbook)", "value": "4694cec3f12a68e0a09731bb05ecfd17e5c52753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003276, "uuid": "d2fde859-530e-441c-81f5-57f87f6a9b1f", "comment": "Malware payload (Formbook)", "value": "21b3187cb3eb91c5f7e922d6f1cc40d1a3700a8c527467289c16551e1494c80d216b134fee12e4b1b51f84dc62563627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003276, "uuid": "fda4df0d-c403-45fa-9ac4-b2a39e09f1b3", "value": "T1E335F1C4372AB705DE689A348536ED7453692D29B010F9E62EEE3FC775AD2025E0CF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003276, "uuid": "7540c52f-d2c5-4399-8d0d-cac4e2b7843a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003276, "uuid": "b9077202-838e-4835-8048-66b885021c36", "value": "24576:GqGR6DJU1/sY+rsb1AjgVPsnidR9Qg8P0F0B+b1cIW:GhR6VU1/sY+rsb12gxEF+0Eb1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003276, "uuid": "8c31509d-5091-490e-9bba-7566edb61338", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003276, "uuid": "39681df3-77ae-4911-9036-f4afd32824bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003276, "uuid": "df7be910-6147-4cfa-8092-af7d11212cb5", "value": "JjQvZCXCbbaJFZt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53f1239-762d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783007438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783007438, "uuid": "2090d03a-a2ee-4734-951c-6e7257137c33", "comment": "Malware payload (RemcosRAT)", "value": "683c7276bbdc7df8740788e245a461d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783007438, "uuid": "e70e5f6c-dee8-45ac-a4df-01e5945633f8", "comment": "Malware payload (RemcosRAT)", "value": "02727498170edcb29c041a632172eda8b43c89f7235346b03b174b3e5985bb38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783007438, "uuid": "67af19e7-7194-4fc2-a612-3cee5cdd1fc2", "comment": "Malware payload (RemcosRAT)", "value": "e8a104ec01ee0fa1c25022eb13ae28150485f212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783007438, "uuid": "219e36d3-4cc5-4db8-bfeb-0b9007e65cea", "comment": "Malware payload (RemcosRAT)", "value": "99410e6dac8f0d48b52e10ed2511b123b76f9edf11a772686ff7450157fe914d5c416504f1f5f84ab8e6a2e509a6b79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783007438, "uuid": "cc1cb45c-d982-4764-8c5c-6e90222fcb3a", "value": "T1115502012A9EDA02E4760BB91972D2701B7B3E49A931E20B5EED3DDFBB73B515800753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783007438, "uuid": "85aa250b-6271-4cb4-955a-e38e2b1aeadb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783007438, "uuid": "0d0b560a-6cdc-46d3-b53f-fe49f42d9b08", "value": "24576:g4bgZXl0RUr1oJB23aSNjVMng7WiOx5QZQs10U42Bow478Fa6Uw:+0RF723ajHm310nw4ia69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783007438, "uuid": "93daad0c-1268-4d6a-b1f7-50841c4de42f", "value": 1344000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783007438, "uuid": "f0b23cb8-9fda-41bc-85da-2834f9372a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783007438, "uuid": "25eec510-41d8-47f4-ad16-ad1df721b74e", "value": "MT103 Payment in USD Transaction Swift.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229c9dfa-761e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783000722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783000722, "uuid": "6121d3d4-2f7d-409b-ac05-05cec7ea174b", "comment": "Malware payload (CoinMiner)", "value": "9eeb5e790993b3227f7a147a167e30c4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783000722, "uuid": "2e84978e-38b8-4c17-8e73-f2240ac7ce2f", "comment": "Malware payload (CoinMiner)", "value": "03a5770f345ad88c9628354cff3ced7cfd2c92ff187182881550ca9a8da3866c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783000722, "uuid": "cb58f8fa-1dcf-40bc-a88a-f29f6d9035c4", "comment": "Malware payload (CoinMiner)", "value": "cdc4a23302b677d374ce2910fa923a04dbec4282", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783000722, "uuid": "22eeeb12-8d0e-463f-bb01-3c1cb87dafdf", "comment": "Malware payload (CoinMiner)", "value": "fad392e8da62f9e8136e7e5a99275cd06262ff6eeb8c48c18fb439e2a0ec9934647702bf882b606870ed726fef63514b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783000722, "uuid": "7cf370df-3670-48f1-bad3-f287b3403595", "value": "T14F6733DDB6DA001BCCFC36F6E206A6F9CC7085506919AD16FE11CAAE6C871DC84F6319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783000722, "uuid": "30b9c291-9690-4d2b-984b-3cbdc2bdf450", "value": "e6c6166959e9db1494bb9a620affb282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783000722, "uuid": "9bc7e65a-b078-40b3-b64d-869c1877f2fd", "value": "786432:T24C7FzhQ2Szwdjtr9P3myjYWx/eocT8nfy9QwmE8cpG:TUdhQ2EQjtrJ31LR/nf8jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783000722, "uuid": "a5a4bd27-4cf3-441a-8075-0d9abc656620", "value": 30771712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783000722, "uuid": "8c3a4163-7d28-4d29-923f-95ea206725cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783000722, "uuid": "6543dd29-7e26-4ea7-bbf3-f11133e96cd5", "value": "TokenGen Builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a3a89b-7609-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782991941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991941, "uuid": "e2721787-ac2b-443a-976e-34bbd1dd9fef", "comment": "Malware payload", "value": "66dc8ff45423d04891779bca066d77f8", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991941, "uuid": "b1d857eb-7ced-4561-a5a6-f03bd220bb2c", "comment": "Malware payload", "value": "04dcb9ae581ae1ef021b2806a09ee71efec4e2d9e068f4cf4ca68508b29fe1fc", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991941, "uuid": "3425ecad-a768-4c69-bf83-cfb800c8d353", "comment": "Malware payload", "value": "dc86aff5f5f8b5812d8e23335bac7e8cfe5f57ee", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991941, "uuid": "55d7a4e4-4e46-46dc-96ff-5fcfb90859cc", "comment": "Malware payload", "value": "249e5e23af9788101ceda7cfbeaf6d1d195f12d94d9c04fe670b7cf1ededc0db1c86a9cbccac90ed22ed2de8c089c1b1", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991941, "uuid": "e787fabc-954f-490f-8be2-23b0e23e6e28", "value": "T1D051E9B74CDB0ED7AB44463104FD32C6943A67DB45527056C06CD788E85CF303AE1DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991941, "uuid": "8553961c-f7f5-43fa-9ffa-5f4a0eff1eac", "value": "48:/izpzXyqQN1szslciX5eu73ZfmkgCTfmR8K6BvbXOZxLyt43Qii7R:/izpzXDgVcAmkgMeR8K2XOZdytdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782991941, "uuid": "5c5a99b2-753a-4638-b76a-2cbdae638c80", "value": 2547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782991941, "uuid": "0c63c794-da2a-4361-b982-769a03ca339a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991941, "uuid": "cf2e54e6-1ca6-4aeb-962f-d577f6c2aca2", "value": "Abrechnung_A2025-011084_16.12.2025.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36be6c82-765b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783026955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026955, "uuid": "1d58be9f-21ea-46bd-9a1d-1fec4349b557", "comment": "Malware payload", "value": "eb554018315541ad53fd0cb705e4d0b1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026955, "uuid": "c72930aa-17e4-4dd7-b5a5-4a5302f9090d", "comment": "Malware payload", "value": "05a2da9df1b4aed78e16349c17443ccd83cb48ed9e38e38d0c0b6ce808a9c2a8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026955, "uuid": "e60588c1-cc63-4f31-ae18-be39862d8007", "comment": "Malware payload", "value": "17837f97ffae693637fa08aa09692e605612ff48", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026955, "uuid": "89d2bb65-b768-47b5-81a6-524ce1936d1e", "comment": "Malware payload", "value": "d73aa35b616c380bb50b1f120262f4e8a26ec011f404a1a89c235b556df26ba33e495924cc97a6a7c5b7c7dde3a594f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026955, "uuid": "722b7081-b836-473f-b2e6-4d061f7c0c0c", "value": "T1A696E143FB49CA97D9AA83F26B270F992A170F04C742AAD34555367E2D7B1C20DC5ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026955, "uuid": "36423a8a-a1a0-4fcb-afec-97b3e7a6ccf2", "value": "98304:wUlOOEzBDTimzR0tbqBtoRTA2GPda9yJhmjcZe:wOUNzubmCREJa9yJowZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783026955, "uuid": "0b18c22e-7504-4b11-8268-0c785790ad8b", "value": 9021604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783026955, "uuid": "f58364ee-67b5-4b80-aeed-9f6da3b1fb49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026955, "uuid": "f851bc2a-3265-4ed5-9e58-bdec3453246d", "value": "src_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d9356b-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782989559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989559, "uuid": "c96162d2-63d4-4730-8fb3-df88fecf9b78", "comment": "Malware payload (Mirai)", "value": "47f193ab98e6c6e363f05cc0e23c735f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989559, "uuid": "d6793926-dae7-4ee5-8244-7a717714e72c", "comment": "Malware payload (Mirai)", "value": "06cd4eaa8a839b1fe23c64204021cfbb738847b37951b84d0327cc07ff18deef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989559, "uuid": "42a69324-83c7-410b-ac92-aedab65f9f15", "comment": "Malware payload (Mirai)", "value": "0601c329bf0c2f9b7cc8d9b646af264b13f86b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989559, "uuid": "5d13fc4b-e606-4870-8343-e6356e085222", "comment": "Malware payload (Mirai)", "value": "4f137d3e4012fe1043f079710ffa41c0109fa65ef605c60b02c8b477ec2ba4ef5c1d28650d77b04263bfbdf3b20ca30a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989559, "uuid": "5f31a72f-841e-478b-8e2b-4252a9540b1c", "value": "T126A46982FAC3C6F1F56709B1101BA36F6B314A2A4035DA86EB956D31EC72742561F3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989559, "uuid": "4ffe0273-e005-48ca-9df8-b2acf15d9ba6", "value": "12288:cnMx3d0VZje9JCFh/21yydQjd9PPnMx3d0VZje9JCFh/21yydQjd9P:aU3d0VZjeEhiyydQfU3d0VZjeEhiyydQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989559, "uuid": "4f753464-843b-4f96-8df3-5b5e6a87db6b", "value": 460872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989559, "uuid": "2125e5f0-0747-4105-9d71-ccfe19369265", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989559, "uuid": "079f4ddb-4d89-40f2-95dd-f47a0ff77bc2", "value": "06cd4eaa8a839b1fe23c64204021cfbb738847b37951b84d0327cc07ff18deef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a510f2a-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033484, "uuid": "3bfcc817-54d6-4d7b-8cbe-ec647d16bf5c", "comment": "Malware payload", "value": "6bd45cb7eaa6d1ebb30709369dff1332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033484, "uuid": "daeafbb9-2e9a-4f14-a747-ecd6b3f2f0b4", "comment": "Malware payload", "value": "09850882df56f887392a08d100456dc3644f4acbb26c8434218574a0bbee07bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033484, "uuid": "a7422bc9-adb4-4995-aadb-18be58883cce", "comment": "Malware payload", "value": "d549d9e76447342854a556829f177d6b489740e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033484, "uuid": "7921fb51-01a0-410b-9a6f-a3d952204bc6", "comment": "Malware payload", "value": "bea60e60a2635fb0df789b1f00e9cb4e015f60d29bb06ea343940bc6b8413352949e53748b94b83b9758c33c4cbc1929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033484, "uuid": "4b16de6f-25b9-460f-b0e7-4a32b2dd0a48", "value": "T109F33B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033484, "uuid": "98c3296a-cdbc-4da5-9a9c-f43d7032b389", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziH9fam:9FJMgWPZr8IaCWReS1WpPem7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033484, "uuid": "68b08f9d-ab51-4d43-b658-a073112a147b", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033484, "uuid": "fd9ad03e-262c-4593-a954-7b8396884871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033484, "uuid": "2637e156-624c-4ba4-8001-05bf8e6e2d83", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b25f22-75ff-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987769, "uuid": "66b29cf0-0253-411b-84a8-abd368ced2ae", "comment": "Malware payload (Mirai)", "value": "22dbbd96fb7090c1a6e21bfa0cab1242", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987769, "uuid": "e1659e65-b27d-48f1-83b8-2dc73f7412ac", "comment": "Malware payload (Mirai)", "value": "0a3b692f49f4734af774102cce6eafc7feb20ca39cd702fcd979ca5c30ff24eb", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987769, "uuid": "491ff989-1fa7-40ff-967e-d9ddae2cec5b", "comment": "Malware payload (Mirai)", "value": "83f31037fa8a92469f20baad86c3d5d009f6dd90", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987769, "uuid": "2b7b576e-8762-4f1f-9d5a-37d499c7bd3e", "comment": "Malware payload (Mirai)", "value": "6968b1e296ba4dfe73c3c887f48937e8daaa5afc7c884ffa89782b32553e9f3220d2bede574e92355c8a93d7cd20e569", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987769, "uuid": "2521fa49-b9a6-4083-96d3-155954e11822", "value": "T1EC057D9EE793E4F2F25301B6124FC7F20470A1266013FAB2EB45AA7674767912F1632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987769, "uuid": "f68e4c0e-bac4-45ab-9712-fe7444df64ad", "value": "24576:5M7DFlGIThp3hs9K+ARTZcaDVz4j1SfDOYw:2+IThp3hSyh+Sf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987769, "uuid": "9219c39b-280f-4442-84ca-646207fe34c6", "value": 831644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987769, "uuid": "a30bb148-5f77-4f04-afd2-faa74b0a6f31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987769, "uuid": "beb22109-f2c3-4573-9868-a97c270e1be2", "value": "0a3b692f49f4734af774102cce6eafc7feb20ca39cd702fcd979ca5c30ff24eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca1e739-75d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782967480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782967480, "uuid": "23900126-87bb-440a-a773-fc50c66ae6c3", "comment": "Malware payload", "value": "7ef78d2cd710c3a3a0a4d4923c295ef3", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782967480, "uuid": "b2fa02f0-6445-4090-bbdc-cdfe40084a86", "comment": "Malware payload", "value": "0aa66c62d8af0501b615368e37bb09f3e1a7804a5a14e6c5e08379b52beec618", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782967480, "uuid": "f3fc764b-da6c-45b5-9dc2-7c86127d8f91", "comment": "Malware payload", "value": "823f6b503633264df94bdc193bae5157f3ad40f1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782967480, "uuid": "1ba2d607-8bfa-4afb-a9be-c7a4edaf5af2", "comment": "Malware payload", "value": "9dd15cc97743c69b443c295c714cbc4a8329cbe854277a870b607a7d44627271370a3f2d67999fa0837bee91802fcd1c", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782967480, "uuid": "29393fc3-edb0-416c-8497-d4232680ec7d", "value": "T1EC7633E48C625893CE4E033966517BDFA64CFD1462B901FE09373BDA7F27E20A551A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782967480, "uuid": "ec7c8062-681f-43be-aa48-dbee4a9835f5", "value": "c1e36b1d68d75d94b57cee9759c1ee9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782967480, "uuid": "0fd5ff2e-0c92-4406-95e1-29abfdd72a79", "value": "196608:LczvhYeTnHyX3B/O5ySYaPSANPD0riHrMFycUCEPz:gTh7Dm3B/O5ySYU2iI8cU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782967480, "uuid": "8c0349de-e1a4-4e64-98d0-cf47c8b61ddb", "value": 7749632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782967480, "uuid": "ab202bf3-677f-4e17-8ff1-b8574e5979d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782967480, "uuid": "63761d1f-f20d-4ea1-b020-036d33109d91", "value": "VideoSdk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da83b55-761f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783001170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001170, "uuid": "61b43508-efdd-40cf-b39a-6cd232b5c22f", "comment": "Malware payload (AsyncRAT)", "value": "179e5c88bbd34e45830e7ee3610d5216", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001170, "uuid": "2d195ba4-348c-4f1a-bb48-4fecb2a1a983", "comment": "Malware payload (AsyncRAT)", "value": "0aac658075b7d9e81419d0beaa3db796569bc14fd57512f4479fb36e9cc4c1a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001170, "uuid": "c8657489-795e-46e0-9429-6771cadf0570", "comment": "Malware payload (AsyncRAT)", "value": "e6fa8fda487392419be240e2911e7c9c346b750c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001170, "uuid": "42bbcf3a-0739-4f8e-ba60-ced7c9581440", "comment": "Malware payload (AsyncRAT)", "value": "ab14540c2f65949bb9a5df20bf4f67a340c552a25c2cf57e3fbdae71edf58233a2a1172bd6ea7773b25181a7c364c134", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001170, "uuid": "8b82c6be-7f8d-4463-a8cd-5f8dca209fbf", "value": "T17064E01837E4C929D2FDDB781CA0E1968A35FE651C23561B7AD06BBF2A31354CE013E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001170, "uuid": "4068c4fd-4037-4da2-8c98-62d81d7d2da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001170, "uuid": "cd4c6fb5-77e0-490c-8b96-9bbed90e247b", "value": "3072:ZU1tzbXBDsk6iJOmh1U6edqimAaxHoSaxtoR8HFUOBy7U5XsYkjT06G:G1BbZse4U/ACH9ax66HFUFI5XXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783001170, "uuid": "86892480-690d-4534-b051-aa877cf8c90b", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783001170, "uuid": "98bbea9f-3052-4b34-8f5f-a65cb1b9aaed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001170, "uuid": "c12eb591-f975-45f9-9278-d845d1f50339", "value": "meccha-camouflageV3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb53fd9d-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988604, "uuid": "ffe06186-41d3-445a-89f9-0fc6e615fab4", "comment": "Malware payload", "value": "b066fa7937d7db917003504a0dad5a59", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988604, "uuid": "59fa229a-4059-4c68-8bb5-5c5d344edd54", "comment": "Malware payload", "value": "0b05351b183689b708e5c2d2d1bf16415bec6336e088ae79bae8c0045c9220cf", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988604, "uuid": "e9f89722-0e51-43b7-86c3-bdfe342f1ba3", "comment": "Malware payload", "value": "0c8835a7746ec4064168f80b1ae4c4b75d1c6583", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988604, "uuid": "00ccf149-d148-4952-ba44-5d758126d4c0", "comment": "Malware payload", "value": "0306fbbf0d4e3b2abf1d385efa024115f9bf53cf54396106c92f69f1b15b7878d2323bb5ad036627d5674ab8d5001f14", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988604, "uuid": "6e1c0517-6e06-4f83-9adb-2613952cbaa9", "value": "T122357B46EA009679D172B4B0564FE375C8202A345123489BFF5F2D68B63E7C1EF293A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988604, "uuid": "2e7956be-b5d2-43dd-bb08-7b5d785ea4fd", "value": "24576:+MZ/+NsTiuGFy/h2z57L+NBumT7Cz+iYwtfFtS9Q8:pZ/+NsTUI/hQFiCawtfFtR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988604, "uuid": "c4d4e963-1606-4f61-8f86-aa52a3942e57", "value": 1088072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988604, "uuid": "5fb1212c-2244-46a0-b401-d2020b536a20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988604, "uuid": "efd89444-f953-40e2-92f2-cf13a9f4b4dc", "value": "0b05351b183689b708e5c2d2d1bf16415bec6336e088ae79bae8c0045c9220cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1145ecc-760e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782994170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994170, "uuid": "d787db67-0026-4bec-af3c-fa59c1f9481c", "comment": "Malware payload (Formbook)", "value": "5ff9c0b47ad7adbba95955ad266ecbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994170, "uuid": "9138da9c-2f30-4ec4-ae16-0b7485dc5c35", "comment": "Malware payload (Formbook)", "value": "0b3236531c608af3cdb33b3f09ab0d5bbd61f67cc341faa92c1c2cb2258bd409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994170, "uuid": "cd7400ed-9389-4d66-a27c-842846c8d9ad", "comment": "Malware payload (Formbook)", "value": "0c8b6a85b4bcf12fbe3e274a0436000a76d6ca78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994170, "uuid": "91f12df0-4454-4ad4-a5c0-1e2044df2672", "comment": "Malware payload (Formbook)", "value": "3e6e3885abfbc141b055fa4ff522c591598f203f7c1244a31e767bc1f51e06e8c5397a1a6cf0c255f5df372699881673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994170, "uuid": "fa67c1dd-7d79-44af-862d-532550173cf7", "value": "T1FE2512806BACCF11E5F907F91671E33247B12C5AE416D31EAECCADEB3960B845A24747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994170, "uuid": "a91abbb6-4328-4081-97da-554f17b6953e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994170, "uuid": "285366e3-4230-455f-8115-e0ca6a61c89c", "value": "24576:Qy1QR6ZAd5KqWpAkYZ5YDT6z842SpEqqT5owAxfOd8XAqVQ4:5S6ZAdgqWpbADzQSpEqq5mxWSXA2Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994170, "uuid": "400b91c7-a2a8-492d-8001-03a65d9dd031", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994170, "uuid": "6f1e973c-1019-4542-a140-223740899059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994170, "uuid": "deb84638-04ed-4dc3-af82-0df7c24b19e7", "value": "Factura electric correspondiente al pedido GA103209 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab01986-765b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783026908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026908, "uuid": "fb99889a-12d6-4297-9e84-a1c26d441b04", "comment": "Malware payload", "value": "316362e4154db3f959f759240be2fb9d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026908, "uuid": "56915139-a2f2-4f3d-a48d-2ae60ed49f09", "comment": "Malware payload", "value": "0bc98459a42d1d0108a882671f4496f214f8a68400810b9e034cdd7212f5a4fa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026908, "uuid": "30734fbd-1f9e-433c-87ed-15485babb2e1", "comment": "Malware payload", "value": "9f4a31e0387422d7e7503920f4d7814a7ea466f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026908, "uuid": "4cfad07c-b0b2-4472-996c-ce5e70758491", "comment": "Malware payload", "value": "c5ad99a80b672d55dcdeef0f5ef5503446dea0a174b938d349ec2d9c1ebbb92fb8ef153cfedd2ca99c585f74fe16472a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026908, "uuid": "d851806d-85ec-4eb1-8552-dcbd5b74c40e", "value": "T163C70157FFC655BAFCF643360E3553692202AC358B67B28BA814327CA4B75D02E42DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026908, "uuid": "ebb0625a-bd6e-4e86-bb2e-7ecacbd56971", "value": "98304:8q6eL7ACQ9GPjpZyp5eWR/XmU+2bDiUOBCC:FLcCQ6pZyplXmebD+4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783026908, "uuid": "b8a14555-9d59-44af-9f9e-c1d8bcfdb2ef", "value": 56142868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783026908, "uuid": "15504a38-7af9-4efa-91e2-28f94631e9bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026908, "uuid": "bf48be14-b142-49a2-adc3-e7d6214ab245", "value": "apksigner6222202351320183515.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ffdc4f-75de-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782973393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973393, "uuid": "71548b85-81c3-4f7b-9c5f-b436d5aa463b", "comment": "Malware payload (Vidar)", "value": "04660f93b136b87207c988a5fbb1955d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973393, "uuid": "4c081555-3406-470b-91c9-1f234ea52c9a", "comment": "Malware payload (Vidar)", "value": "0d22384f694f5d08e291f32825e9b6c816d7a6067f1f0b45ec029c877c5c5bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973393, "uuid": "0a8d2690-d918-4610-9a44-72cd0b4ec7d3", "comment": "Malware payload (Vidar)", "value": "04b5902ca3f3437347f2da69f02c82694955d929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973393, "uuid": "12883d6d-1767-47fb-8370-acf0e9586408", "comment": "Malware payload (Vidar)", "value": "3240629794abb8c16e987fc4d31dcf2a9b6635353ff366cf87f24ec2d98d3ad2667c16f63b5560c8e0bb21ccc4e3fc54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973393, "uuid": "f1cdac6f-e8df-495f-8716-d686ecd7c28f", "value": "T101E59D07BCE149E5C4EA933189B252927B31BC184F3527D72EA0B3392E72BE49D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973393, "uuid": "0e5db332-b796-4356-916e-8bcce3ed082d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973393, "uuid": "c327fec3-d509-413f-8f03-df50a8ce6ebc", "value": "49152:mr4fxRwzMWuubY1vWf/UnvPhTspVQGWnmsL:mrOh1GUnnhTspVQbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782973393, "uuid": "d3cdf913-f689-48f2-adfc-a75fdf735b6e", "value": 3102048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782973393, "uuid": "72bc5934-65c5-44c1-8e4f-cbf1167cbc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973393, "uuid": "f73c5b19-aeb7-40ec-afd9-80b073f9f62d", "value": "a609d1b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd483b0b-75ff-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987775, "uuid": "431f3262-cb69-4cff-b1be-3531366d7178", "comment": "Malware payload", "value": "91d8ee912048e48ec4945371ace371e9", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987775, "uuid": "e84831b2-5816-4daf-afbc-93379fb94fcf", "comment": "Malware payload", "value": "0d9d55490118f4325d31ef37fa19e0fe47bfe80fd01edefb93e8ecab2affa855", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987775, "uuid": "20534805-5196-452a-bec9-ee33206e1009", "comment": "Malware payload", "value": "a0d17b547cb4935471668280ec0055108bb126c5", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987775, "uuid": "83039b48-ff5c-422d-98b6-0ae2198684c8", "comment": "Malware payload", "value": "85cb9096ab80853c28c6a3ba8ca7583caa534469fc980987e543ac856b3e3cc280c335093c804190f3cb1e0e03e052bd", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987775, "uuid": "1c16d1cb-5b3c-4325-8d3e-a8b8c77f483f", "value": "T1B8A51226E92185B9D477A4F1520FD3BACC31A6349523889BFF5C1D24923A7C0AF2D35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987775, "uuid": "cf9766da-d79c-46f0-b60c-36cbe74e3dd4", "value": "49152:gd11DM5MFjZP+Fp+4SPJVwwjgXKsz+Vwet:gd11DM5MFlOp+7Vwwjtf6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987775, "uuid": "ca47bf72-1460-4592-acdd-67ebe8fcd348", "value": 2226098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987775, "uuid": "962745f5-6e77-43ab-add0-e763d552ad86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987775, "uuid": "42bb2374-a19d-4c68-9c6e-2523ce8b5ea4", "value": "0d9d55490118f4325d31ef37fa19e0fe47bfe80fd01edefb93e8ecab2affa855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de75ca6e-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972261, "uuid": "6d22fc40-371e-42ea-bd94-cf67f0a11339", "comment": "Malware payload (Mirai)", "value": "4c61295169e69a9a32bd663ebcfc5347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972261, "uuid": "f11d0935-4291-4e70-bb7c-418976a39223", "comment": "Malware payload (Mirai)", "value": "0e0bb886e76bb2947615e5271211823b444898017caa89225757d49f9688a144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972261, "uuid": "cc05a09b-74f5-4b1d-a301-f12f64aa1aa7", "comment": "Malware payload (Mirai)", "value": "d647373e229bcb532b1e54dac1a1d4438065d66d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972261, "uuid": "fbcdc969-8304-4305-a363-de8079ca4ab2", "comment": "Malware payload (Mirai)", "value": "6531ec8e20ce968bf74fdf6e447d97d2c18657b643fca6584e60d584e93d098ced38e103ebb1c1de2ff9e55f34ca949a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972261, "uuid": "d3b9242b-0059-4b5a-8bc8-7b2e991c97aa", "value": "T14CA33A92B808EFBAF40F963B84634502763273F3AAD45B71A2136877DD761C11D6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972261, "uuid": "f8fe1e19-e070-49d7-87a0-44c4fa924894", "value": "1536:Eu7Obyj7HUQK5ebK08OV+4pXn8imwPT+lEMNLESg2yoj3Tf9:ibi7HUQnbKW+4nF7UdESg2yoj3Tf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972261, "uuid": "0a4a0025-3ae5-4981-b603-7b33c9843bd2", "value": 98404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972261, "uuid": "da37fdc2-87cd-4667-a395-e2709291de1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972261, "uuid": "40cab276-cfea-4e2d-bb2d-f3be1a4ff63f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0810f0-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782989598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989598, "uuid": "a4502b57-58a1-419e-9b18-b059bd951c87", "comment": "Malware payload", "value": "85ba57aca2056a020669be6c7d786eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989598, "uuid": "94a1ce73-1f7c-4145-a833-04afaf041efe", "comment": "Malware payload", "value": "0ed2515dc3255c9994388b20660048b6883ebf7e184118b1a2e066ba21b2a64c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989598, "uuid": "00252ce3-b6d5-4833-8b16-ca36869d8637", "comment": "Malware payload", "value": "32ad667c8eaf02c022971b57dd58f585954eb236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989598, "uuid": "0d450440-460e-4136-af69-67947c891968", "comment": "Malware payload", "value": "6bca8115a395e5405352215f20128666746d982d063a00e662e7a1696fe002030aef487998f20786e816dac6cde96865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989598, "uuid": "a1cb9692-34f4-4dc0-b063-1f422b5de674", "value": "T161341285F4C08CBFE1EBC1B9428FE536BD22F8466270765F9910A8317D11B169AAD7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989598, "uuid": "579e6562-7d1f-4cbc-aaa1-fb4c3a90d21f", "value": "6144:GIM2aEWnwx3SIcB5S2PEA2YU9OBoYZ8po9YxKqu3rMHtKwwdEh:QaqB5RPU9OpS+quOBwdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989598, "uuid": "5f0f2489-f3a7-46f5-a5f1-617bb09eface", "value": 237394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989598, "uuid": "573a0a93-8af1-4ec3-bd95-ae792b7b0e5d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989598, "uuid": "dfabb1ff-cc3d-4f57-bdc1-b2f779850f11", "value": "0ed2515dc3255c9994388b20660048b6883ebf7e184118b1a2e066ba21b2a64c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fe5feb-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988598, "uuid": "96dee342-3d30-49b4-8649-895406902984", "comment": "Malware payload", "value": "fa523423165a339acf21a4a0f2bc488e", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988598, "uuid": "cdffa015-71d5-4d73-b150-1b565df32f7d", "comment": "Malware payload", "value": "0f1d8b2ee68b2da190cdbddef766c3e499cd9bcd4fae65c93793ef8f3d869345", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988598, "uuid": "50c755d4-fae6-48ec-a142-7196113a5a96", "comment": "Malware payload", "value": "80e82a1fb45ae7048ed7a68471b5862a93b84038", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988598, "uuid": "34ad54cb-4bc5-4ca0-b50d-08a92b50295d", "comment": "Malware payload", "value": "9b5cf0f2a6266a9521876384b9c6c0ad0522b43dddb4f317c16145135423c24629733784f5b541ef665eaa3e871710b6", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988598, "uuid": "af16202c-ea31-4ab1-a81e-66f6dabf3092", "value": "T1A6156B06EA016579D47271B1524FE336C8686B358527488BFF5E2D6CEA3A2D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988598, "uuid": "4aea6a37-0b6b-4171-be9c-5bd1b61f4f0f", "value": "24576:MeLXBsUAJbR0RZDIHCVJFY21VpGw6SmPWogPQ1l:MeLXgJ1kKuFYCTG/PWogAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988598, "uuid": "4a44b739-ab0e-4bbd-9948-4034042826ea", "value": 883248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988598, "uuid": "ce55e566-b1bc-41ca-87dd-f43af2362944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988598, "uuid": "dff85b97-8274-40ae-ba59-781a34b02d2f", "value": "0f1d8b2ee68b2da190cdbddef766c3e499cd9bcd4fae65c93793ef8f3d869345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f76427-760c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782992995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992995, "uuid": "23eabd59-4437-4677-b5f8-ddf76b7dcd85", "comment": "Malware payload", "value": "526d72f92d4b5d7a591d4c6722cf8ddc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-b81078cffc6d471e9d2d977de133536e-r2-dev", "colour": "#DB0924", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992995, "uuid": "f7b91b8c-d587-424a-bf19-eafc1ca61fab", "comment": "Malware payload", "value": "0f8bdace0b997d4360731fd8bb9fde8d201fcd9d090a8c5be31617e881bd4ec7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-b81078cffc6d471e9d2d977de133536e-r2-dev", "colour": "#DB0924", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992995, "uuid": "a2181c60-3de0-4fca-82ce-fcef8cdc6601", "comment": "Malware payload", "value": "c555ec0b942672428ed54098c3cb5475df55ff74", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-b81078cffc6d471e9d2d977de133536e-r2-dev", "colour": "#DB0924", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992995, "uuid": "3a186734-44fc-4b58-ab08-a45501ba5dfc", "comment": "Malware payload", "value": "6eb916a6477b735a2b664425177db130172bd58a7351e15784e3eddd46fefb96d3c914500d796197a3eb469baed61d68", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pub-b81078cffc6d471e9d2d977de133536e-r2-dev", "colour": "#DB0924", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992995, "uuid": "d65d1c64-c1ee-433f-a2cc-a8bbffaa3a4d", "value": "T19C6733E81DDECF26DB83ACB18267395C91F2EC5A49645418F378F838A4B76E0D370946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992995, "uuid": "892bd5a5-3cc5-427e-b976-8cf22cd5457e", "value": "786432:vNWZbpSLD/BhvSbzWUPK+DvELDQVxnSDXTm7:vN6b4/nEWS5DvFVNSnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782992995, "uuid": "46022215-0d9d-42e1-93f5-e78067df6f63", "value": 30926336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782992995, "uuid": "b4da7b96-a76b-4f96-9a71-0c099eac30c5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992995, "uuid": "2130eda5-4deb-472e-9213-239eb6ddb3f3", "value": "ZA_Access_My_Department.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c83bee-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782989592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989592, "uuid": "f2b5899f-adf0-4379-ac24-d654a3f3a50a", "comment": "Malware payload", "value": "a99e56a80cfab200393bc55013b1e778", "object_relation": "md5", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989592, "uuid": "f5a6dba7-b742-4d4f-a7f0-146c86d7e18f", "comment": "Malware payload", "value": "11bb239ab4d50239fc2d3411be65bb04412b8ec45fb08a6c89854e5231092c3e", "object_relation": "sha256", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989592, "uuid": "75bb3ba8-b7ec-4101-b29f-6d6ff9aa6a54", "comment": "Malware payload", "value": "4550d80a5da914c1ed1cf44dfd44eacd1129d13d", "object_relation": "sha1", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989592, "uuid": "ab1351dc-af5d-448e-a64f-c3746a4f98f7", "comment": "Malware payload", "value": "fc43316df9672a9055600ac7a5f76ab75da7652353f7b8daa9cad6bd1eb6fbaa1552f344ea1c2ece0d2fae6c928d982a", "object_relation": "sha3-384", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989592, "uuid": "6b75b8a9-1a06-4917-bd67-218f3ed0fcf2", "value": "T1F871BBBA2421D3317D8BCA7C7B50BD8CCC47A0E36A95AC91B18D2D04FF69E907A78704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989592, "uuid": "6f27df7a-6e91-4837-b59f-92c807d0b983", "value": "96:HsKBiqTamLrDCkxwqyWuIRJxQdGiGJKuedMDHW92c1XEqX:HsOwRaoMDHc2OEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989592, "uuid": "0b3bdf29-d9b1-4cc3-8f8e-69c9f765bd5f", "value": 3736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989592, "uuid": "64611ced-25a9-4173-9c6a-ae0ecdeebbf1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989592, "uuid": "62484306-0681-4261-9568-10a8ec6dae72", "value": "11bb239ab4d50239fc2d3411be65bb04412b8ec45fb08a6c89854e5231092c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9a2786-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966596, "uuid": "0f0cdb80-541a-4061-a453-f555430158e9", "comment": "Malware payload (Mirai)", "value": "178cea07746133dfe4f72fe0fc49ef68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966596, "uuid": "8755c164-cdf0-482b-ba53-036c5164d313", "comment": "Malware payload (Mirai)", "value": "1214d108e59c54c3f6f548ccdeab6be49ffbf71b68957834878282686e745e96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966596, "uuid": "b5084e65-eb36-4998-96e2-fd972fd7b397", "comment": "Malware payload (Mirai)", "value": "eee557fc4244f058106063a48d1fb8786e566f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966596, "uuid": "4707778a-121c-4568-b4c0-1a0b77483273", "comment": "Malware payload (Mirai)", "value": "1a6804b9e464f486ed71a502656cb10ae2ccc038133c4e4a4871fc4b3636e69b37cf5dad7f4b14fb58743285176e5bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966596, "uuid": "8fce4aac-3b9f-4ef3-be13-cb00bc94699f", "value": "T1F8539EA6C819BD94C4008334B422DEB42B63F40596671EB98E8789955487EFCF61F3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966596, "uuid": "8717ac99-242b-428c-87fd-4579f4f22726", "value": "1536:Oa8tF/MUQ75ifwt1ARSAmJF/Naz/TlHmrmCwM:OXttMUQ75QQbOTlmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966596, "uuid": "d6889719-6803-49b4-a303-62ff6c10f0ce", "value": 63884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966596, "uuid": "0c3166cd-3751-48b4-b9ba-d447b8eae715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966596, "uuid": "7ffd818e-4dee-42f9-b7ee-3ab2c7c750e0", "value": "vcimanagement.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970b12f9-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987174, "uuid": "ca44c1d4-3387-4d38-aab7-01c55991570d", "comment": "Malware payload", "value": "f792fc821c05ea423778f0278f2dbbcd", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987174, "uuid": "4585c6d4-f247-4d6a-98a3-926038806720", "comment": "Malware payload", "value": "124703ef83ffabc18d5c2b35c8864bd99b57158b3fb21c6ffc91970172d66f04", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987174, "uuid": "5f4c4956-6872-427f-8897-98dde71d3b47", "comment": "Malware payload", "value": "31d700edd61c454ea793e80e79505be7ecef922a", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987174, "uuid": "aef34966-424f-4cb1-af72-8769861e68ef", "comment": "Malware payload", "value": "16beb94c1f3b68f6581701d87564e7301b794f1858048e74167c6aeb994154a9aeb9f691c80c0c6da6ba1b9b06334007", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987174, "uuid": "49e8a96e-5107-4b7d-8bae-ce6adf7d488d", "value": "T182D42313E544483CC2EFC6B5CBDB8913DB15B8AE392C1E8A93CDE6A4951646037F93C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987174, "uuid": "88b071e0-f0bf-43d3-b54b-aed374e6832c", "value": "12288:QuprjNqlw7vZBCSeBlOChl3/2V2eP1sI5jPwZVn4zFQtXd5XWB0FrHGX:n5Bq29ByHOC0rl4n4ZUN5my5GX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987174, "uuid": "36cd27cb-5c3b-4f25-a708-3dfda93e9916", "value": 634351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987174, "uuid": "5457fa80-75b5-406a-a42f-48987c9b8cca", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987174, "uuid": "ec220daa-5202-484e-9f00-f084700cd885", "value": "124703ef83ffabc18d5c2b35c8864bd99b57158b3fb21c6ffc91970172d66f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f797e2df-7611-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782995496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995496, "uuid": "cfdf3dd3-0a80-4bb4-b1d2-fb4e4585f1bd", "comment": "Malware payload", "value": "7d5dc4cd4de21632f8daf21f9038e0b5", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995496, "uuid": "328e0182-52ff-4da2-bd97-d0a7650d8cbc", "comment": "Malware payload", "value": "129a8e84e98d3c03742f8dc2875dac76162c0ceb5e128c29eb05598f21c5d9ae", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995496, "uuid": "206e6926-b337-42fc-8412-82777cd8d017", "comment": "Malware payload", "value": "5febfbdafacec52ae35af76303a18c94ea6d5cc7", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995496, "uuid": "157b1064-2308-4505-80d8-747257aadb23", "comment": "Malware payload", "value": "3c8c48501b48dd1bb8e1390ffd77d91e32fc48f28c62c88683674088fe3104bec9fe6515fbc07b065c4ef7f32d81c7cf", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995496, "uuid": "700df4a1-5089-4ac1-b47d-6a860657738c", "value": "T15A76EF13D5EA8EF4D11BE6BD4A629332AA14708C5E32B12C25D5F3666FF0D38A15DB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995496, "uuid": "fae146a7-1e93-45ec-a78e-6c3b1dc61f2e", "value": "621f438e5ae84c0a14d766cce7016b6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995496, "uuid": "89691b4d-300a-417a-98fb-c1551418ce6b", "value": "196608:Otkw49t5fNbuQTgEJyTJitRjoInErzvu:cMt5fNbuQTgEmifoInErzvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782995496, "uuid": "ae011086-5769-44a2-9272-a1b1aad64811", "value": 7348224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782995496, "uuid": "56f9acac-8769-4d3c-ada0-a4d566452dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995496, "uuid": "aa8ccfe7-cbf4-44e6-8eb2-fc36a0e4a842", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3228da14-75e1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782974549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974549, "uuid": "9ac4defe-d7d5-448d-afbe-120b68f6d4b9", "comment": "Malware payload (Mirai)", "value": "5b7c7589fdb739664605108744edc441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974549, "uuid": "03b40a6d-a7ba-4741-84b2-9475153ee7ba", "comment": "Malware payload (Mirai)", "value": "13013ddeeaa5187dfd668a5715046b251b62b572bb9af64001decd7928bd2798", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974549, "uuid": "783a5a2f-c295-453d-9b1c-36071a5f3f9a", "comment": "Malware payload (Mirai)", "value": "ef4078a0b56ec62df59d8dcbe55fd18c3dd52af8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974549, "uuid": "0a62ee77-5577-4cd4-a857-83518b40fbc2", "comment": "Malware payload (Mirai)", "value": "bb321e3c48e3a9cd3bfe340ba7bfd74723ec9d520fe4d6bc02afa32d21b919115636b1e14c01770e31527e0de5b888d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974549, "uuid": "4534aeab-75d8-4bf4-99dc-423550343b9e", "value": "T14ED3C71AFF500DFBD81FCD3705AC174634CC960762652B753674DA2CB68A94F8AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974549, "uuid": "8ba31d6f-7ebe-4fb5-8d54-c35c14fe3d1a", "value": "1536:mWv+YNP4nwFnQB3FA2p5ZG/VwR5flc9vZ5BlYgS5AV1B3BbBw7k0NMKR9F:N+ePywercdDBjV1B3p2lZR9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782974549, "uuid": "36cf14be-50b5-4bb0-bdc7-758105368aa7", "value": 131116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782974549, "uuid": "73dc16c5-77ba-46a1-9e97-2903dffd6570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974549, "uuid": "d4c9621b-c572-4ec6-bbc3-8cfb45bf4104", "value": "lyV", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0bac6e-75dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782972579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972579, "uuid": "1d2c7159-0970-458f-befe-cbfe927d1160", "comment": "Malware payload (NanoCore)", "value": "82ee6623c299c6390197d616003839dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972579, "uuid": "390161a1-a76d-49a8-a645-2905abbb51de", "comment": "Malware payload (NanoCore)", "value": "13bab9f76e7c622aa132da33387b1a6f46f7882e02426e7a4e3b3510a7618bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972579, "uuid": "2a74ad38-85f3-4dea-8bad-9a33b76d3e8a", "comment": "Malware payload (NanoCore)", "value": "8962258e08dd8c6bd229ac04cefce47e7391fd46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972579, "uuid": "2232fb8b-4998-4649-9825-76a773afee54", "comment": "Malware payload (NanoCore)", "value": "2b9fe7ab5eb5817f21215ae050eca871c506ebc9efd8de71621650f2a50df6781280528e513fc49b42934485a2b005d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972579, "uuid": "9d77df8f-d327-4ffb-ae53-2d98696c4ee9", "value": "T199350148292B8546D4B26FF50DB2E2F09776BC66B539C51A4FE60DFB766730039003AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972579, "uuid": "d71bab8f-22d7-4dae-9b37-26b2d80a16f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972579, "uuid": "b15f8f59-c683-433e-b7d9-204b8cf8f2bf", "value": "24576:rLPFv0+5oymM0gjCBvp4iwQE/3KYj1DIziruS:ry+5ozpmTQOOziruS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972579, "uuid": "90beb65d-1533-46af-8555-946edb45fb2e", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972579, "uuid": "d574f9d9-8457-4b8b-ad7f-dfb4bed5be1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972579, "uuid": "60b97ccd-7822-46a1-9589-ecd81d25b08d", "value": "Scan#250226HPJetstar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4b4cc3-75ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782980014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980014, "uuid": "9cb4b9f5-d92e-4a82-aac3-dd1484f62c8c", "comment": "Malware payload", "value": "39c643ee3167d4261a260fe77699b7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980014, "uuid": "964e128d-35cb-491f-b1fc-7739501b34c3", "comment": "Malware payload", "value": "141631edf2f0e52ac81b23dec2e2bcfa705a0572d4ac08de1aaaf933767c1686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980014, "uuid": "5c6d2bab-9730-47a0-bbd0-2a07c2704c42", "comment": "Malware payload", "value": "0b04039bec95d080b9d6dc0b4afd9ed1453653e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980014, "uuid": "2b83dc2c-845a-4b4e-8871-2ef63f223707", "comment": "Malware payload", "value": "74d2b23b5044af957b3549381b6080c56c15730a16f16c3f3a1857b67ccbb668d442810c5f203d0c99139713c267222d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980014, "uuid": "531e3f90-7cb9-4f65-985f-ba758ecf91a3", "value": "T11BF733FAECE18B65C17B9CB84C639F28D2180BF7662633A90736D4CDBC81871C66E551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980014, "uuid": "024992fb-dd23-483a-93a8-e0c4b5617cac", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980014, "uuid": "ff095f37-238f-40c2-8408-419d90927b8c", "value": "1572864:Gt9IKPlpA0neSZfNgJtWEd5lGLcN8daRJNV2yaCOfUuolzIsAOTs97Ao7:GUKNpA0JC3xf8LHdanNV2yyfUJlM2YtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782980014, "uuid": "33df1065-aab0-43ec-a84d-46d04664934c", "value": 77128571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782980014, "uuid": "0a76efdd-fcd7-42a9-bef5-803a949512e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980014, "uuid": "b59bc862-37c4-4314-80a0-edf35ad63dfd", "value": "Make Lots of Money with Sex!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a112c521-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783009524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009524, "uuid": "501a08e0-acd1-4b48-812d-c979a774acae", "comment": "Malware payload (AgentTesla)", "value": "eedaabe39019fe93fb83c06024957996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009524, "uuid": "b5d37744-e0cf-4ece-92ba-647c46a2f5f8", "comment": "Malware payload (AgentTesla)", "value": "147d1c9d4482694aae441db2c47b61afc2514c7041c13a7e382f8c237e077484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009524, "uuid": "7f560400-9c20-4c69-b487-a2d8f2d248bb", "comment": "Malware payload (AgentTesla)", "value": "2b521a9639f0413ea6235c6858f9d5e3c95e3cd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009524, "uuid": "ef4709a0-1cae-42a2-8258-6cb9bca32f5a", "comment": "Malware payload (AgentTesla)", "value": "d175380efeee8ecbbe27273e0375a62bd55461b47cb8fa94a7e6009406b21cb79310412e8764a25b22eabbb3ad136d94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009524, "uuid": "8585de00-c394-4022-b3ae-066845737b8c", "value": "T1034512033701C436DA45817189B797278BF1D9B812635A837B6C7F4A3FB76A34B2D1A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009524, "uuid": "2e5903e6-d66b-4692-a795-626f21f203f3", "value": "6144:79X0G7HUo89Y/Kx7REeLQqNi0H8OWqaH7ZZWjoAOpnnxi:10IHUoKXxVEe2a7aHjWVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009524, "uuid": "66ad7b00-6c45-4563-bfa7-19e5559ab586", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009524, "uuid": "31b56450-10af-4d1e-ab00-8ed7f0e1c582", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009524, "uuid": "5080b324-a5ab-470e-acdd-d42ec8ce411c", "value": "147d1c9d4482694aae441db2c47b61afc2514c7041c13a7e382f8c237e077484.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40befa15-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009363, "uuid": "3450d99e-5825-4fe3-a771-bb9bc37e7d07", "comment": "Malware payload", "value": "0408b5fbc2fb2a9604b7a65edf080ffd", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009363, "uuid": "12bd961b-df17-45e4-be07-9aa0b7c5ee98", "comment": "Malware payload", "value": "14832eaabc75dbc650e0aa1c81871ad9fee28273eff329bf72de1ae032c811bf", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009363, "uuid": "65f55cc9-b3f9-40ee-b5d0-efe02f526d82", "comment": "Malware payload", "value": "34302501d7621e9316e26c9e177bd5f9c97c4167", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009363, "uuid": "a5f28fd8-3fa1-4d07-aa32-277c65033698", "comment": "Malware payload", "value": "68140570c7bc60cb7358419fe502acc1506004cd1eafa5438685d33e1206b844586c252c182350a4594e4f22ef5157bd", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009363, "uuid": "23ace817-6477-4d09-80cc-992bd868fe95", "value": "T1B714F127074E5F0BD59A6F48E4059BCF28F49869D852CADAD7BF06AB540BA41D2FC03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009363, "uuid": "04961757-7a89-49c6-a14e-2dc3697763ef", "value": "6144:CnyUweztr3Gd1k5PSpUHwcbqkjOoh/lkYMX9L:uyv+SkFUUQcbqiOe0tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009363, "uuid": "b210a714-b255-408c-ab96-1d03bdde4bf7", "value": 201432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009363, "uuid": "d75ca8a2-6938-4460-9ce1-9fb27f886a36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009363, "uuid": "d9375db8-a9c8-4ef4-a036-b5ddd8277309", "value": "Misprizeso.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b919005-75c9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782964311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782964311, "uuid": "59444afd-e972-420a-a687-aa9046750f0b", "comment": "Malware payload", "value": "1142da1d33094179e5af4ef84ef0e3cb", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782964311, "uuid": "d691535f-532d-48dd-9fd4-7072f910bfa3", "comment": "Malware payload", "value": "14dbfd961231b155965c48b3ab75c1ad551bca63ae686ec4a903e30249fa578f", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782964311, "uuid": "22f11e9c-7002-458e-bf26-e10d651ffd9e", "comment": "Malware payload", "value": "218e4636dd8e6efe1188b252f3d7a9180a8c7bf0", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782964311, "uuid": "11914980-4caa-4807-8754-cdc09622fcfe", "comment": "Malware payload", "value": "9241757dd286b6ca680c69867981e64efbb03a2eb9fe10ee1b986d919e55925e46512eaa33da5bfc83ad3f85cafe11d1", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782964311, "uuid": "58f6ac75-7052-44c5-8045-26463daf3da0", "value": "T17401469CB2BC8F91099DC58AB6B051048482D0C7E1F657C5F28E0820BF80E4D3A6324D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782964311, "uuid": "30bbf96b-747c-4e20-91ef-d9b2ec147292", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkkjt016hpnv:FzY8k1/sWi2jkwt016r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782964311, "uuid": "f86b43fc-803f-42ac-acc1-29d675a7cfcb", "value": 663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782964311, "uuid": "d332dd3e-0c66-4a7e-99cf-3bd73914a0cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782964311, "uuid": "66165fe5-d8df-40a6-a5a9-3904a08bdd58", "value": "ipmiv2.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b2bfc3-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988586, "uuid": "a81b9c90-33ed-481a-be78-c6cec2daf4dd", "comment": "Malware payload", "value": "c3d529d4cf80314984884d95d705a95a", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988586, "uuid": "afc5b4de-d50e-48f6-ae00-b11cbb505ff2", "comment": "Malware payload", "value": "155c8129d9716ca79325ddac2335c7edd87b9d712ebe22db2bc65b7ff63dea1f", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988586, "uuid": "63a64a19-7c4b-4801-a036-3fa620d41691", "comment": "Malware payload", "value": "e5040ca262529a0886dbe28214cbae87bb4a1628", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988586, "uuid": "a9157f54-6f69-4b9e-b98c-5452d8fa8d12", "comment": "Malware payload", "value": "f2392c60b93be7ff1c2b4c931108049c5a9c97fa54aa941aca1a4bbfc541de50ccc7cbc09efcbd7edbf1f2013a4c6fec", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988586, "uuid": "33748f03-a82e-468d-b4ed-30726e1e848c", "value": "T1DD25E01AF95160B9D47760B2434FD376C838AA31455798CBFF1A1D28AA3A2D09F3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988586, "uuid": "fa16ee69-3821-4b45-809e-b595a070ef51", "value": "24576:lADyiTwO40PmhChjoXHo2nOzpK4GQtOm4rrBOIWK:lAWiTwH0PCEcJOsbhrr4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988586, "uuid": "6a71417e-f26c-49e1-ae82-18e3e30d9aaf", "value": 994577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988586, "uuid": "421dfa48-9087-4375-9c5d-9e4af209de29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988586, "uuid": "5df1f474-3e99-47cb-a63f-3c05053a02db", "value": "155c8129d9716ca79325ddac2335c7edd87b9d712ebe22db2bc65b7ff63dea1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb2279f-75b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782954411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954411, "uuid": "d19f7cb1-efb8-4665-9918-8162232cc98d", "comment": "Malware payload (Mirai)", "value": "d97e7fc39534a3ff786b0f6abfedb8cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954411, "uuid": "24d8b30c-3120-42f3-8ffc-e0dd93d29b57", "comment": "Malware payload (Mirai)", "value": "15b04c03fae4a70bb8b9b14d91c156c76d163d5198fff67bab554e6f15b7385a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954411, "uuid": "cc1154bc-5947-40c1-bdb7-454e95251551", "comment": "Malware payload (Mirai)", "value": "f8d8cc30e53f699d9ebeb62337d902c783bb890e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954411, "uuid": "8fab9025-e1d9-409c-808f-dbba7f7567f5", "comment": "Malware payload (Mirai)", "value": "c4f084a85d2a70f0020b1c3d1578994df4f9fb085e9c724f750343b60fe976b47b2cb49d69f821304310620a859c5fe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954411, "uuid": "963f23a2-5f33-4a70-a958-93188361f8dc", "value": "T17DD31A45FD419F17CAC256BBFF4E428D7B2A176CD2EE720399256F20378B85A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954411, "uuid": "ee34dd76-1a33-43ab-8ce4-dd44dbf0162c", "value": "1536:CBhFErfLW09qK6s3JUnhM2uduwfoeTtwYQR96ZAOY43yYrCAuMQUNlIMwyw3+jix:YhFELLTR6s3JUSwwhJw563RmJhSxSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782954411, "uuid": "bd594d40-4984-479c-af3c-8cd127701c97", "value": 136472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782954411, "uuid": "502c4585-0e5d-486c-b59e-f277695aed3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954411, "uuid": "3f7b2928-a83d-48af-8da1-3f021c0ad8a2", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72e7d54-7614-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782996757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996757, "uuid": "1c67657e-4772-4b8e-a6f5-4df9907f0b7f", "comment": "Malware payload", "value": "ab5f81e7c0a95737a74829cb837625df", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996757, "uuid": "ce0a9fe7-6e61-4469-8abe-69522db14560", "comment": "Malware payload", "value": "1663c36bd1778005cd9a220cb1451bc9b1a182af811e7d1b695db254b5b97f4c", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996757, "uuid": "5cd7397a-94d8-4924-85ee-a6950100909a", "comment": "Malware payload", "value": "cbb1b650305baa04b2a63ae059d04897a3e0dc50", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996757, "uuid": "f87e455b-9103-4ec8-a375-c781c9635beb", "comment": "Malware payload", "value": "40365f1cec1af3292aaa9baeca58416e3d4f22d5a1580f72bdb28f0388415f181c6585c12e1e7aaf741f7380fca94e70", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996757, "uuid": "b7074492-6387-4cc1-82c3-5e0b270e7baf", "value": "T1BC51444783D8C8A6C318437D891B853CDB3DFB317B5782493B48016B6F622416943D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996757, "uuid": "6443f6f5-d4dc-4dba-af1a-a283b1b625e5", "value": "24:etGSKN79OctWtokRENCn/sztx48P4JIgQ17H8QkxPnRuV4MPgic:6KN10aYmttx43waRRuqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996757, "uuid": "9d2dcc20-816f-4008-9e99-327d881017d9", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996757, "uuid": "129ad25b-395a-4eb6-af6a-a43a5b34dfa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996757, "uuid": "e475d871-a383-4aa7-bae7-2b31e6efd273", "value": "sc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb17607-7631-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009252, "uuid": "ea935ea6-d4c6-4f77-834e-7aa34cc75b83", "comment": "Malware payload", "value": "d21a12732497e419f1affb06dc75f8be", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009252, "uuid": "da69e767-2753-4f87-8cf2-438b288b2d0d", "comment": "Malware payload", "value": "169e3a72243520130f8654723b69d045e7b37b85eba6c1435ae4f337e7e11899", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009252, "uuid": "bcbcff70-97b2-402b-b977-9b3b111654ae", "comment": "Malware payload", "value": "b9a00703eeb1cad47c37a73493ba84de501e49f9", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009252, "uuid": "aebb72cf-fc4e-4ac3-bf70-746bab59be17", "comment": "Malware payload", "value": "5018f4827fb2099bd76a3bf4e85cebeb00bac40b64a86812163b7e40b45229c54831efd40ff85b9d440940b60b585ec0", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009252, "uuid": "edcf1d81-7522-4ab3-9525-86c6d703d8e9", "value": "T114B502592BAB24BAD703C795A655CCC9A9EA84D9B3900BFC3E49DC6D0F303C4A550FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009252, "uuid": "c77a16cb-23fa-4281-9b30-32e9053bcb36", "value": "768:d666666666666666666666666666666666666666666666666666666666666662:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009252, "uuid": "cfa325cd-85de-4aa2-b6c3-f22a412edeb2", "value": 2308507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009252, "uuid": "4d96f792-dc9c-43e9-b55e-27acc6e18767", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009252, "uuid": "df0c81dc-ce06-486d-a947-f3a9019fffd0", "value": "169e3a72243520130f8654723b69d045e7b37b85eba6c1435ae4f337e7e11899.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a80c627-7667-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783032250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032250, "uuid": "6cd24fa6-ce1c-416c-93f4-5a40c32c9183", "comment": "Malware payload (SalatStealer)", "value": "a4cd834ba9819b28bb0a45a90f34f45b", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032250, "uuid": "7ec49220-28f5-4d65-8235-f5af0bda3e5a", "comment": "Malware payload (SalatStealer)", "value": "16e34d5b3836f196864a8efe804d8dcb5938801d29bed451a3b67dca6f7b0929", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032250, "uuid": "c77f9897-defd-4300-886e-20e122087a3e", "comment": "Malware payload (SalatStealer)", "value": "8e36e4e662812bec78ba97cdb43960743efc2bad", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032250, "uuid": "95cd235f-aeb0-4e08-95d6-8e284abcba9e", "comment": "Malware payload (SalatStealer)", "value": "92e7397e637e80cb1678e1e2dcdf137d8813fdf9d25ec35ca8681aef98aedd10c3620988082a3c93a240c9e3630cc5c2", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032250, "uuid": "5728a505-a56f-4808-b118-9bbcb124bbbd", "value": "T1B926E1037BFEB05AEA7B97B4947462814665FC774D51808E31CD048B4F9BA407EBC2BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032250, "uuid": "0ea49eb2-5a5f-4064-820e-e7a60a3e3a61", "value": "645ebc07ea47a6f1018aae85547b08b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032250, "uuid": "033e0cca-5e53-47d5-ba3a-5db9126f79f2", "value": "49152:RHOlsXUMuthG59/72yB08wlTPv9RD+Y1qEkvom1UYRos6lcEutlnuAcxvTdVIrCB:kLIGKwp39GEkv1ZKe7nuACbdx9oefA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783032250, "uuid": "a187deaf-f5a9-4a68-866c-8a44a85cd2ae", "value": 4721992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783032250, "uuid": "726496d3-1805-4d32-bbba-ca331399af4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032250, "uuid": "e59ace2b-3910-4599-a004-b448aea7eff1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dcff43-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782989588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989588, "uuid": "5c64a3bf-285c-49de-a2ed-fc71abead6e8", "comment": "Malware payload (Mirai)", "value": "b17d801ab7d81819a8f241abb6e36fde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989588, "uuid": "81eabb36-8280-4c72-bfc2-78d724f5ce55", "comment": "Malware payload (Mirai)", "value": "18bc5a5bef344e30eee238cccf542fee677f4fc631551aa7a7d87bd339607ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989588, "uuid": "edec34ad-6aaf-4617-a28d-0eb9b949740e", "comment": "Malware payload (Mirai)", "value": "2262f569f10713cebf4060b9e48443fac9a931ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989588, "uuid": "e7df477b-9fec-4168-aff2-2d19230dc3b0", "comment": "Malware payload (Mirai)", "value": "862b1339de3af89918c336e8d27a432634df4fe22bcb221c1cbdb6f88b7c907ca17748ec17102291ea7ac59d81d5e204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989588, "uuid": "3f111479-b598-4fa5-b8c2-62342ac25d00", "value": "T18C347C07B58150FED8EBD170474FA237BB33B88953247A5E26A46AB12F36F50670E781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989588, "uuid": "dd67c0e8-2d2f-435e-bd7c-6a3c94ca03fb", "value": "3072:P6aVHOHRkfYHQHhRY62z3eMxuRwg3r9+jskN8nYcG9C/R76SyHTR18bwLmdh:yW6kfYHQHnUANr4se689CpuSsR1PCdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989588, "uuid": "b30d8f09-3465-41f3-84fe-0b37997c5306", "value": 243312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989588, "uuid": "5b474a9a-db0a-4cdf-9dba-fa12a1c6f7c7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989588, "uuid": "cdfd44d9-4dd9-4183-84e2-1da45e25ecab", "value": "18bc5a5bef344e30eee238cccf542fee677f4fc631551aa7a7d87bd339607ddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7b2893-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036550, "uuid": "fef2e71f-04f2-48b7-8edb-9326011c072b", "comment": "Malware payload (Mirai)", "value": "699eb8d8dc5db7d65f246f764251859e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036550, "uuid": "db3c129d-d84c-4591-b975-b9101751ae12", "comment": "Malware payload (Mirai)", "value": "19242bfef334f4554ee013586a0265adfe503496e2ebac07f922bd3ce2a9e37d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036550, "uuid": "66481828-7cb4-406c-8775-ebf56e4a742e", "comment": "Malware payload (Mirai)", "value": "509e4f12eee205f1fcd45c72c76eec84899237f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036550, "uuid": "765c28a7-3a77-41b0-afe4-cf644f0e49fd", "comment": "Malware payload (Mirai)", "value": "6357d07a5172cc195866819fef42f29dc0d828b0d38db0cd65234e4491c4664a0b6f29a04409a0a10aa2c9038ea1656d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036550, "uuid": "68389bf3-03b4-4549-9696-32172abfecdb", "value": "T12BB33AC1E64FD4F8D91641702267EB379B32FC76013EDA93D7A49B727C93A4198062AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036550, "uuid": "e3fa297f-0668-48e5-b3ea-75b5f1d753b5", "value": "3072:KJFrpq7W7PTL9rH5crC3MFZnKOiKYW9iHGNIiP4r:OG7WDTL1H5crIMFZKOiQL4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036550, "uuid": "199b210c-4f37-4c58-ba5b-a26cb0af644d", "value": 116016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036550, "uuid": "ae6dffc7-6708-4b64-b9dd-ed8c62e57010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036550, "uuid": "ff2a8dd6-b975-45cd-8137-5278217bd1db", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817b7cf4-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783003458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003458, "uuid": "e5790eeb-8674-4df0-a02d-06bb956a1e55", "comment": "Malware payload (RemcosRAT)", "value": "f9158f928bff45d130cc27d4ae20aee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003458, "uuid": "f7608a2a-528d-4615-a36a-7526ee9e4934", "comment": "Malware payload (RemcosRAT)", "value": "193863103749d8b2f536cef7bbac7e9691f96742962c5aea4e9f6604db0c4aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003458, "uuid": "a3b59790-3a91-422f-bc57-e2791d825209", "comment": "Malware payload (RemcosRAT)", "value": "d307f448f00cb89fee296eb1144ef414905902f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003458, "uuid": "d383493f-bd85-4db9-9a15-9b6a50be3bb9", "comment": "Malware payload (RemcosRAT)", "value": "28b5529ed249d4509f7a47121443aac952c32d7f6a3d859c69eb13c541aaee96ac7ab77264ed803c4f9580b11a238d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003458, "uuid": "b205f9cd-a5b5-46df-95bd-0b066fae9398", "value": "T188B4BF01B6F2C1B2DA7654300935E735CEBC7C21183699AB63D61D5BBD30291DB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003458, "uuid": "04ab400c-d7e9-4a42-8e2c-13a8f678b07f", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003458, "uuid": "1a2d7d1e-46f7-4316-815f-4fd3768e55ec", "value": "12288:U97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOrDs:UlxDmRnkvVkhYHk2c+DZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003458, "uuid": "cfa62279-3e56-4a07-a65e-524c73aadb4b", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003458, "uuid": "39a2a4d3-ce6a-40d8-8b14-fe63cdde6f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003458, "uuid": "785dba35-0bfa-4849-ad91-e794a538584c", "value": "Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93c7cd4-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966669, "uuid": "44c50f96-c47b-4f1b-9740-c7fc7218e7ef", "comment": "Malware payload (Mirai)", "value": "72b056d9eaa945fe5b8814103bda1640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966669, "uuid": "c2371923-2a38-4516-902a-8520f70aaa5c", "comment": "Malware payload (Mirai)", "value": "19fcb0877dd3375c036c5f3093bf1960d75710de97958cff8ad8a14f63ab9369", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966669, "uuid": "54c3c65d-5957-44df-b747-869db8f91cf8", "comment": "Malware payload (Mirai)", "value": "a4b745efc5d28ea873e4866fcf77b92354c7c81f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966669, "uuid": "7d67faeb-78dd-4b60-96b3-69a51eec3ec4", "comment": "Malware payload (Mirai)", "value": "3c3ac008c8f2c791e9b58ebda30bf23939c1e8909664e5c005ce6ba90378b1b2f96512fdce20e8d7531bfc0a33111359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966669, "uuid": "7f2b0bc4-6ee2-47c9-9113-9ff58e596c84", "value": "T1E133E8527DC26A2AC2E0537AF9AE81CE332067E8D1DF7257CC211B0476DA55F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966669, "uuid": "242dde4a-ebb2-4fd8-b86d-44d4d9fbd1a3", "value": "1536:hCqZI1iDUguHppKKOxgPg6osAvH3Y09WZoh+fgh8l:XZeAPD9WmhA3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966669, "uuid": "725099af-37a2-4ebc-b533-ae812213ee4f", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966669, "uuid": "ccde5547-cd99-42e8-a632-052d1344fdfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966669, "uuid": "d6405692-8bff-4689-a1c0-73997b998a9a", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdd1d28-75af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782953387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782953387, "uuid": "2b18adbc-e879-4446-a9da-c148c416efca", "comment": "Malware payload (Mirai)", "value": "77fccd17a8c1695fc2ae89a0c10b1807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782953387, "uuid": "81df8feb-9ca5-42b9-97f0-df07eb6110de", "comment": "Malware payload (Mirai)", "value": "1a0342c1c562ff1527627192d8ea3be9aedde4b47c5436d5f2bcb924d9725397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782953387, "uuid": "c12a567b-fac8-4a34-b8cb-c9f806a96c02", "comment": "Malware payload (Mirai)", "value": "dba2daf4ef806d2603da22ea895d659052ddac93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782953387, "uuid": "16728323-2e84-498d-9c4a-e68c23489fe4", "comment": "Malware payload (Mirai)", "value": "92988685ce261b503b73d195e47d56268a12a409f99d97824a39bed0028a27a04286257e54ba68c39641268ecd40533d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782953387, "uuid": "466ba38e-6046-435d-9637-b2badc7df6a9", "value": "T182C30649ED416F01D9D636FEFE4E028973534B6CE3FE7101AA245B2127CAA6B0F7A105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782953387, "uuid": "a6f4c66d-df77-4a30-a13b-e2939d545d54", "value": "3072:eoEBSBlUvKO3Qhx+nv8Sta4cYC/2OA2J+McDHRrnvIwueN:ZEUBlUiy6x+vRta4PC/2OAc+jHtvIwuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782953387, "uuid": "132d639d-6ffb-41b4-bc9f-52bf13feb177", "value": 124640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782953387, "uuid": "848b5cf3-7abd-45bb-8748-14a63fe73a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782953387, "uuid": "1e516687-824c-477a-8137-2fdb168bb87c", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5069cf4-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036670, "uuid": "34989ca4-ec9c-4936-af2a-3fdcb54e183d", "comment": "Malware payload (Mirai)", "value": "050e7cf7cca5c79fc7975a8d73e7585d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036670, "uuid": "88aa5d56-f256-4cc2-9e31-3af0d0203ffa", "comment": "Malware payload (Mirai)", "value": "1a06cabc732fb4ba0c71b49ba648edfc1af4e138580cba520c00ee483f574b1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036670, "uuid": "aadc04d0-b8c1-4e46-aaa7-c6266d6042d5", "comment": "Malware payload (Mirai)", "value": "6ec57e3699dde519a44d09340d6c52617a99e02a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036670, "uuid": "c44d85c2-3288-4eee-9b7a-8d527af10362", "comment": "Malware payload (Mirai)", "value": "880189bd21da2d0c7807a8eddc98b8c9e3220f45a86a69c3b55591ad5869225f936413c312f961bfacb39ac7091da3bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036670, "uuid": "0659c662-f829-4b4e-8e38-f5b4ac41a27e", "value": "T1CFE34C85BCC28A22C5D513BFF92E018E331267E8D2DE7212DD621F24778796B0E77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036670, "uuid": "1fe01c51-844c-4111-9813-918cfb0730c9", "value": "3072:IsxfP/ROdS5DMbCl/t19iEG5VH0aVxbZlV2q2OeO4Y:tGswbCpt1Q5x0alKq2W4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036670, "uuid": "5f0dc516-8039-4580-af6d-10e9fa6fc02f", "value": 153204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036670, "uuid": "db46468f-5166-4450-84b3-e656d1d1b75b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036670, "uuid": "0d8aa651-85a7-444f-a904-e9c98a13efc9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4bbca2-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988580, "uuid": "8bff512c-c58b-40c5-80fe-8d0dfb1cebcb", "comment": "Malware payload", "value": "f35638fda7ab048f8db9db2a073caa00", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988580, "uuid": "26f32a63-088c-4274-9816-127339a201b5", "comment": "Malware payload", "value": "1b5db2a95e4eb02874734f405603ae00b5deabee0583c3d99d316c010d717c3d", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988580, "uuid": "480edc40-8771-4691-a0bd-21ce5f4c7cf2", "comment": "Malware payload", "value": "2fbc8bcdff7932200f002db8611accbc3c18523a", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988580, "uuid": "88ac19fa-6bf0-4244-82b1-bd97af5c38af", "comment": "Malware payload", "value": "a415aeef64c598f4fe4171e9019ff4a1c5d1b732a39d85dbe4fb6763a9049a48e24009be45528451eb3820f1e7b6d479", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988580, "uuid": "4f828b88-2653-4e05-a8b2-b2e4326cd666", "value": "T129357C06EA10967AD172B4F0564FE375C8202A345123485BFF5E2D68B63E7D1EF283A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988580, "uuid": "fa15b0bb-3247-4ea5-8a61-03925a784b48", "value": "24576:AeVI+Fipy9BwDxbzVg1ta0idTv1axmuG8G7pWgWG:7i+Fi8iDxPWL01uG8G9YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988580, "uuid": "3e1bf277-306a-44ed-99de-01f459867f6a", "value": 1092168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988580, "uuid": "2bdb1e17-5845-432f-91ce-5b4d5cae1329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988580, "uuid": "c3556f4c-374b-44fb-926d-0fde0183e4f5", "value": "1b5db2a95e4eb02874734f405603ae00b5deabee0583c3d99d316c010d717c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3cf0c9-7603-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782989387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989387, "uuid": "13a137c2-47f1-4001-b9fb-c11e0473cad7", "comment": "Malware payload", "value": "78b99bb913ecef9fbd21bce90677de63", "object_relation": "md5", "Tag": [ { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989387, "uuid": "e97a0d46-bef7-4f47-8de5-88e9cca2d2a0", "comment": "Malware payload", "value": "1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819", "object_relation": "sha256", "Tag": [ { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989387, "uuid": "6577eec4-9976-413a-ac0b-10e99c7f6481", "comment": "Malware payload", "value": "e8d718a5ec38e3c085723266f142fc63ce085801", "object_relation": "sha1", "Tag": [ { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989387, "uuid": "c2723ea6-f13d-4fb1-84b4-19065e5c86d7", "comment": "Malware payload", "value": "2c1e50973242ba3831444c94ceadbbbd7f44e18fcd6ca6ce1464bb94cb2475bb23db5d160ef292db1a8ca5db5dd3e572", "object_relation": "sha3-384", "Tag": [ { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989387, "uuid": "aff894e0-562f-4360-a948-dcdb2f711fe2", "value": "T15E51019EB4610923715BAE7ECE45DA958D4B05830630DC35F52E3C283FB8E44B506BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989387, "uuid": "12b999ea-06f0-4404-9022-acd9b27b4c5b", "value": "48:HsKRDRM/Sco5whWrDztDz+ULN8swRQRfSjgVAhGiGlLIW3ptat+trtkGtVFt+ZtR:HsKBiqTamDhDCkxwq05GiG2W3pM8RSGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989387, "uuid": "9f26e47f-06f7-4cfa-b20f-309d67935b0e", "value": 2908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989387, "uuid": "bec1cf06-5c33-43b0-bd31-bc3202fa3216", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989387, "uuid": "f42b7706-2fef-4315-9dab-8e3c602d5aef", "value": "1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53a6371-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988566, "uuid": "096a336b-2382-4c0f-a2f6-9de4e6c6b5e3", "comment": "Malware payload", "value": "5e6b53bc129725bddb44b4de2be23dcf", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988566, "uuid": "cb96a23f-1cf8-4a10-8626-d730522ad042", "comment": "Malware payload", "value": "1bfbd29b9501041b086f802c7e46655a22824ab3a58eeaf5848566ad672f856d", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988566, "uuid": "ce649706-361d-4386-92a4-dd54b210fa1d", "comment": "Malware payload", "value": "66abf09568f0c507b626efcd3b353b5f529a29ad", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988566, "uuid": "a1cc8652-d302-4464-9595-f4b24e8c3260", "comment": "Malware payload", "value": "a292f0cd4136d1be4b327a67b29b0c563bdda3b9c110df666c232a1a4a1c7c41762b54aa05d6ff7c3d3e813c34bd42dd", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988566, "uuid": "13af10d2-6371-431b-8c98-04abb4655717", "value": "T19435F116EA1181B4D4B6A4B1530FD376C971A6305163C98BFF4D0D68A63EBC0AF2D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988566, "uuid": "1d8daee6-745c-48cd-a1f8-e18139e12f2f", "value": "24576:XlEoLPFRcFw2+TECJQiLx1am84l8QCtdWuYQdGdfYgYuFKfvkFCT5DHUtY:XlEo7FRcFzCRdc94l8dxkdfYCs5ItY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988566, "uuid": "3f2dd29f-d3c3-47e3-868f-51c79b23a4e3", "value": 1144750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988566, "uuid": "836ef02a-ac56-4a03-81d7-a78ff0808b18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988566, "uuid": "896f353b-4593-426c-bd52-35f8d236df06", "value": "1bfbd29b9501041b086f802c7e46655a22824ab3a58eeaf5848566ad672f856d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f0cd0f-760d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782993753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993753, "uuid": "73190569-1321-45a7-b9d3-a211a8e240a4", "comment": "Malware payload (SalatStealer)", "value": "6b98948154e2e58689c535cbed1cb0e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993753, "uuid": "5170d7a5-d6a9-4102-aeb5-31bb53fcbbce", "comment": "Malware payload (SalatStealer)", "value": "1c4948cac8289b0f94ce49f76bc5aec8024c9a7b1d609bc1f2fc6ae0b52c2456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993753, "uuid": "a21a7dab-6931-43c2-86a7-525b28d59ad7", "comment": "Malware payload (SalatStealer)", "value": "c1fde6836c51f4a23cd636c571f4124ab506d309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993753, "uuid": "7420aa53-43c2-4112-99fc-db92b5bc72b5", "comment": "Malware payload (SalatStealer)", "value": "4544f4d25b1e9788a433944ccebb8c5422d69d53f060166a3ac8045653ac3e66d13a76a9433aaca0043efea0fa0f5cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993753, "uuid": "335aa864-c4be-46aa-a5bb-21b3345889a1", "value": "T1EAC65A11FACB54F1E903583144ABB27F23355D048B28CBDBEB583B6AF87B691186B345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993753, "uuid": "85bb5b38-7a0b-49a6-878f-8f3756869133", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993753, "uuid": "2ec12c1c-8c29-410c-9c06-de808a02d6af", "value": "49152:d7cYd/E/DhrEkkbgpE/fctYrAnbFbolUrEJmO/dJ63S+rfEfw+i1W1DTHaijwunb:eYREBEsE/0erkcp63NfEf1D2J4oCEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782993753, "uuid": "52b0c2bc-0c71-4d7f-86ee-fca9cfd482f9", "value": 12579328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782993753, "uuid": "3f8e8b68-71c2-4336-acd0-009048867e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993753, "uuid": "a5c4a4ce-07b0-4b58-b2c4-fbcba62d40e7", "value": "Patcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963b56a3-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004352, "uuid": "c39ac6fe-3c61-42e9-8d94-285f557448dc", "comment": "Malware payload", "value": "1e09854c33f885f5f1d42b5e539607c6", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004352, "uuid": "2d9fb1f4-9e17-4bd2-aa3b-5b2b70b9eb62", "comment": "Malware payload", "value": "1d97f8703f3e94dbb0e8f6a464a3dfbf31d6af073637f4cbd87127daed555391", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004352, "uuid": "1a784bf6-adfe-4887-bfff-edfc88d986ea", "comment": "Malware payload", "value": "bfefe0cb64c27189ec8b9e541c7cd35267271b0d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004352, "uuid": "ed39850a-f1e8-4be8-8f44-6d4a6296073e", "comment": "Malware payload", "value": "c14b0eb6ec5992a3cfca594db97251396982017255ca97e07926e57560cb14e0859125b3f8421fb28d290dda4d9c229b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004352, "uuid": "6977bf53-3ebb-453d-98e1-f5cb37f86dd2", "value": "T16735124C7599E549C37547B2DFC2C0D2910EBC679E8A811B328E7B5F3F32DA1AA4314A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004352, "uuid": "e41e296d-436b-410b-a77d-e553eed2a1c1", "value": "12288:PAPXRC3A+79QG0WW7zqzjP1wRBME1LrwCJyzcdd1OJRR3c9B2xzfArBP3C+rRIYz:PA/EkAPErjtOJ3jzfyB/zeYiyKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004352, "uuid": "f2b46d20-bbe4-4fd4-8db8-275ad3bdc003", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004352, "uuid": "1356bf5a-2629-4ade-85e7-74ba14ade92d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004352, "uuid": "b83b126a-d983-4c45-93e2-e27c4264360a", "value": "doc36918720260701171934_pdf .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92804fca-7612-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782995756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995756, "uuid": "66a70db9-819c-4c4f-8090-6b649a3d07be", "comment": "Malware payload (Mirai)", "value": "a5e2a22e729d4dcc04549edc59bf96f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995756, "uuid": "274cc42b-3b42-4c06-b4a4-a1a4c6e82929", "comment": "Malware payload (Mirai)", "value": "1ee5ebb9819b307e23d59f80245a80294a7d66ff6f6e1f2666015172679afe3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995756, "uuid": "36ee610c-f87f-4516-977d-e2ff238bcb01", "comment": "Malware payload (Mirai)", "value": "001b2816e4bc3c5880eac3b0d6ec607adb6448eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995756, "uuid": "627e0ae2-a6c9-4bec-b415-7054323404f8", "comment": "Malware payload (Mirai)", "value": "76aa11166c75bb600d15273e3745726b6deeca0f26e51768cb08316d5700edc9c0d56c196d6ab37eefb2d0cbcc13c1da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995756, "uuid": "ecc178b1-2420-4e64-86ed-6cbb8d072a09", "value": "T1B9F3DA0A9F510EBBDCAFDE3706E90A0139DC954722A43B753674D638F54E90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995756, "uuid": "b1635bb4-24d3-4be6-8b9b-16b7a7c687bf", "value": "3072:Z4JO4BpS3Jah21pkoPIaShSEbtO3wuE9:Z4FB6JaQ1KmJSg4OguE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782995756, "uuid": "1c1097fa-68a7-4da7-8d90-36c247688e94", "value": 161752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782995756, "uuid": "733db81a-b36d-4de4-8b87-2162828e6053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995756, "uuid": "1739c262-1a39-4acb-9808-4e80188d4eaf", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e8d23d-765d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783028127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028127, "uuid": "aaf8c725-5462-4397-b63e-4549e830e9ed", "comment": "Malware payload", "value": "9a6f930bc7c4019de3b8ebfee6a2833c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028127, "uuid": "cd0dde83-fb5a-4bbb-9280-972b790d937f", "comment": "Malware payload", "value": "1f30b62c19be5de98456ec6915f1618da92cab68f20bf36cf91473788437f87a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028127, "uuid": "9c786435-8c65-466f-914f-1aa4e6411165", "comment": "Malware payload", "value": "e84e6ca409c5233479e322b992dd57e796eed02a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028127, "uuid": "0c2920cd-6900-4a29-aecf-9284d4f56b01", "comment": "Malware payload", "value": "92038f6d57b2dbc2e2bbb93df11a3f7bf18e161a6c4893ab9c58b4ee9f6ca26adf2e2a2cd18ee7fa36f2909281ca1b30", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028127, "uuid": "930ff164-eca0-45a0-b3c3-64c2cff6f2f5", "value": "T11676F1EBE39056AAC6FA12B50836693C80174E754FD3C1C79A44B33D64F71E84F68AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028127, "uuid": "17a85023-fb2a-4941-9e1b-77ddb879fca8", "value": "98304:rvqDn/p6WLVrKR88MVqSTBOZIAnOWwVIxKR7qtIhTUdCDGhD1eUdXaIrpblNsN5g:2Dn/BVGTjSmKZsCDyVsuJNsdi97fkjzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783028127, "uuid": "76e28e31-1e00-450b-a233-bb51ab8792fa", "value": 7183230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783028127, "uuid": "df5ee8a8-e62a-43ff-aef0-c00fa6dc5aab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028127, "uuid": "fa398423-4e2a-47e7-9356-93a33abdf9f7", "value": "\u06e6\u06d6\u06eb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ca59d6-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782989582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989582, "uuid": "1d914d24-f00b-4d7c-a817-123519119549", "comment": "Malware payload", "value": "f7c1d1d27ff5072ff18139bfcab097f4", "object_relation": "md5", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989582, "uuid": "63851c99-6a3e-4a93-9831-a368dc86e887", "comment": "Malware payload", "value": "1fe59cd7e8497685844ad7d97874a7254f6be4fb1537ab7eaa099f85c0e30344", "object_relation": "sha256", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989582, "uuid": "b061f864-8835-40ac-b088-465471d489e5", "comment": "Malware payload", "value": "cc888942d99912ad23c14387035965b1febbbb33", "object_relation": "sha1", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989582, "uuid": "d3088711-06a9-467e-baac-dfde4d31be8d", "comment": "Malware payload", "value": "2a1f68106df4f05e856674fddfc52c30b39cb04d541bfd66eb2b6c1d5d4b9e0e906043e7034971bb7e8ef350a25014dc", "object_relation": "sha3-384", "Tag": [ { "name": "igmc-duckdns-org", "colour": "#EB27CD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989582, "uuid": "f5451a2b-a115-4b5a-b8db-a50bd81a5c0c", "value": "T1B891858C1160A3343C7A9D7779D50D18A282C3B2A6E52FD17ED6FDA457C8E372B88681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989582, "uuid": "444e732c-4163-4414-8354-05c8151280e3", "value": "24:vt7m717m7Qwtft7m7Y7m7TNBft7m7027m70daft7m7N7m7oWft7m7e7m7lhJ1ftq:vj1gtgShINvsQtknZxr7C2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989582, "uuid": "a91827a1-05c9-4af3-b823-d6fcb1dd8e2b", "value": 4230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989582, "uuid": "3c8a9f76-b4b2-43e6-964f-acb38cb0eae6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989582, "uuid": "223c82f0-1967-449f-8634-56cf611da4b9", "value": "1fe59cd7e8497685844ad7d97874a7254f6be4fb1537ab7eaa099f85c0e30344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c00c39-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033455, "uuid": "6b11d0f0-d44d-4d7a-8913-26fee2a75477", "comment": "Malware payload (Mirai)", "value": "f7c3a58268fcd339afba309a965e9dbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033455, "uuid": "b9a87655-c71e-409d-845c-497f038e09bf", "comment": "Malware payload (Mirai)", "value": "20161e9b6edc8c42af263a9099a5f285473da5c4935a600f373b7da8a3111515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033455, "uuid": "46c7e76f-21c2-4543-ba64-249de9ee63e6", "comment": "Malware payload (Mirai)", "value": "f005b873b0e4809ac5c6403fb4d82ef92585f45e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033455, "uuid": "55aadbbd-aa98-4f00-ac5c-fee634746a96", "comment": "Malware payload (Mirai)", "value": "fff3e6d4a25c6e7a8344d4a8ce9935a8f0ace23bec97a58b0396ed855cc46b9ac4fcf18e7a5b96925d5ba50739cad468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033455, "uuid": "094f7501-601a-4693-b982-47ff38c52829", "value": "T1F5B3E085B210AE55C02672FCB1870A9093B17E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033455, "uuid": "fa94d72b-5528-497a-89e3-780f59b2987f", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wud:as5zqhr5Nzy7wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033455, "uuid": "715ac6a4-c465-4646-b9db-c41809436cb1", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033455, "uuid": "1f7219f6-9c9a-4215-95d8-7da3ec7ec257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033455, "uuid": "d1edb43d-9d16-4c5d-8608-322b67035ac3", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e98f68-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004170, "uuid": "d3409089-ea3e-4b78-8f1c-3560435b79d2", "comment": "Malware payload", "value": "18b45ada38bafd387af968ee10ee74cb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004170, "uuid": "334e7c71-00a5-4648-b9e5-a21f02d73498", "comment": "Malware payload", "value": "22b64786cee07bd4e8b11503da27ae4f56edff35b3d32716ddb4f8aabedccdd5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004170, "uuid": "49c17f41-782e-44e2-bff1-68ef53961f7a", "comment": "Malware payload", "value": "b5551e46b6bbfc9e3d031dfed1285f23afae807d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004170, "uuid": "eb8538cb-94e5-4267-99fe-ed624cdca377", "comment": "Malware payload", "value": "fba6704d33e29c9671b94687b750066f580aa47a905fca518db6666bacc796c3cf70941141863939975176320448dd84", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004170, "uuid": "9558aded-5bc0-4199-824e-9e6a9000106b", "value": "T16E942044C7D6050E14A6748486F2DACC58EC767BEFB7EDA0F91526FEAA39E70403E058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004170, "uuid": "32f03a5c-3bc4-4bd4-a7f5-e2ffb70cd02a", "value": "192:Fp2tymh7QsAsHBpuK2hcUcC28DmI7w6sAUh7y+Vv0F5Wlmn/57vfqR7XdKdeHQqq:F4CM+X5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004170, "uuid": "279ca244-117e-41f2-b80b-7322f1959eab", "value": 435042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004170, "uuid": "ef6dcf2d-7817-4eb1-b9fa-6474267916a1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004170, "uuid": "ae10c619-f01a-469b-b37a-1c38308c49f3", "value": "e-dekont.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21079ae9-75da-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782971514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971514, "uuid": "e354952f-141c-48a4-8d4c-5276a0ccba3a", "comment": "Malware payload (Gafgyt)", "value": "40eb2637aec6516693439501556aae2f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971514, "uuid": "8a52df51-0f9f-46f1-8137-c8d22d251ded", "comment": "Malware payload (Gafgyt)", "value": "22fc7d5db60a905b56c8263d8d9f50d43688ff57bb792683bccfc080a431b6da", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971514, "uuid": "c5c4f92a-2071-4191-8c54-a011ae885a2a", "comment": "Malware payload (Gafgyt)", "value": "0f38f2552b5589dbe246b989f0827d00a719d21f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971514, "uuid": "215f4728-935b-46ae-bc0d-69060cca5a90", "comment": "Malware payload (Gafgyt)", "value": "d8fbcd983c9494712d83a517e3d4bb2075d2845d1443b4470c5930703d3d6359669e716c8d8e9db9f61c27ff2535d244", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782971514, "uuid": "d3442293-fb69-4bc9-bddd-4da1c63c5d6e", "value": "T1A0A14FE7B0719039A4468D2062BC90D15DBAA4AAEC809ECE70526D14697FCC46F66973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782971514, "uuid": "c5f4c854-0778-4300-ac2d-8809d16e504a", "value": "48:AWH8fJ6GDkMqqfVFisPUBckaryaC1d3sJmKB1Os13WxHs1Cy183yml1MBAne1V4W:AWHM9nj0cRmZpUBNcTAOs9oQXck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782971514, "uuid": "22a1cd75-2518-4698-8dd5-5eda4e881dff", "value": 4899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782971514, "uuid": "d45075c0-d1a0-4886-bba4-e5b0e09b9ca3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782971514, "uuid": "9b9981ed-697b-42f0-bec3-5e616cd52d33", "value": "22fc7d5db60a905b56c8263d8d9f50d43688ff57bb792683bccfc080a431b6da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0731437-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782989847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989847, "uuid": "5321dbf8-3afa-488c-9544-d3fc5d083132", "comment": "Malware payload (Vidar)", "value": "08ef18196f6db2fecc0b4d470c3bed4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989847, "uuid": "4a60a2e2-78d2-45e9-83ad-a6bdd65524b7", "comment": "Malware payload (Vidar)", "value": "2391042a45591450d3869f98721803acc9b63e482b2996d4b0c9cd4a6d57cfd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989847, "uuid": "f3332159-5e8b-44a8-870d-4b500ea1e045", "comment": "Malware payload (Vidar)", "value": "7c5c94af6f2425e848c094db1e8335c766b68c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989847, "uuid": "bdd1b3e5-e400-45a8-8737-96c83dda7c66", "comment": "Malware payload (Vidar)", "value": "af385f92a491c6776e44f5cf30f6e790b76233bcdaf70968db90d98936f94303bc0c60fb4d38e308a99d2719b553ad2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989847, "uuid": "3f690d5d-1fd7-41a4-a712-8997d137dfcf", "value": "T13CF58C477DA018E6C0AAA23188B7555A7F75BC484F3233E72E40B7B82E723D04D76B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989847, "uuid": "e47a3a31-8c1d-4a86-a1f5-87a6994b8f07", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989847, "uuid": "ddb3c15c-ce8e-4f41-98d7-1dd65175be4e", "value": "49152:9oLpUV6dC7oDa28LU4qY/MviGZc0CrtpuCJYQzuSNgU:9RQ33CrX1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989847, "uuid": "27eb6245-8278-4c43-a618-82d3c7814311", "value": 3536272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989847, "uuid": "c02007f3-5a25-4174-9d4d-b7f7a851dc17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989847, "uuid": "e33f3c0d-75da-495e-8854-17063a292356", "value": "kodama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01915e7-75ad-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782952426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952426, "uuid": "02c7828f-9cba-4192-8d9c-989fc27bada1", "comment": "Malware payload (Mirai)", "value": "2f0c7ef579ab8e74cab7e5d3aa88c816", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952426, "uuid": "bd6869b1-a1ad-4cac-9e44-c1de62e4e022", "comment": "Malware payload (Mirai)", "value": "23dbb81b2e1004427f908dca6fced8e08115fb42f6928c4a639144636387dde5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952426, "uuid": "a768141b-e6d0-43fd-9c80-07ff218ea462", "comment": "Malware payload (Mirai)", "value": "cf9857cdebb27ce842dd223031aa5ee5190f1901", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952426, "uuid": "f8aa9744-962f-4bc5-8d45-ac3dba521e08", "comment": "Malware payload (Mirai)", "value": "97c53ddabe9759205aa9cd4433a97b139766dab104fb30694744da313980651d3d1e334bc978ff5c16fad490c1b8059c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952426, "uuid": "f6df8ed1-14e9-4ae5-af53-d3fd617997a0", "value": "T13F0148C68240AD10506AEA1E62E756D0B410C3CE0A5A0F78BFDDAD3DEB98D14F126F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952426, "uuid": "ec0f9340-376a-4731-99cf-3c3d8a4dece1", "value": "24:kXCKysE2hi0ziQvZohaiX4bF3/MSEMHWZBXZ67:e9Qp+MsiXGEpMHWZ9Z67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782952426, "uuid": "6d55e14c-a6d7-4953-88a5-b238a49d549b", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782952426, "uuid": "4b40472c-c5b8-4900-81f3-0678d0d89ea3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952426, "uuid": "acc971d8-8f37-4867-9d93-f23b80e32ebe", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049cca70-7638-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783011839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011839, "uuid": "675a9f66-9c76-4e07-81b1-3bf0d075d720", "comment": "Malware payload (Stealc)", "value": "d3d588d890278dd2318b41ea30ae7b40", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011839, "uuid": "e3961c70-01b4-45d3-b614-c5b37e630973", "comment": "Malware payload (Stealc)", "value": "2599fc6c97a60c08520c557b1cc551cdd543293291e60c81dc010d6dcb8a8b03", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011839, "uuid": "10715882-4766-4f61-892e-3ff5ba77c529", "comment": "Malware payload (Stealc)", "value": "22e7e6a72ef6ee81ae57cabc8da056e36a8ab7ab", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011839, "uuid": "7ea65ef1-dcd4-4278-8e8a-1095ae5d3a4c", "comment": "Malware payload (Stealc)", "value": "c281d8d065d3aa658dd8f62e15ea1ed855f80d14fb50a74354d9738b92c009df8993e0653b84c1c17b35ed61f71e04fd", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011839, "uuid": "4f420417-dc83-4c2e-88fe-90b656596ac7", "value": "T1ACA5234A13E4949AE8B72B344CF2005A91303C539A34A56F27E0BFBF2F629C5DA75717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011839, "uuid": "ad95882b-30d8-44a2-874e-1334e8ce0d6a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011839, "uuid": "36899a40-5e4c-463b-bc1e-38905744aa02", "value": "49152:2uelYuPJqzjpmLtSMDQxa0vVuOw2Rw5wl2Gi/NbsqQaipiDoKebF:Eh8jpCyXtG2Rw5wHi/xqPwoKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011839, "uuid": "f3e1501d-2cd9-4474-b26e-92975b6ea612", "value": 2207744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011839, "uuid": "ef2984f9-06a2-4dd8-af64-e6bab357460f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011839, "uuid": "c3b088d0-fe13-4a7a-913e-e5e574e77ea7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06909a2e-765b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783026874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026874, "uuid": "084350a4-a129-4d14-bbfe-85103bd73212", "comment": "Malware payload (Stealc)", "value": "3aa8ec7fb0c2f9ecf0553bfcbd6aad64", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026874, "uuid": "10311613-9c71-4d31-b868-9c327ba46948", "comment": "Malware payload (Stealc)", "value": "275035f44dc9cf992964e3954ba0af5d09e0df6b5c1009befaaeb21408cc0bba", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026874, "uuid": "0141aec4-9ece-4bfc-b896-c8658c24d1c8", "comment": "Malware payload (Stealc)", "value": "f697275f6cb26ad58e4d8debf8cec6e4f2b21671", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026874, "uuid": "e7fd2106-daa9-42b4-a558-e51828a727d4", "comment": "Malware payload (Stealc)", "value": "d720e8de9c2313937c53a5cc550885d2e1a6c62164ec567681850772f4c2b42b57fbae984e684471aee40bbc8fb600ed", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026874, "uuid": "02ee9d24-5247-48b5-8e01-277b09a446ff", "value": "T1FBA5230F13E8476DD17A873488F2428297313C546B3867FF36E81AAD5E232C2957676E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026874, "uuid": "bcf979d7-eb55-4078-8936-a6f278dae828", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026874, "uuid": "4693cc46-5c9c-4dd8-9a5a-ce26f9de7c89", "value": "49152:nuv+8ndzSduo63YpgytG0Sar8SfB6eZTHLuSeWa/rS57:Y4oYpRDrTkqTrveZ/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783026874, "uuid": "81653fce-791c-4fc7-8d49-825dba1ffa4b", "value": 2248704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783026874, "uuid": "85a84f3a-ce4e-4eef-82f2-13cd73ab8e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026874, "uuid": "570d7d39-3844-45a6-9003-a13c798972fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b95f4d1-7605-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782990080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990080, "uuid": "38ec4e27-d62e-48f4-b8b1-25876f15965a", "comment": "Malware payload (Vidar)", "value": "98e0e7fc8326e3303592bfebfd38f844", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990080, "uuid": "a9fe1878-caab-49dc-81cb-005a5ab5c3cf", "comment": "Malware payload (Vidar)", "value": "2ac2cca8225a6e8db150d95d6dda4e68179c0b55715690f566739ad79cd96f5c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990080, "uuid": "060ed751-ab83-415f-b1db-c863981d675f", "comment": "Malware payload (Vidar)", "value": "69a11ba3201e5615c0a34f8e46c149e646fa55f8", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990080, "uuid": "c873ae98-cdc6-470c-9a16-0f7872c4b8b6", "comment": "Malware payload (Vidar)", "value": "74f44b3c1906ffaf9774094181fa3dcc4441edbfaf4af68b94bedad24c7a7992a28c0d05e3c54ced7e84efe8b17c2c51", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990080, "uuid": "60d656ae-987c-46d1-8220-f92a1a506d18", "value": "T1BBD5AE1B7CE048E5D469633289B651867B74BC490B3123E72E8077B82F37BE19E7A750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990080, "uuid": "c9d49927-f71e-44bb-b366-be2d913c143c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990080, "uuid": "90514d4f-fb22-45ff-a56d-82351e1de427", "value": "49152:3r5TAliU0bN4Jka9jHuvsAmDArnhWVkwWqmX1uLqSOgiBJBv8A4+iQVAR4D:3reIAka1HNAmDArnhWVkwWqmX1uLqTff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782990080, "uuid": "87dafa2b-7f5a-486c-8949-a9e9d57706e6", "value": 3019144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782990080, "uuid": "13448e73-dbc3-4f69-8266-2ec2b68ea2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990080, "uuid": "a29c3bbe-4df8-46ac-a449-bba4972400b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117111df-7610-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782994680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994680, "uuid": "47fefe3e-4640-4ee6-ac34-4a627f18f7c5", "comment": "Malware payload", "value": "0d43847ec7b4a0194030fe7f7478d79d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994680, "uuid": "815bee3b-2b1b-46a5-bac9-ba60907e4ab5", "comment": "Malware payload", "value": "2aec88d8c5d58627295703ce4494f91f26b098260736051ea072b05c5ac5cf2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994680, "uuid": "accc48cb-785c-48ef-9960-49190756fbf9", "comment": "Malware payload", "value": "5795d23e25d8997852971eca5ac311cbcdc7627a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994680, "uuid": "377c61fa-ed53-4bf7-a682-65e4e8e399f8", "comment": "Malware payload", "value": "f4823284a3f3175ec0ff0f99f63f5c7de54ebb5cd2f52c6b460154df1eac434695d0fe7b92e4539a2493471b0937b3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994680, "uuid": "62cf38e7-867a-4ec3-a4f3-78a2075b9c4c", "value": "T159F6E7647A5B99ACD09BC47483478A66093130DB1B3979FF44C8923C3F7ABF46F28259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994680, "uuid": "6b39b5e9-2435-4a16-8896-8fb37bb39733", "value": "c9446fb871d27b582b8c30f8ca06e09c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994680, "uuid": "2929d0b8-9122-46c6-9197-75d2b88d6ae1", "value": "196608:TPpO7I5l21iYtH3+oODHdjvDAzj9NcCMzLxlm3:TPpO7I5l21iYtX5AK/9lsxlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994680, "uuid": "739f41c8-d952-41af-8528-30b676bfee70", "value": 15973376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994680, "uuid": "203e6225-287a-49ff-bb56-b22c5219e11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994680, "uuid": "2adadeab-5e0b-4df5-9877-7a21d3cf30b4", "value": "0d43847ec7b4a0194030fe7f7478d79d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e62669-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006335, "uuid": "509b7cbc-5da5-42c8-b884-344f57844e25", "comment": "Malware payload (Mirai)", "value": "1a0bb87cb73eb08de010a6226d810658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006335, "uuid": "7388951c-4b79-416d-83bf-347c7295b7d3", "comment": "Malware payload (Mirai)", "value": "2b4e4731ace2b85bbc153183f5f8c105479f4d7adbd43952aa007f964c4f8df1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006335, "uuid": "6e764568-6dd1-4a82-95c5-b3ec09c64899", "comment": "Malware payload (Mirai)", "value": "3e7fee2027fbce83c51f0a0b6b0a85ee00db35a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006335, "uuid": "5332fd2c-5a7b-40f3-9d55-2050b5afda81", "comment": "Malware payload (Mirai)", "value": "f0780e7d0ca48240166bb08ff03acd25527dfd6cdd895a1061cdd6e06acbe030c21b1f9c15383a3d4838a2f6dcad941b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006335, "uuid": "32674a55-c7f6-469d-a87a-b646e8dc6634", "value": "T131D34B07B5C180FDC4DAC1744B9BF53AED32B1A91238B26B27D4AE222E59E305F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006335, "uuid": "b657f859-7697-4c54-b933-21577aa04c0d", "value": "3072:09/SOyAEvjt6qkWYBR6sjafoH0FdBugQyDueMEPGF6IaD:09/SOyAEvjt6qkWYs18tqIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006335, "uuid": "5aa7c565-1e48-49f4-9407-1667cdb1ccf2", "value": 139768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006335, "uuid": "952a0a1e-caa6-48f2-a31c-e225d1769ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006335, "uuid": "936e19ec-2bf0-4f23-9580-6ea57cc33f24", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bd554e-7603-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782989393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989393, "uuid": "932c4115-c6b6-4790-98a1-8d0f101033db", "comment": "Malware payload (Mirai)", "value": "93898eff562e039fa05a8dae431374d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989393, "uuid": "1dbba52a-dac5-4f12-b8ce-85dbedae2b85", "comment": "Malware payload (Mirai)", "value": "2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989393, "uuid": "b3094d78-361c-4176-9efc-d19039c243e2", "comment": "Malware payload (Mirai)", "value": "714a32ff426fc0f11574d49cd24c66f4d842fbc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989393, "uuid": "20ce70c0-1265-41a8-a6b7-eca3f669f7d4", "comment": "Malware payload (Mirai)", "value": "9de2c9c8e4776fa5d35409fc42f35504556cef3c78f715a416d447362d6d813084f34cafc4e4019de7871f454d6b4887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989393, "uuid": "c1c56678-6105-4691-8aff-cbe357bddc3b", "value": "T1E8C35D81FAD3C1F1F6934AB10027F76B9B30DD254124CA99EBA26A71EC71D12856F36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989393, "uuid": "da6564eb-d83f-4ad5-bac9-fdd92b87f077", "value": "3072:kIgrKdInOj1Rk4oNIgKm9aFXafA2vR3aLZLZ3:kIgW2nOTk4ougPCSqVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989393, "uuid": "d5e06897-79f8-4df7-a660-d0ed382bd1f0", "value": 128092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989393, "uuid": "b0f17635-3313-4b64-9cc4-42a03d4b519d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989393, "uuid": "006cc33b-15d6-49b0-9ece-a2e1804365de", "value": "2b657f06f8e78a2ec60c50b2ab486a528e7a3585fabffdf0cc21311497113a75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c82a473-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783003504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003504, "uuid": "79d9636b-af3d-4508-b8e2-f4d092783583", "comment": "Malware payload (Formbook)", "value": "0edeb3baba87c4dcd9f436b29cb47526", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003504, "uuid": "3be3bc96-f315-4cd7-a208-a3ce5722605d", "comment": "Malware payload (Formbook)", "value": "2dd03e12427dc4bceddee25ee78a0459c10b04cc46966bb35ea0de20fc8ff601", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003504, "uuid": "4667fc3e-1799-4da2-b431-f2120d350cf1", "comment": "Malware payload (Formbook)", "value": "cf64672d77e0d4fb019b04ce7018f5355b37b447", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003504, "uuid": "7022f8df-86ee-4964-8ec7-d3b5bedb8f0f", "comment": "Malware payload (Formbook)", "value": "340b7c98cd57d44d8ea5156640aaa8e252eb20ae66c85763d3f27ef7b742250596e4c3f53d08a46a1eb717f6c36a05e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003504, "uuid": "a2b711f4-bc97-41e3-9df9-c341d18b6d8e", "value": "T17A1639414724A0796A6DC33EE037DF70458F20071298EF5D352EA258F96AE8F178E9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003504, "uuid": "b5193303-a1c1-42a2-9713-cf3998b579c5", "value": "98304:7/jqAqonqFh1XeQjz+LyOJ7i+wBgb3fVqb0wQZ44f2GZaBzMC9vocxOXMkWe7e2q:YX1BgbrrZ44f2ICbme95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003504, "uuid": "f11b5910-863e-47ff-a7d0-ae7ce3dd6f15", "value": 4109341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003504, "uuid": "7c87fe24-faa3-4552-a055-f466ca91accf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003504, "uuid": "e462b149-931d-42af-89ff-0ee8d162b7cb", "value": "SCAN093755.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afdbc7d-75b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782954109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954109, "uuid": "79c273aa-c467-444d-b896-76d9d4804f87", "comment": "Malware payload (Mirai)", "value": "a13675f9eff0a5cb808931df5eb73554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954109, "uuid": "0c64c097-eaad-46ff-b02b-3d24a64122fb", "comment": "Malware payload (Mirai)", "value": "2dd2d2e4b0caad0ee13ce14277b88ac1d1585b7ba1ed627d853f05ca9b171c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954109, "uuid": "bae78363-22b6-4802-bfbe-f42eb51472de", "comment": "Malware payload (Mirai)", "value": "304be64d088455bfcc58e52b10ed805259bda512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954109, "uuid": "6576bdca-b651-4ce2-8c07-ea3824376990", "comment": "Malware payload (Mirai)", "value": "8a0037b884bf2a1ef2a9e32da0099f4a8e595485aafcd75062f8687d51ca2c4074f1c28b84d25f841cd17fa8cc156900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954109, "uuid": "3a6c60dd-d8db-4e81-a745-c139fbb2f5a9", "value": "T1494302E76F9AF024CFBA8E31052D06C0DD6DFD43212B1763D5E806A5A9167EB7C90922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954109, "uuid": "7f88eec8-1cee-4d5d-abcd-feebf6a0c8d6", "value": "1536:llrrNBi1pgNEJ1JxvE8c/8Ap0aYOv7BljYN:l9y0NUMNp0aYOzBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782954109, "uuid": "80beacb3-e140-44a5-a2e2-04a599f91131", "value": 56388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782954109, "uuid": "694d2165-6814-4d20-be4a-6397e3ba1d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954109, "uuid": "e468d14d-ea98-4500-8aca-095d34fb5a58", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21a70b0-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988561, "uuid": "2dea9fe0-5f69-4ea3-96ed-1fcd28b9bc33", "comment": "Malware payload", "value": "b266e5be8052d321d11ae31386fe38f0", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988561, "uuid": "82dd649e-ab0e-494d-b17c-42d899e2df19", "comment": "Malware payload", "value": "30000bda195032c715f67a2693c6805647d27a82ade5a931569b4eaed59144eb", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988561, "uuid": "1193fc10-b25c-47f2-a678-5ab61755b8ac", "comment": "Malware payload", "value": "dc4ee98f629d77b7fda1c0423c275a731e281002", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988561, "uuid": "b3278798-e898-40aa-9d9c-e513234b3be9", "comment": "Malware payload", "value": "f2cd92d7702c3c3f9fc2625ce277571a2acb6ed266aaab49937665ede821623fdeb4cb620f3698e50d53a55c8549a566", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988561, "uuid": "59c6752c-f92f-4389-a935-9956da082536", "value": "T1F5358C06EE109679D172B4B0564FE375C8202A344523489BFF5E2D68B63E7C1EF293A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988561, "uuid": "e69dc651-b263-4073-8aba-94a9e032d1b3", "value": "24576:onbeR+ZVKyeyCPt2mxpoaC0TzvxZFTzHpOHLq:ibeR+ZVKECP0mxpomvtzHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988561, "uuid": "48f5105b-a238-4217-8338-2c701d91907c", "value": 1092168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988561, "uuid": "d4a6af4b-b3cc-4190-9cfc-d702c5e8f50f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988561, "uuid": "13c92383-0afe-456f-aec5-801b46acdf5c", "value": "30000bda195032c715f67a2693c6805647d27a82ade5a931569b4eaed59144eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e891bd6-7638-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783011963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011963, "uuid": "5139cdbd-99bc-47ff-a7f6-df04f27eb01c", "comment": "Malware payload (Gafgyt)", "value": "bd74c8508594ef351b205d6d248a2546", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011963, "uuid": "7d12220d-ad0c-474b-87e3-a47177e6f622", "comment": "Malware payload (Gafgyt)", "value": "30974a4384c6993c8b90ba89593a631cb135d8077797127a4164c7cd65836a9e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011963, "uuid": "d104b5a1-744e-4f29-9548-c2aa604d5441", "comment": "Malware payload (Gafgyt)", "value": "f08203e25a1f0b232d7b975bb6336bc10ae4f303", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011963, "uuid": "a44e4f31-f13e-4ac8-bd97-838b1b9943a9", "comment": "Malware payload (Gafgyt)", "value": "602dae0e9e6b801e2cb135c8b5ca4746187e1790f3594e452888fa98817663488de164c230c433dd1e4c8c1c9411f03a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011963, "uuid": "353b39d4-ab42-433e-9cd9-bf2bcdfd8826", "value": "T11DF32B01B9004B93C5C32BB6B7DF46557B336B6897EB3302EA18BFB42F4669D1E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011963, "uuid": "350b4419-b7f9-4ada-8509-1716330d4844", "value": "3072:YUHmlt0WKHRy+UdSbXoM0lHnOu+8p+pBNAGAvlWFvo5mr1b5:YAMt0WMRT0SbXb0lHkpBNAGAvlWFvo5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011963, "uuid": "262292d0-702f-4432-9ab8-2b998eec70d1", "value": 170678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011963, "uuid": "738e4535-ffbc-4c76-90ef-484ca67d0b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011963, "uuid": "69ebeffd-0e2e-4197-af4c-e95079a8627d", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6cd9ab-75f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782983911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983911, "uuid": "2bbbcafe-a00d-4e5b-b9d3-4ba6b19bb6a4", "comment": "Malware payload (RemcosRAT)", "value": "102bb9c0d9e5193c401342afd9c408d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983911, "uuid": "919fc419-6c33-4413-9a49-aa04c7ba1288", "comment": "Malware payload (RemcosRAT)", "value": "32b41325b3423e09831580aaaec166351b1e16c5e417ab7b5ad10ea60ba7dc9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983911, "uuid": "832ce185-f2ba-4017-95a7-e0e0ee3d371f", "comment": "Malware payload (RemcosRAT)", "value": "6e74c11212c2f444d0930d99187ad37b6a0f32d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983911, "uuid": "f1d6e5b5-8ae5-4812-95af-c5f7de355de6", "comment": "Malware payload (RemcosRAT)", "value": "e730b83391adbb34d5b367c51ca62d86797c79da1cccca24e91c031faaa7c57f4efb358e2ef483a8314e0ea3313b6fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983911, "uuid": "3aded743-2db2-42d9-b62e-c792c0ed21bc", "value": "T1A5551254276ADA02E0A70FF016B1D3709B787D88B931C20B9FD97DEBB976B600611393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983911, "uuid": "a0cf1282-ad5d-4ecb-bd01-68f3adef56a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983911, "uuid": "1e190506-5f31-4c7d-abb7-8ada0a814767", "value": "24576:oa6UwCnKdpMthfweCNvV/AL5LG2++S5OL1d/Y/7h/29IA:oa69DdpMthfwjMwX8Jah/2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782983911, "uuid": "f21e0d4f-3a20-4990-8529-2328a703bff6", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782983911, "uuid": "fe5b1171-6e2d-4c0a-9503-6f1fb6f9b161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983911, "uuid": "7db388df-f3ae-40d1-bf71-21feb0d15082", "value": "Q 094 -06 FMC-26 Supply 13 58 5K 11 10K - EBEN-1X.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e081e55-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987803, "uuid": "d8364c23-888f-4eb6-b8df-9479720a8004", "comment": "Malware payload (Mirai)", "value": "6b81be4b26cb1a27c259b24bb51f166a", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987803, "uuid": "92f28896-ec13-4524-83a3-c7937b2b1b49", "comment": "Malware payload (Mirai)", "value": "332103d1ff4d00ce31706034f1917c5f753ae1eb0eeb54465992fa07747db93a", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987803, "uuid": "07748d1a-9fda-473d-bdd0-647d43f1bb3f", "comment": "Malware payload (Mirai)", "value": "42d2907823df83c68ad746014e6426efb9768102", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987803, "uuid": "c6f6086f-4aa9-4fb8-8372-1db75558a739", "comment": "Malware payload (Mirai)", "value": "40c3218715bc387272b34fe59b9b91aa95d646d51f1aa75e1b501bc2162e73186177c9f7fe6dd8ad82103423b589b44b", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987803, "uuid": "f0809d0f-a7a7-4574-b86c-7ac69189f131", "value": "T166057C9AF793D4F2F25341B6020FC7F20570A1266053FAF2EB45AA7A74767912B1632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987803, "uuid": "15bdbf13-5bca-49c5-a489-2972f87a9bbf", "value": "24576:R4UDrr0zh7ghRaYDBKKxTQkfzWvnzvRzw:660zh7ghU4Gzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987803, "uuid": "95c45e13-086e-4c35-9fea-b85475fb95b3", "value": 835860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987803, "uuid": "5a41ea78-c280-4099-8523-106209c89000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987803, "uuid": "e39cfa5c-998a-4159-b8ec-311e98512aba", "value": "332103d1ff4d00ce31706034f1917c5f753ae1eb0eeb54465992fa07747db93a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c718cd67-7603-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782989402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989402, "uuid": "dba8c43e-8c77-4e89-abac-f2ea1f3811e5", "comment": "Malware payload (Mirai)", "value": "e68c4af21a7f29e7a2a522de3055e1b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989402, "uuid": "7386fc88-7443-4876-b262-8d04babe09da", "comment": "Malware payload (Mirai)", "value": "333db2402e9fffe9811e98f09a481c3d8ada888c3451c4259d047fbcb9bf65e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989402, "uuid": "e322cbdd-9aac-40fb-bdea-41d86aa27c37", "comment": "Malware payload (Mirai)", "value": "3cad830fdeac4f62bd8bcf3b994abd56ed2b252b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989402, "uuid": "a32c886b-ba85-4279-9468-b660ea52b45c", "comment": "Malware payload (Mirai)", "value": "2de244f99514a513bbd2cb2e10dc7cf80ecfbc23e242727072c82c941eb3105c1a6abd3a8586a127c6ea978b0dd7cdf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989402, "uuid": "0295df3f-8719-437a-a4e3-cfa720eaf8a5", "value": "T181B35D07E5A294FDC1DAC1B0836F9136E772BD5523247E6F2390F9712E31E262B09792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989402, "uuid": "5606e795-f50d-40e8-b674-cf4d7920506f", "value": "1536:T7nkJ1VI2IJMT26jsEbA9it0bFvlzpGezII+YfqCfb5zlzgP/ZOjmhkor:k3QJMi6fkQt0bJpjIIhfJNxkOjm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989402, "uuid": "a8e2763e-1479-4dc3-af3f-be5a28206a98", "value": 116456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989402, "uuid": "f3930226-37b8-4650-8e68-5749ab512aba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989402, "uuid": "28eb201d-678d-4ee2-84b3-edd3494623df", "value": "333db2402e9fffe9811e98f09a481c3d8ada888c3451c4259d047fbcb9bf65e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bec377-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009344, "uuid": "fc37c0a8-9084-4823-a621-9660cf4e2bfb", "comment": "Malware payload", "value": "58d2feb4c9bc2a6ee4bb8b879aefc046", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009344, "uuid": "7b3c0c55-e5e1-4b87-95a2-6af3d6e5fb18", "comment": "Malware payload", "value": "3458e481efd42d05280dcb197c8754eb0a3711166106cc2c89bc7891cb74a97a", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009344, "uuid": "97c30678-67cf-42db-9e28-16899812249d", "comment": "Malware payload", "value": "51cf31af127349321453e631c61573ddd594c330", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009344, "uuid": "5a9e23b3-a8a5-4bb0-b95d-693708919221", "comment": "Malware payload", "value": "8694add33e7a7e5f49b95d3133f3d36dfdfe4feacb0b2eec371091adcd275224cea9b63b80c0717a498e7c435b6dc51c", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009344, "uuid": "c5c695d9-0669-406e-9ba9-63c9f04bbe68", "value": "T199535C70EE1205B74F837B8CBDA94221CA79D315842624B0F6DB871D92099ECF77D29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009344, "uuid": "e08e3a56-edda-4e0d-bf8c-8b065a34c7a3", "value": "768:pUymACQPy6IB5UtIbeNHb21f6SAbyoUe4u1dfbvnDkWRAvsGCu0p2tt5MyRHH6eM:p0Q66qEVK7Ad3dRALd0ATRHHpOdbGrwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009344, "uuid": "f7b29006-ca9e-401b-a3d0-da547b13ce15", "value": 62848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009344, "uuid": "91aab4e4-cc95-4a7f-abc4-0dcf829957c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009344, "uuid": "e6f4a477-ab4a-44be-ba07-ce40b38a9ab9", "value": "ORDINE.MTV000000000000000000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d59b22-760d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782993718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993718, "uuid": "5df2ce07-1095-43b8-857f-f7961d569d43", "comment": "Malware payload (Mirai)", "value": "ee3ce581b3dc93c5f2515c5c558422fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993718, "uuid": "1a84467e-6a3c-4774-9d3b-cfdcbe5ccbc0", "comment": "Malware payload (Mirai)", "value": "347263a28b3b091bbcb0c7abaf85e13e1e96df9e31f8a05a29fd93d6e5f9c10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993718, "uuid": "00df36ff-ebe1-477a-aaad-6643df2687db", "comment": "Malware payload (Mirai)", "value": "b6b35cfdf11ad9e497a5f00d3abb0913f24c904a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993718, "uuid": "486bbd05-ce47-43fb-8cb9-344ba912bbab", "comment": "Malware payload (Mirai)", "value": "5f62f23b70cfad7712cdaeb3b82afd72168c1f4cdffaec0834e8035504760a55102a9ea6976333b0b3ead3147e10d11a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993718, "uuid": "a1389b24-261f-45dc-a421-184db35b578c", "value": "T15FD30845FC559F17CAC265BBFF4E428D7B2A0768D2EE720399256F20378B85B0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993718, "uuid": "2971c296-fcc7-460b-87c7-a73729cb116d", "value": "3072:bvYB84tOg1y3t2whFuXRUs2AY8qkg4Ig85s:bvBOZg3t2wnuXRUsRFqkg4q5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782993718, "uuid": "4d2f95ee-fc28-4821-a9a5-8343bffc28e1", "value": 132856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782993718, "uuid": "605f1a60-7e67-4232-9611-6c28a3ec3874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993718, "uuid": "28bfd9c4-feda-43f4-9316-29d1a8a01dbf", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59296915-75e1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782974614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974614, "uuid": "7c76076c-8219-4ee2-b147-318d603ad8fc", "comment": "Malware payload (Mirai)", "value": "74825a2151a9eca4ad696cf4c35ae658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974614, "uuid": "9b8229aa-118b-42d9-98ae-b545a3ef9ce3", "comment": "Malware payload (Mirai)", "value": "363500d89720dd4f0db103cf3c3d70e00b23163bd6cb74f9eee2cdc6e5c2ad88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974614, "uuid": "2a8374fe-98e4-4a40-9b30-e086f746c021", "comment": "Malware payload (Mirai)", "value": "f485bb28b72367e04395ec8f29088ccda2a7b91c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974614, "uuid": "07bb99e1-b678-484e-b5cc-cfa434d97c6e", "comment": "Malware payload (Mirai)", "value": "fdd4c398df26a6498f3ea45b5768f8e1ed9f89050eb8e69658feb9e44bdacf99ee507ae609d5750962497ed1508f954c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974614, "uuid": "c9dfc2da-ddf3-45f7-83ad-0ac407a5017f", "value": "T174A33A6AB8809F55C9C1057ABE1E538D331317ACE3DE7213FA106F2C778B56B0E2A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974614, "uuid": "5995fa03-2114-4c24-aec3-b13341b7816d", "value": "3072:gPgqpYTPq3GSnaGTW9Lq7MvaS5WZkTlZQ:1qpYTPq3GAaKSLq76aoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782974614, "uuid": "2db1c4aa-cbd0-4967-ba4c-2692ebc7d63e", "value": 98964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782974614, "uuid": "c5d087d3-33b9-4e64-ba59-09cae1098fcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974614, "uuid": "84d41b55-4f75-4577-a61a-f81e3bd90611", "value": "v9c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a83ccb1-7615-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782997058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997058, "uuid": "ebf57c3e-f65c-4a6a-9b3c-5cce51fae8f3", "comment": "Malware payload", "value": "209c72641b099d7ca4e94d12d75eed31", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997058, "uuid": "24d0434e-0744-40f6-a5eb-9cd431e675bd", "comment": "Malware payload", "value": "388d7fd938e51455ad9ba27eae9ce01fcbadff8ab88d5a7e9e742cb28402f1e8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997058, "uuid": "eaffebbe-3d7c-451f-a86e-189bd75cc935", "comment": "Malware payload", "value": "46005a2ca1f996f5edb63bd92be85d6161066b6e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997058, "uuid": "147b4723-bdec-455f-bcc3-d99f5b2581cd", "comment": "Malware payload", "value": "9b7e324635f48b32db35f829bd4747efccc626c861cc97709d743c9b13cf0931748f81542f5bc2f119ce6091e0c33cb8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997058, "uuid": "97435205-d7e4-40e2-9df7-ae6e7328d9a1", "value": "T148662382FF45D82FC4B7853B4D53473122669C2E8A86A34798DC31586D7BAD84FCAEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997058, "uuid": "9a53294d-cece-45c9-9e65-ef33c27c7459", "value": "196608:fRg5Mg0ivGlOSaJDlippDUSVUuHRx6w587:oMg0vlOrSpQFuHRLC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782997058, "uuid": "6865a79d-6ee7-47b2-b887-0512553f1aa6", "value": 7016188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782997058, "uuid": "98533f2f-9091-472e-a568-37d9ae0c60da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997058, "uuid": "380b6a31-14c9-4533-a8b7-b753b7a0bc81", "value": "\ud835\ude7f\ud835\ude9b\ud835\ude92\ud835\ude9f\ud835\ude8a\ud835\ude9d_\ud835\ude83\ud835\udff7\ud835\ude94\ud835\ude83\ud835\ude98\ud835\ude94\ud835\udff7\ud835\udffe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f0e09e-7627-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004535, "uuid": "54a9c64c-c94f-436c-9c6a-6ac64ac3a5db", "comment": "Malware payload", "value": "e04210363a49106992d77cb29bdd5b46", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004535, "uuid": "4051cfe2-22e1-4711-abd2-5059446d44ae", "comment": "Malware payload", "value": "3a0e1400a7ac8e8b984beef2f330af7a144b04723016ef07681ac0294a725444", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004535, "uuid": "34685f34-a38f-492e-a869-a6b3cb649d04", "comment": "Malware payload", "value": "93a5e3625b99e8033514ad209fbab0fa33ab1182", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004535, "uuid": "6be60230-e707-45b6-9d8d-da7e2783aec9", "comment": "Malware payload", "value": "535cdf1a44c5817ed415d379007b818d3dadc65f2b0e9a3adde3eb584de36ca0083b80c0b7daf0bc9ef85085ed5291eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004535, "uuid": "1a424be6-0355-4086-aebc-71f3801fd55f", "value": "T1767111A8999B7095D6B1E3E447135015F559D1672208C3D4B6ACC6983F7172C90F3EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004535, "uuid": "14a891f6-2b86-443a-8d0b-ec2acb6a397f", "value": "96:rSr4/k/rpDNUqHp+rX9/OcdQGYpQzhi/g:rSrJjfvJ+D0cKGIei/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004535, "uuid": "b63323e3-e09a-4f12-82d7-6fbeceadc872", "value": 3513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004535, "uuid": "e41b76e1-a809-4705-8677-b9c27c52ca3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004535, "uuid": "f2d8ca86-e833-4b8a-a274-0459259bd991", "value": "3a0e1400a7ac8e8b984beef2f330af7a144b04723016ef07681ac0294a725444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907c7c6e-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036555, "uuid": "2792c7c0-02a3-46e5-9a4d-2413e24fec70", "comment": "Malware payload (Mirai)", "value": "40603f2ccbda72ea3988a4737e066b84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036555, "uuid": "6ae2a508-8c9b-485d-9bf6-cc4d9653a2f2", "comment": "Malware payload (Mirai)", "value": "3bce162c4900bf770a866a3483abb609c57c110d08dfb626e2b7dbfe24b89531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036555, "uuid": "ecfef503-a9dc-4a29-86d1-5ef26eb04bc2", "comment": "Malware payload (Mirai)", "value": "c62047ac8a136105e12652e86a58de7c37d6c8db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036555, "uuid": "c848f9a5-3139-40ba-a171-ec567b35ddaa", "comment": "Malware payload (Mirai)", "value": "2de12e0ae16f57a9a094875b7220ff5d742df41e71168add20f675b527f30ca57f4a039528622ac82fce255510aa5374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036555, "uuid": "c03587f0-7988-442f-b3e1-a267e79c8620", "value": "T11CE33B9DB402AE7EFC0BD57E4CA70E15FA31E3B12153172A629BFD63A8321650D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036555, "uuid": "3665542d-726b-4728-b4bb-97129ad6ca79", "value": "3072:SwzwVQJr9BDFuYEPG93wLbw6hkodsdb50MHp5FEAYt:EI5uYEPGhV65sZ50MlEAYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036555, "uuid": "22c2fb66-56fd-4588-bdd5-d4450d2902fa", "value": 152520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036555, "uuid": "d9e7b4d1-6385-4c26-bd11-1c7b7804f4a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036555, "uuid": "4b9d63bb-a839-49b3-9615-8fab79d34937", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5014d693-75e7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782977176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782977176, "uuid": "a32914b1-6e13-451c-88e7-7508acd9882b", "comment": "Malware payload (Mirai)", "value": "97f27ec84b1e2ecc2b308877cdda5244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782977176, "uuid": "b0aff050-b1d7-4c32-a14a-fed81baa7c2a", "comment": "Malware payload (Mirai)", "value": "3c4560200bd60849364d4e72fec8055af3b4752033f9650b0ac33754153fbc37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782977176, "uuid": "e548f2dc-ee46-4e13-90b9-374c2a715f69", "comment": "Malware payload (Mirai)", "value": "ead3f9a3e9b518e3ec3adf63c3abbb56563fa2af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782977176, "uuid": "8c34d210-7c24-482f-a691-2683e595b0c3", "comment": "Malware payload (Mirai)", "value": "e353dbeebacb08df552329f020b99916cec6d7d27982c99c4cad30fe9a52d89df5d508c1fcb85c0b87415e9bc1f94255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782977176, "uuid": "c8b638f7-9526-4ecc-9e11-ea55620ae19a", "value": "T1F0835C89F7C3E0F0D90705B1116BB77E8B34DE125124CE5ADB94BE77AD32B02A51A62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782977176, "uuid": "20cb8df9-54a7-4f21-a27f-cf0a812eca0e", "value": "1536:e8kCrhReBqwY+cpi+DqYosyPY7JWUI31fMQ1R5U8Edfr:e8vSBk+cpiLsmRiOdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782977176, "uuid": "5cd0d2a9-b674-4807-af3f-5f8c70699da8", "value": 82684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782977176, "uuid": "b056dec5-e25a-4f5f-884f-272c1d331299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782977176, "uuid": "3ef02256-cfcf-4166-8551-76a14ab4eee3", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dafe56-75b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782956892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782956892, "uuid": "84caab7a-b8b8-4313-8711-85172a76869b", "comment": "Malware payload (Gafgyt)", "value": "ceb298c9837f57b89dfde7401724cd38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782956892, "uuid": "64f97c90-7501-4cb4-a222-90dd35ae6576", "comment": "Malware payload (Gafgyt)", "value": "3d68bc2eccba098b2a5d8c641a14c50a15663e0fc268d4f98141f617d68f143f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782956892, "uuid": "da714828-c348-4002-9098-4bc4537b5b45", "comment": "Malware payload (Gafgyt)", "value": "bb63cc29f0bfa659a60a6ea025ecaced0ae3b925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782956892, "uuid": "2760b2c0-cfc8-4a67-b0c2-9cb206e5b587", "comment": "Malware payload (Gafgyt)", "value": "da3c04a86200ef03df5c5d2b4559e88645392e53b1abbef92406eefe8fe5c1ad04915e9ad59e21c9b1ebe10c420467f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782956892, "uuid": "8f3f0809-bdd0-4c71-a57a-f1f85438cdd8", "value": "T169D31A04E551876BC2D2137AF79E469D37331BA493DB33215A34ABB82FC179D2E39821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782956892, "uuid": "e80ffafb-fff7-4412-957a-098539980ecb", "value": "3072:NQe3TQbfKa/XMVky8hGGfvPW986SLgmFQwYvQX8T7:p3TQbCafVBvPdLgmFQwYvG8T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782956892, "uuid": "c8f3dab9-e226-4b15-903f-f2a5bf6ff2e0", "value": 135625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782956892, "uuid": "106d865a-f360-4b39-9a52-6309b2b5dbd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782956892, "uuid": "aaac73e3-4ae1-4949-8805-baa2fc1238b6", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5bb0db-75d3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782968765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968765, "uuid": "9f8ffa31-c630-40c6-abd5-ece8bded25d9", "comment": "Malware payload", "value": "fad0a70df23c8cc1a628969f38480d25", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968765, "uuid": "f32e7f7c-aa34-46d5-a5b2-be34be1885ae", "comment": "Malware payload", "value": "3d6d8144e2d09acc3e160ab0ed3d84df1e15f1a6118166e2e5ab9b12b19c5312", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968765, "uuid": "33f041d0-02e4-4fbd-ae5f-643168f3bd30", "comment": "Malware payload", "value": "6c7725fdffb99dd1b44708727c62f900d761ae7f", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968765, "uuid": "9c65f7e2-22ac-41cc-945f-d4807be008d6", "comment": "Malware payload", "value": "3fe207b090f4eb8fd06af58fb233c345b6d476f957fc192d901bbc221dfca1496d32c251ef6ba904a2a2d5f4577e25b5", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782968765, "uuid": "1997937c-1f67-4768-a2a6-96e98ead6148", "value": "T17601468DA1BCCBD10DEEC599F2B0950448A69097A0F45BD6F38D48216F00D493A23B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782968765, "uuid": "00d8f7f7-d503-4cc5-9e83-f415a276dc54", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkojbjm3dfFjm3dhyQnv:FzY8k1/sWi2jk8Xm3RJm3/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782968765, "uuid": "5a726f1a-f494-4a0b-9379-78dff5e657e7", "value": 664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782968765, "uuid": "df328466-bc80-4031-a159-746cb90c6e3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782968765, "uuid": "cafb990e-f77b-4802-87ef-8a523df3ea6c", "value": "mq.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b9b063-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033450, "uuid": "2beef235-6eb6-4d2f-8288-26098e9879cc", "comment": "Malware payload", "value": "d537c08f0dc0602656bd43655ccfb749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033450, "uuid": "07a8e17f-6709-4ca4-a1fb-8b85e4ed5f10", "comment": "Malware payload", "value": "3d97e9a12d8d01204887d78b3f6122a19f13bf031f42b85ce48f8efd520c3e8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033450, "uuid": "e9d567d7-5fa1-4011-b8e5-37cc91d4a711", "comment": "Malware payload", "value": "32621c863a5ea67f945c73be9d9ab3d0455702fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033450, "uuid": "9b935ba3-ebd6-4070-9634-66df1272c6f5", "comment": "Malware payload", "value": "0c5f234c86695c32343056249079e3f267aef4448573ef2af15da797ea5d6dc979929d579d21157dc683e1aa679ac2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033450, "uuid": "1a3f24d0-a3dd-4a18-be25-2d0dba9a8788", "value": "T1A45302412ABCFC3ACBE3D5390B7841E545D849E4A8D6A01F43CA7CF48606D54EEE8787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033450, "uuid": "701c1f28-fbb2-4b21-94b6-13e9bca0f23b", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/uZijcCAQl:MaHJgMo8FwOA4zUFGUO3UhAZiqQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033450, "uuid": "9ed1274c-e63e-41de-85fd-d3b3f01563c3", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033450, "uuid": "2a5d1339-cfac-4f1c-a967-6d05ae6107f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033450, "uuid": "81547533-60a7-4558-aa32-139e43784c75", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65631c0e-75f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782981077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981077, "uuid": "66a1ffab-f088-46dd-9196-7355cd1fb2dc", "comment": "Malware payload (Mirai)", "value": "93be36ebde26dac6ceaf27788bcfb0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981077, "uuid": "8969ad5b-21f2-4802-b532-6bd7e32c0e88", "comment": "Malware payload (Mirai)", "value": "3da275fe401f717f6d94d34f576289ae0d805cdbe6a6bcb0e3d034a92f46bc0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981077, "uuid": "75ac8e05-e957-42f6-99b4-28bb298298d0", "comment": "Malware payload (Mirai)", "value": "de934d9fbc196607404436c6fbff42e9c1f9a835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981077, "uuid": "c8047da6-b857-4315-bee7-7b7899e45b26", "comment": "Malware payload (Mirai)", "value": "a63e763e47073d3d3a84fdd2c57cd146f8fbf954d5267a8d7484bbcde467f50acf755153f4c32a106fe72ddca3c61c33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981077, "uuid": "c7464a74-db35-4d54-9a3c-7aa533e4a347", "value": "T153C30945FC519B23C6C651BBFF4E428D77260798E3EE720399256F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981077, "uuid": "22021411-6fc8-486b-993c-af26998fc980", "value": "1536:w/GpovYnjDqB20bY4VDh2Tp1lafWqSOuYwIVKNRVmljQwywFORORjIeOuC48g4dQ:NAYjDqBO4v2V1lauUOPucEfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782981077, "uuid": "a086d244-a270-410f-a046-9c45fdb156ed", "value": 121196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782981077, "uuid": "a80a87b2-247e-486b-8ca5-b634ce09975f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981077, "uuid": "977c62a5-2e98-400e-a05a-2d6df32fa924", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608c33e4-760a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782992236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992236, "uuid": "284e22f2-3784-480d-9c49-02b27de0c13f", "comment": "Malware payload", "value": "a5f4968b9d56d9ab55934d691141b0b0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992236, "uuid": "7864ad84-5cc4-47b3-8eca-9393647fe3eb", "comment": "Malware payload", "value": "3ee30b097c1fde37017b99603fc0000312cabfd646c6165c9e56de06b13b9928", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992236, "uuid": "dfd30f7d-23f4-4aca-b11f-9a361125ac57", "comment": "Malware payload", "value": "63acc36d2447c2ea59b36cd6ae29e0cd1d82fc5f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992236, "uuid": "db273482-7bae-4012-b3e8-81adc4fd771a", "comment": "Malware payload", "value": "5edade36b188c05a0276bc7c0764f37a3a3072cea0d7875e9b51d0e8ca3970ba2534cb75fdd0afb5b572b2a77d90a252", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992236, "uuid": "4286c883-3fa3-431d-aa23-aa6a4eb58b4f", "value": "T18F22C9985DEB4F53DC611CB24C5A6593F932BF1F914660AA107C4F96BC7E8F004E6AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992236, "uuid": "74dc94aa-b467-420d-8570-bfd0e0117a40", "value": "192:/xxdvz11J5aFYBbI9p4MlTWh1LCxymbiMjiDX244sdFEqUovSIYM:ZxdvznbC0+J44S4o3YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782992236, "uuid": "4e6239f7-31f3-4677-a4b6-ecf592af1d32", "value": 9951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782992236, "uuid": "73749a3d-6b16-4ca5-b5c6-a7e6d4faa29e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992236, "uuid": "e7563e3f-fcce-4286-a390-e4b3ae8d3fe1", "value": "Anhang_add619f1_0.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d4954a-75f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782981080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981080, "uuid": "ed434043-1453-445b-88a5-431d7d6f1743", "comment": "Malware payload", "value": "9b42b8dffd0dff62228b89c76500bd94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981080, "uuid": "7460d551-f2e3-45ed-ae23-cc0a3cf95350", "comment": "Malware payload", "value": "3efe13a4fea7eb54c72f32efeca6bfb9518e0bf6108c1ce3c248edf6ee5fe7ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981080, "uuid": "40ba2645-4e05-44db-b72c-4bad5bdedc08", "comment": "Malware payload", "value": "5f222f43772a08ad025479e077c32f0bb213c9d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981080, "uuid": "6e15d776-06a3-441e-9433-fcab8ac0792d", "comment": "Malware payload", "value": "7381034ccb6aa49bf2635507d90a50e9a4ec2987d6db284f1e2aba287c34cbb3867345db965b21962ca450d9bc3485ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981080, "uuid": "a379da94-d185-4491-81c3-f3e0538e1f26", "value": "T1EBA22923067E6A07C0E1B3B701D31363A1EBAFD85560932F7D552C8AAF663401D3E795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981080, "uuid": "68ef946e-086d-4492-ad8a-b907ec7d57bc", "value": "384:tEEFOVtDujNOod+d4MMYByz5n1HsBvsDlCTfHSZamlHOkER4B:tEEFqtDujYod+IF1HsBvs5CfezHOkEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782981080, "uuid": "11b3a2ed-c119-4350-ac33-1576632033fc", "value": 23192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782981080, "uuid": "05ed214c-50bc-46e3-9eee-0600d9cde710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981080, "uuid": "e51d17ea-c400-4373-8f8a-76c7fa11096f", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df9b81c-75e3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782975508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782975508, "uuid": "dd55d0de-bbd4-4c37-8dbe-21131cc8e664", "comment": "Malware payload (Mirai)", "value": "70e1466a877a02bd792ef97714bf85e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782975508, "uuid": "ec9191b9-4865-4117-8022-656666748075", "comment": "Malware payload (Mirai)", "value": "3f1f32025d275f50b5128e7a01648dcab848d916eb5acfac47edaf89ac9db14a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782975508, "uuid": "8e232524-0503-413c-ba4b-8c08f1e3aeb8", "comment": "Malware payload (Mirai)", "value": "f663eeac3cc90a71b7076dee2e72c03fe0114ebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782975508, "uuid": "59feac2c-2881-4b77-a2b2-1537b9848695", "comment": "Malware payload (Mirai)", "value": "2453b3c9e588563318a48573c7b5fc6992257d1e59b4e28616d1b796327462cc2e19a7b37cd589c7fddf06c11adb7f5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782975508, "uuid": "6044b934-7f82-4148-9bc4-98a3e19f9759", "value": "T11104855A6E328F6EF278C73447F74A25975D23DA23E1D684D2ACC1142F2039E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782975508, "uuid": "8861a3ff-920f-470e-b6ad-bb0f10b11060", "value": "3072:JRR3xtoEZC77ha9/5pGEm/LfaaPcihso3aYvmkL+GVbR:JRR3xtoEQ77CxpGEm/7lUIans+G5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782975508, "uuid": "40e160b4-94df-4657-8004-fe75d2752dc0", "value": 185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782975508, "uuid": "b84e3dc0-9554-4c43-813a-1f441deaac55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782975508, "uuid": "407fa1f0-658a-4b19-bc05-79836fbaca0e", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa248aef-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987340, "uuid": "b71177eb-ec10-44d9-a2ae-8a8af8a1e1f5", "comment": "Malware payload", "value": "0b09b237a6da01d82553c62755ec7423", "object_relation": "md5", "Tag": [ { "name": "41-216-189-183", "colour": "#74B60B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987340, "uuid": "36c37ac6-f78f-4b96-8f99-3cc60590c98b", "comment": "Malware payload", "value": "403a9d9a903edb08eeba18fb096fe9a7fa20d728d8872c5478f623277df2dc53", "object_relation": "sha256", "Tag": [ { "name": "41-216-189-183", "colour": "#74B60B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987340, "uuid": "88439d32-e644-431f-8fa4-bbcca99d7f43", "comment": "Malware payload", "value": "61fdf9f4568d0e40b8faae8cc224efc71404190d", "object_relation": "sha1", "Tag": [ { "name": "41-216-189-183", "colour": "#74B60B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987340, "uuid": "f0915eed-c77b-46db-81df-7e2081027d26", "comment": "Malware payload", "value": "db2885b3579a416fea2d1c64d4266f5529563c5f2284a6f382a0ae5883d0fdac47ad6036ad89a5d3e9b1aa08dde22129", "object_relation": "sha3-384", "Tag": [ { "name": "41-216-189-183", "colour": "#74B60B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987340, "uuid": "3623242e-a232-49b8-aae0-fceffc4ba0ff", "value": "T19981D1FA619A5530FD57CDB81621546250CBD7A30AAEED06F20F1A442F6F9C0B93BB07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987340, "uuid": "9d8d844c-efcf-4ad9-811b-1c3196c83f81", "value": "96:HsKBiqTamDhDCkxwq04GiG2KuedMDHWak+zlxwQoFW0gMNk+04k+39xqrUF//OXb:HsoRhoMDHpk+z3wQGW0gMNk+1k+3vqr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987340, "uuid": "9ba8c792-62af-4d7f-b620-c687e0ea73d9", "value": 4055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987340, "uuid": "135384c6-4014-40a0-ace6-24755cd281b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987340, "uuid": "b233b77b-ce5a-4d58-9bdf-88da6f887c6e", "value": "403a9d9a903edb08eeba18fb096fe9a7fa20d728d8872c5478f623277df2dc53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50499c62-75c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782960426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960426, "uuid": "b70af991-5edb-4a33-8c37-aeaa5843bf9b", "comment": "Malware payload (AsyncRAT)", "value": "cc5eef48d8137eef70410515ae974aea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960426, "uuid": "da101888-2984-408f-9399-da4b68da343e", "comment": "Malware payload (AsyncRAT)", "value": "40f84ae721a13a383e13d18ba0d4cd120db5fe61fae4eefc117347fa6d1a4352", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960426, "uuid": "4ba82bb3-b543-49a7-adec-648beb76c7fc", "comment": "Malware payload (AsyncRAT)", "value": "9a297bdf2e2014743cc76739b71af175e27a9a66", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960426, "uuid": "64b97511-72e9-43c2-8f99-49f051e0b47a", "comment": "Malware payload (AsyncRAT)", "value": "f3d486061eb63c525ff20ea074dd69e6fdf370899f1f92cc4c7d08caca5abb7d9baf3ded26f771a7ffec055df0d41a9c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960426, "uuid": "8087e543-e87a-4989-a4c9-f6130acd72a8", "value": "T10464D0082BC1B9728BD9943F247F926EEE3D4C869644D0C8F757F884FDB53069627288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960426, "uuid": "c24d2f1b-86fb-411b-b4d0-a2ecfdd25899", "value": "6144:ZrObwammarKkMF6Lm6X0SbVbMVkksSS4iaV3KY:ZrObkmog+/VwV3vVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782960426, "uuid": "f4a540bb-fe3a-4247-ac67-51c614948533", "value": 312699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782960426, "uuid": "9cb471e0-a00c-45b5-81e5-e04136402719", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960426, "uuid": "095d8982-8ca2-4eb3-80a5-0aa5b931ad8a", "value": "SGH09876545678XW.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd2a8d6-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988531, "uuid": "be7294c1-c1c8-42be-b75a-085465986654", "comment": "Malware payload", "value": "f907e086cd844c287c12eb1f3dff8480", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988531, "uuid": "bced1b33-a739-4821-b5b2-156ca5f4d235", "comment": "Malware payload", "value": "4138e76d1beab382c21ee50f6dfa2aae3910f3504393267896b8bb953154a9aa", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988531, "uuid": "cf572060-c73a-486f-aa6a-49f70622ae9e", "comment": "Malware payload", "value": "c19fa661f80ea0b51e95f65a887529018963d024", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988531, "uuid": "837202f8-2117-4f23-92c1-932eab9a9a57", "comment": "Malware payload", "value": "71226b3a6e9fbb860e62be742b0572c750d2b17ae8e6b4266ea7f025fd23d2625a7fcb710f30d4347db10750282db506", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988531, "uuid": "9d9911c4-e668-46c6-859f-c573f19826db", "value": "T14235F115EA1181B8D4B3B4B1130FD379C835AA349153899BFF5D1C28A67A7C0AF2D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988531, "uuid": "ecb27b76-820f-4098-82b4-8ccaf4078214", "value": "24576:XlEoLPFRcFw2+TECJQiLx1a+u/jK+uMJDjaI5MNYeGnmQqoB2E9AZwmbT80/l:XlEo7FRcFzCRdc+oK+lJfpDrB2E9mDT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988531, "uuid": "e074b028-2ec2-4b81-9cb2-20126f42e2b8", "value": 1144843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988531, "uuid": "6e716926-f1f2-4ae7-aa47-6d5a61b35da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988531, "uuid": "b448a3e6-4160-4202-a058-4103b176daf9", "value": "4138e76d1beab382c21ee50f6dfa2aae3910f3504393267896b8bb953154a9aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f74825-75e1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782974550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974550, "uuid": "c75ef593-31fc-4ba4-b425-415e78a16f34", "comment": "Malware payload (Mirai)", "value": "c26e02f855263f12aed6321e680f841f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974550, "uuid": "1622f48c-276b-4411-b015-78cbf6deaefe", "comment": "Malware payload (Mirai)", "value": "4212927959feccf26c279a1c3fd22b587f991a3dc0829d8dd37c7ee8f96741cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974550, "uuid": "e62c2906-6cd3-463f-8afd-6ebc7bf1d5db", "comment": "Malware payload (Mirai)", "value": "a5657228e3bfc0addfbcd80144f39dec3d0c605a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974550, "uuid": "1173c6e5-fe6a-4c2b-8ba5-5e6fad46a10b", "comment": "Malware payload (Mirai)", "value": "9025823b14e77ffe1e5979347d46435b1cd5a284a9765fe2b17de931ef6f550dfcb686ac086683e991dedeb61391e92f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974550, "uuid": "ee030fd6-0f19-4939-8d2c-064d92498762", "value": "T1B3A33865B8819E96C6C11977FE5E438C332667ECD2DE3103FA146F1D378B95A0E2B092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974550, "uuid": "202ab69e-fb97-42e3-ad5b-a3c121021ea9", "value": "3072:lzQZP3kAsmg04Htvl0WsYpGLx1F91Av9Sv7t2+gJ9lZk:lst3CmgFH05Oaf1A4v7Q+gJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782974550, "uuid": "34f26fee-7794-43a9-8b45-a71bfc2877a4", "value": 99852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782974550, "uuid": "8691b938-197c-485c-a6d9-d785ca0c5b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974550, "uuid": "de7e2f5b-b79a-4138-82ae-dd3778de0b68", "value": "DsI5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0d1f1d-7653-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783023667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023667, "uuid": "19b1f363-6d59-4c97-b82b-5c92213a2bc6", "comment": "Malware payload", "value": "9a3f48f036e88ea454956e3b06bd265b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023667, "uuid": "f711dffc-2f8f-42f5-8fb1-ae25b023cf1d", "comment": "Malware payload", "value": "42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023667, "uuid": "62df5950-9d15-4846-a4dc-edd429675b3f", "comment": "Malware payload", "value": "8d068c6084e396e3cdc1165d2804e7cc84ec7d91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023667, "uuid": "6ef1959a-22b1-4c4d-8bd0-56a1f4e0f0bf", "comment": "Malware payload", "value": "2f09010a9f909a49a32ef0adb949b32fabbe9773fd797d5a2fffe67115c50cf16d51f784b438f9e7ae4cf32b289286eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023667, "uuid": "c23c9595-07b5-463b-a675-ede470aa15ee", "value": "T11E01A6C68201AD00802ADA1E639B61D0B411C3CF1A4B0B687FDC5A3EFB8CC14F066FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023667, "uuid": "4fc77065-50d4-4513-8b9e-b81fd17cb997", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaNCRERFCEQ4r3FChXBY8Cf84n/lC+lauD:kXCKysE2hi0ziQvZohaNXj3yLPsJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783023667, "uuid": "0e56c679-4ae0-45f7-bb08-d8dd4a9c5e10", "value": 827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783023667, "uuid": "e8ff35c9-03d2-4126-9b7f-0ea126a0c380", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023667, "uuid": "07b926b6-2895-4eee-a8ca-f736897f120d", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b598639-7608-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782991261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991261, "uuid": "a996742c-36da-452c-b21c-35c7b19e4f40", "comment": "Malware payload", "value": "861343e6561548859c07206028aaf7d9", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991261, "uuid": "ffb02ad3-7edf-4438-bf5d-30114c61c0bd", "comment": "Malware payload", "value": "43e6dda2af1193356b62650f3a2f7df89fd670daa60a9dd80e605cfe3b4cb53b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991261, "uuid": "5b97941c-ba7b-4d96-ad5d-381608c3bb67", "comment": "Malware payload", "value": "b454100a241e6e83f2d03fa985ba52ed3d81fac2", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991261, "uuid": "3c2e0495-d124-4c39-8c4e-cd1fa02e1efa", "comment": "Malware payload", "value": "d6bc5678e8b9bb0f2e826db4344040588365fa50bea292eecae0dbe6156fde6eba71980195d9ec3f18b7af1acb8dd263", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991261, "uuid": "aa6afbda-870e-4c96-91b3-49a9566f0e9c", "value": "T19AD1EA9C1DD91FE3C743A9A297D237973914BF4E68426C1E207CCE8EB22A99201977D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991261, "uuid": "206d99e9-4d3f-4930-883a-4a43816cc91e", "value": "192:/AM8GwtQFinDU1yMWspi1JcRFD+7+K7UtbF:YMFTFuqWsUnUtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782991261, "uuid": "9e793356-1fa5-4b76-b2a6-5f3272c9b2d3", "value": 6279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782991261, "uuid": "93c73177-cf2c-4195-9d3d-43540f138935", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991261, "uuid": "9cad60f5-5619-4bdc-8d3e-858ca4efd885", "value": "13774849_DE_DE_TK_RE_000000001_00741389_20251223_639020746596112790.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c48d984-7638-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783011986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011986, "uuid": "738d10fb-1872-454a-a980-1913225070fc", "comment": "Malware payload", "value": "335d2a7a72833fd4cb952f0397363e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011986, "uuid": "6d37902a-3338-4514-81e5-3f0cb234553b", "comment": "Malware payload", "value": "44878c966b581104845df03c58ba0d100309ddd124b91d71142b0a19354b4d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011986, "uuid": "40fb3a92-3588-4ced-9baa-c7a9033b5c7d", "comment": "Malware payload", "value": "3abe811516a7f93008ed44b3b60e9174cb41386d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011986, "uuid": "1a2162e5-5f84-4653-a4cc-b03d93679a52", "comment": "Malware payload", "value": "9690c37de0e2cddfcb8c68d4d7777d802567e46ae0bc66d78d31ecd70dbd3570c6acd9cc2f45ebf12e64746fd9008bd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locker", "colour": "#0F83CA", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011986, "uuid": "e6d80b18-d2d5-41b6-8c49-ea8d059f642d", "value": "T15BB63389B78409F4E4D7F27998D1D43B62A1742207B08B9B57F11DA709732E8FEB9B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011986, "uuid": "4f0b9b9c-947e-4c1d-8e87-bfcbe7d690af", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011986, "uuid": "cf518366-96a9-4325-937d-8b8a312761d8", "value": "196608:f3YmS0W8UANFhCEbvs+Hc/IDtT9OiJ4Jkz9Rwpr2Zwl6LumWwtmPCxh:fPW8tFhCMs+8ADtAiJLwqMw9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011986, "uuid": "781d8497-ab86-4828-8395-4642f8a9fed5", "value": 10433817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011986, "uuid": "f652ed13-b205-4a66-9895-783663cfdc43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011986, "uuid": "33387675-bbce-453f-994c-f3a093e1bc5d", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c391a0e-75b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782954111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954111, "uuid": "906997a8-a5cd-4c41-a733-09d598dbe1a0", "comment": "Malware payload", "value": "fae500faf8a32e64cd02345ce1247b6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954111, "uuid": "8f82624d-d2e3-4552-b582-af701906228d", "comment": "Malware payload", "value": "45ddea6f511d08f73e89d515052378cab0099a5a327468f40d6f1da7ffd03c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954111, "uuid": "143efbcb-b43a-4f3d-9eab-0b30e7e8ad0c", "comment": "Malware payload", "value": "2240c991a90c559223847a08b81bb1cc95fdefc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954111, "uuid": "003d51cc-1ed7-4934-8c03-85e23b087551", "comment": "Malware payload", "value": "83649120f8501e3b41c60184d80800ae8238a5b52ec1e9d4086b2331f85c2fe9d2584d247e4738aab9d27ae7ac236934", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954111, "uuid": "4a745db4-426c-450c-9295-89a46fc883ee", "value": "T131D3F75B5CA450E5D4EEE078CA3BF217BEB27014073837E72EA15A610F67EE161B8B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954111, "uuid": "a7e9bd53-e1ff-4340-be54-4964609602cd", "value": "1536:oqZxxZV29yl9anqCLrhC3SiajSusE19/aFXUOF/lQB8foyRLZ8/1fu:om2ACLE5ajZJKXUo/KBP/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782954111, "uuid": "d5dfd1df-b420-494a-837c-cc051d54ee2e", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782954111, "uuid": "c4078d16-a00f-4b7e-a019-a943ad31c712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954111, "uuid": "4c816e14-3b87-4197-b3bc-a11366209f6e", "value": "45ddea6f511d08f73e89d515052378cab0099a5a327468f40d6f1da7ffd03c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5844bd2-7623-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783003170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003170, "uuid": "d5d380d7-5341-4d1e-ae49-1b4de908958d", "comment": "Malware payload (AgentTesla)", "value": "2560fce6723b594f3ac08456080dcc56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003170, "uuid": "9313fa4d-1f2b-4855-bfac-7a5f45321ae2", "comment": "Malware payload (AgentTesla)", "value": "46376531988f10612187dd8c283c20022da0107bbc7a9964898f7e1dc31866f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003170, "uuid": "7659e2a2-9c48-4715-9694-e19b02fcebc3", "comment": "Malware payload (AgentTesla)", "value": "1d62f6d8b45de19ee872e40a95c5f9d78c88bdcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003170, "uuid": "03721627-a55c-43a3-88db-6f4097010944", "comment": "Malware payload (AgentTesla)", "value": "701224f3e8bbde9d66ac2700d64ff5fc184dde812e8f080400bbfb9db368854109ae03a926f38fe069b8f8889e28a231", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003170, "uuid": "0c86be35-4d79-4f35-b1fa-97713a17ac88", "value": "T1BB3594124406063DDE2F95D268BB860611F5310B3FE1DF657F1B7B8AA0A4A3339F7968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003170, "uuid": "cb979f26-784b-43e1-9a2f-408d9749ee4d", "value": "96:7OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOp:2szBDx6Ksc1Rq69vUpOseSCW6Tq6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003170, "uuid": "669ede75-41f5-4c91-8394-8a8ca06f4553", "value": 1063158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003170, "uuid": "ba9ac0d2-7674-4f00-b140-f98946f843af", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003170, "uuid": "f5028d04-6aa4-4fdc-abdb-809da5a8cff9", "value": "transferencia interbancaria (BBVA).tar.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f326e83f-75ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782952968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952968, "uuid": "5481ae80-e5b2-43b7-9095-3309a4ee6070", "comment": "Malware payload", "value": "2fd378bc943cf7742174a3bdccff1651", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952968, "uuid": "cf29eb7f-3237-4cc8-a54f-763beca978ef", "comment": "Malware payload", "value": "463c8c98e977e279732093f73ded0f41d292a83d08c35609d544b90bcc195a8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952968, "uuid": "cb959bd9-69e9-4995-aa04-688071d1b6d2", "comment": "Malware payload", "value": "5fe6a3332ff4aa20a5f28a779aab0780627f9d46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952968, "uuid": "dda68ec7-f216-4ace-a382-d7bb3c35717b", "comment": "Malware payload", "value": "db6ef9959a0f7f76d77faaa1dd1396b6a252aa22576e73da6415bd5271d99c33a7274812494c7677d305635aaece4261", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952968, "uuid": "8740d71e-b08f-4233-b29e-3050c9cd1720", "value": "T1A0236C6516817C24AA99D4371D7F2F0CBDA983E6320492DDBFCA3CF28C59A9CD11872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952968, "uuid": "00f2f5de-3fda-43bc-bb86-f2211611c277", "value": "768:zXRWNGxVH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:NlxCcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782952968, "uuid": "da6371ab-cdb0-46f5-bd63-f78d724e3f7f", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782952968, "uuid": "3b364bbc-1a2a-413e-ad9e-e8de11e8640d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952968, "uuid": "6341378d-3cad-419a-aad3-97c1de7ae469", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05af653-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783015214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015214, "uuid": "bd40e3e7-0036-46d8-a772-25fd08a4f6f9", "comment": "Malware payload (QuasarRAT)", "value": "0c78720e1c3df66ab5a7c60a9e0c8502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015214, "uuid": "5d2ef684-0872-4a3f-8f6c-ee7d0f69b2bf", "comment": "Malware payload (QuasarRAT)", "value": "4694ccf2399010c0e069f481e3471745dfe0a4f72003ed476ecf86b7b6b4ef7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015214, "uuid": "37141b36-69df-46c3-b66d-1283c629dee2", "comment": "Malware payload (QuasarRAT)", "value": "8a3a3cc15f5035a772abcb15c01980c16df34d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015214, "uuid": "9e8f5c42-3121-4004-b833-27da69b7dee9", "comment": "Malware payload (QuasarRAT)", "value": "486e9f90015fdea1fedc965929cb9bdba36389a4cc308f195c870438b8cc366a1bfe3c3c4d1453c287c4b778167f09a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015214, "uuid": "e8e1e07a-ed21-48c7-9e8a-113124e75a8c", "value": "T116252336F11E5636E307E27B00A59342F317BB5E2E275696494E11A8C737BFE030A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015214, "uuid": "b42bcec2-3b37-4da5-a25c-4bf25cc38810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015214, "uuid": "fd0efce3-a4bc-4476-85ed-6cf808ceaf9c", "value": "24576:v7BHPDMz0ok523j1IKiEvO/3vtQsnHhIe8:v7BHPD543BdG/3vhnie8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015214, "uuid": "26a852a9-8c75-4083-8282-2fc99a704214", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015214, "uuid": "7cb8fba8-6047-440c-8311-ae14b7f29148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015214, "uuid": "e5b413ed-5bcb-4ebb-852c-b65a4bfed28a", "value": "0c78720e1c3df66ab5a7c60a9e0c8502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea91c9b8-763c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783013943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783013943, "uuid": "671e18b9-0404-4d8c-a668-7e9d24838882", "comment": "Malware payload", "value": "8f75a93affd354b431d920a32d521ef0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783013943, "uuid": "a188426e-7490-4efc-9c89-1efe58a7f3db", "comment": "Malware payload", "value": "47ac67eb2dc73a13f7226c7b3a429b1ae26230aeec3d7fa679c7a281515491e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783013943, "uuid": "ce1e5d01-7700-497c-bf28-4e17ef162207", "comment": "Malware payload", "value": "73e36dd07ae2d8bd94cdc7c5d11e19c2636d3ee8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783013943, "uuid": "bc680503-56d6-4e75-aa0f-ceb32f57747c", "comment": "Malware payload", "value": "e00e57b9719827d47fcaec94a5db1d0438c36bc9666078030e62a99c484f41eeeac7301836616d856017e03e32bfb5f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783013943, "uuid": "e2aa566a-6e8b-40eb-9a1e-ad940efe82bd", "value": "T108F059D0A6114137F8BA88EA9672CE8EE305C93B6C05212C363FED6A1F7C415B1B1D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783013943, "uuid": "0e59d877-ea11-4b97-81fe-3f3f1829d852", "value": "12:ks0+6UJ764NDh4TFQh4ShY7Sh0zxzt4WxzRgsT8D223/q7q:b0+vHDOTyKSwSqzxztMa8D2MWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783013943, "uuid": "5845461b-cd25-437f-892e-5824a6137d7f", "value": 540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783013943, "uuid": "def9843e-c2a1-420c-aba4-7ee4cd85a306", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783013943, "uuid": "ef4954b7-84c7-410e-a750-2be5fdc66759", "value": "sample-47ac67eb2dc73a13.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a88a8ae-75fa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Koadic)", "timestamp": 1782985462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985462, "uuid": "619b2c8a-dc39-4287-934b-180c81ceb363", "comment": "Malware payload (Koadic)", "value": "11238f1243988a80c327bc00bc96279e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985462, "uuid": "fe446bb5-32d1-4bf1-a40f-6725711135e5", "comment": "Malware payload (Koadic)", "value": "486844c034a301053666d3197a39f93f3c157f26f286fef5274d9fc2ccaad689", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985462, "uuid": "e742787c-97fe-40d1-859e-162a7d3b0122", "comment": "Malware payload (Koadic)", "value": "607a78037744770bf639a487313b537423d5a610", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985462, "uuid": "bdcd08cf-84a7-4ae6-9d6e-1402d4982796", "comment": "Malware payload (Koadic)", "value": "fc03f3fa1bbe3f22ca61e22c18b051208850ddd633c7b4a2f36ca30246caee1554ca19176ab68d1e395f19c3cfbd0a6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985462, "uuid": "728fa649-bcde-4662-b5cb-2d953262b0fc", "value": "T1CE4523015EBA3E4947A8D39AB1BF4F4C18F01F27056EE9DE03E528C7125B7A65BA7C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985462, "uuid": "042e223f-e62f-4130-91b1-761feb937aa2", "value": "24576:HjYPxK/ewawFPHiqMcxjnB2aPMBnbSWOuOliJTyuVLc+:DQKmMabsnBMjc8Lc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782985462, "uuid": "c38c077c-1ce2-4b51-8aa3-d68795fc0b83", "value": 1278267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782985462, "uuid": "fc43ca1c-ec3b-4e7e-93bd-6d33af5aad38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985462, "uuid": "e987be3a-f466-423e-9785-ef05c4fea567", "value": "20260707_0100101033214.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbab80fe-7641-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783016119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016119, "uuid": "88dbcb4f-7d07-4555-a851-1162b0aeeb12", "comment": "Malware payload (WannaCry)", "value": "faabc72c2848caf771c29c6cddfd5254", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016119, "uuid": "df39914b-469c-4835-bc43-42110e25fc8f", "comment": "Malware payload (WannaCry)", "value": "48ed2a2fc7652fc12c6edfc2efbef6d65a9f85bf5874dbaf275301775265e136", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016119, "uuid": "71c0793d-69d8-4aba-a3fa-28efc3623329", "comment": "Malware payload (WannaCry)", "value": "c5accdecde3ffd7f036e5b96e10ee132cb657644", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016119, "uuid": "a767fc4e-e978-4235-9a25-46f804aeb6fd", "comment": "Malware payload (WannaCry)", "value": "129a5ee1d726154e484d72d6ddfbd065ef51181ddf4c9331e92ebb3eabe6c569a48069eb7f3a90480e5f25fe8beaac9b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016119, "uuid": "22ce8231-d29a-4f11-9116-c0b59c237d37", "value": "T1A236235531A8C0B4D103517088BB8F22F6B2BC2927B5694FBF944E7E2F237A1E715B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016119, "uuid": "9e30dc69-58f6-4ca6-ac1e-bc5c74242b1b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016119, "uuid": "6d246efe-c1ca-4ef1-af1f-22e76a8f737d", "value": "49152:jnsnpEKUv9wC7+VQej/1INRx+TSqTdX1HkQo6SA:DMpyv+Fhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016119, "uuid": "b397c5fa-ea4a-4275-a5dc-7cf90af60552", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016119, "uuid": "9a8bcf60-c8f8-4814-b76c-e95d5cd6b704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016119, "uuid": "3e316d8d-15b5-4002-9169-6a0614648c7c", "value": "48ed2a2fc7652fc12c6edfc2efbef6d65a9f85bf5874dbaf275301775265e136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b16d502-75c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782960444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960444, "uuid": "e91a8217-dd7b-49c5-99ff-5362457d8c2f", "comment": "Malware payload", "value": "c850951bd418c58a5ae4523065c1c922", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960444, "uuid": "5a83fb3b-84fd-4a72-9be6-35ba9c1a72b6", "comment": "Malware payload", "value": "48f8f9303da8baab31e347d8f5686fe4b13a3a34af9e34395a2b61f27fd0c2bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960444, "uuid": "6f8a7244-e139-496f-9a71-7b5fb7fc62c1", "comment": "Malware payload", "value": "7f760b124c5b36acd963560ff95898ae3e3cb5db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960444, "uuid": "60a76d8e-fbdb-4ee3-8874-a4d24400b6b9", "comment": "Malware payload", "value": "9e611c679e6c46880713b80d92529e8fa6104c1b71f4590015d5fa328d7949671d4839856f9666af20d689d8ca2415b8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960444, "uuid": "3dbb4264-1d4a-44e9-80c2-bb3030b0f93b", "value": "T17E667D4065A4A2C339389B3A941D7EDB3D4E54F3AD74CF4936EECABA944CF022974253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960444, "uuid": "31efe2bb-3220-498f-b7a4-dca07c3c3656", "value": "196608:2tX1MlLCb0hDgOo9DzG2HIbWUH1ymxv4VD9cJ11zITJSV3ssmZutX1MlLCz:kX16uhG551yEyg118TJSOsmeX17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782960444, "uuid": "97d7b005-a41f-4e10-b743-913c4ea362e2", "value": 6785964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782960444, "uuid": "cd512475-30f4-4658-8b73-7305c130915a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960444, "uuid": "2840f000-9a59-47ef-88c0-35705aad93e8", "value": "PB 2400.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1149f928-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987808, "uuid": "a00d4f0e-d3ba-48cc-945e-86b64bcb6b30", "comment": "Malware payload (Mirai)", "value": "21dcf74ad5e65a4afd1fecbf12e25668", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987808, "uuid": "cd517d91-0314-4a54-9ce5-664db6c19bd8", "comment": "Malware payload (Mirai)", "value": "49d9233e9a8ddefd1e10b43020cd1fbc770a524a1e7135db8e9e1377da61f11e", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987808, "uuid": "cc71058d-4e6d-49db-8a18-a725df7baf1f", "comment": "Malware payload (Mirai)", "value": "d6dfd84b8bc5740c8913fb7eef0a2b295289fd52", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987808, "uuid": "b9dce360-b87a-425f-a753-c8b9815e6087", "comment": "Malware payload (Mirai)", "value": "7614c530f2f72d2ad6fdd0794b53a1abff4f1ab8c5e85481eb2f8dfe115cba97c5b5e088fda045af70a665867458a734", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987808, "uuid": "6b6f7c5f-2cd1-4016-8860-9ec54e3c3e34", "value": "T18CC57C06FD20A976D1B1A470828FD6B2C8246A3502278457FF5F1D2CB66E6D1AF1C3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987808, "uuid": "0a11bd30-8c21-419d-aac8-f4495fdc9750", "value": "49152:6UQ+iATAuzcyV0Hw9Qs3dXyFH27skQi+6gmlc/:6V+igAuzcyV0Hw9z3dwi+Bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987808, "uuid": "bda27b16-5ae1-497c-ac77-849685453516", "value": 2650096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987808, "uuid": "2b03357b-cefe-4561-abb2-e45b857db0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987808, "uuid": "08cb19f2-7a6f-407f-a7be-9bbda7419331", "value": "49d9233e9a8ddefd1e10b43020cd1fbc770a524a1e7135db8e9e1377da61f11e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668fe74d-7613-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782996112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996112, "uuid": "757a7673-ec55-44a5-acaf-e44fa4f5ba91", "comment": "Malware payload (Mirai)", "value": "8f85bf3784443ff83a5a5d91e9ff6b86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996112, "uuid": "8d30fb5e-ded3-4080-9bca-8f98b786fb89", "comment": "Malware payload (Mirai)", "value": "4d7a477ac907125c84e0f8aa8a19fd01ea7f7f36eeb4add4de87e42866ca745e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996112, "uuid": "1fd1ef11-db28-42c7-8202-7e55e135e3d7", "comment": "Malware payload (Mirai)", "value": "9fe064bf4e6abb6c2240c40f6528a489fbf8835d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996112, "uuid": "867e3c31-dddb-47f1-9212-9f0e3b9dceba", "comment": "Malware payload (Mirai)", "value": "c2e7d836ddd2f3efa90c2a58c16d49210b1e7f83430c2a970160aea859033fbf542f94f520a0ac144853fb03bc30ed36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996112, "uuid": "2e95e850-a8a0-4ee8-876c-e772a5649844", "value": "T140B3F845FD509B23C6C655BBFF4E428D7B260759E3EE320399256F20379B86B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996112, "uuid": "f2a19824-b257-49b5-af89-a3fac4f9cb80", "value": "1536:+YG1MY0p2LASd4Vd+mtTB7i2/MqrO2yC35+qFOwNIlewwywJWs27GSusXoUlAhID:Q70p4d4emt97i2U3qAwixHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996112, "uuid": "4196a5f9-d0d6-4ed2-bf5c-8191d955bc45", "value": 117100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996112, "uuid": "4a8789c9-645d-463b-b378-37da01ad88c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996112, "uuid": "1cad7283-2ee1-4c92-888f-aa5f9350276f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c2131a-7639-11f1-ac1e-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1783012352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012352, "uuid": "6e34d847-1b66-40bd-93de-bf50f4d12bf5", "comment": "Malware payload (LummaStealer)", "value": "b07f16a3b524017d20d360823c09b956", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "sloader", "colour": "#9CA03A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012352, "uuid": "74f31c9d-b6f0-4ed4-8b47-085fb9012171", "comment": "Malware payload (LummaStealer)", "value": "4e5b2ae91379b8069c04c6639bb0bca5ddea0dde567bea8cb9bc9822b9cdda0d", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "sloader", "colour": "#9CA03A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012352, "uuid": "66d8263a-b668-4157-b414-de0a3c3292af", "comment": "Malware payload (LummaStealer)", "value": "f680fbbf487f61c9bd231e48f83a9e1c092ceb6a", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "sloader", "colour": "#9CA03A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012352, "uuid": "e81be063-e0eb-40b9-9bf5-e7ce9f9b8bfc", "comment": "Malware payload (LummaStealer)", "value": "24b4e41af2b70cf7f11c08100ff34b3b9013ecf065f89ff410ed9c4c9edf2701d4eee47f9d57f8cb603f3fdb592307c1", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "sloader", "colour": "#9CA03A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012352, "uuid": "e6d844a0-ab4e-41cb-a6ac-3bd571bcd345", "value": "T1BF3523C1314084D7FFF395791867CF9BD4A49D5086B4A34B03E13B8AA4F28D7BB2A625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012352, "uuid": "ff064331-9619-4e10-8bb0-fdae52d5f25c", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012352, "uuid": "3cb84626-f849-401d-95d0-840a54731372", "value": "24576:iw+tSVHEX47Z8E/X0xZ0Id+7IsJSa/aqGK1CIOJC1+0sPiB4HM:n+ekXkQvPd+3JS1+1CQpbB4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783012352, "uuid": "d0dc54d7-509d-4e02-8ff7-463c388901ed", "value": 1100041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783012352, "uuid": "780af3b2-9326-4f64-9163-c413a97f16da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012352, "uuid": "4ddaf2ce-8fbf-4725-ba94-2c40cdd7e264", "value": "nadapp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686f9701-764d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783021026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783021026, "uuid": "be5afb52-0b58-4fe5-a6a4-58875ea5f6dd", "comment": "Malware payload", "value": "54aee5f6cb2427adaf7508f987ff990d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783021026, "uuid": "07ead5e3-09d2-49fe-991b-720aab6c432b", "comment": "Malware payload", "value": "4e6276cc400b3b9e9616d04474b64a8fa0c35375b9673ab41a92a6d5bce72d8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783021026, "uuid": "ced54d62-4ff1-4ea5-8895-b8c135335a08", "comment": "Malware payload", "value": "11835385c3a614d1ac8829e95096e367f80e3832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783021026, "uuid": "07645461-0207-4939-a913-364fc2c3e951", "comment": "Malware payload", "value": "01a1e1b2b87deb975b4e49b541dd1e7d6177c7c54f269c2f41bdbb0576b320d8a0c20529c03b27b8dfbee1321099d6a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783021026, "uuid": "0339ded8-64dc-4809-8869-0baedabbc6fd", "value": "T1EEC45C0BAED00DBBECD1C470475F81776F32F485A222A71735C5A6213E56A34AF2E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783021026, "uuid": "ee4c1eb7-c39f-4c2d-9b5e-608d6349261d", "value": "6144:+sVutJn03sIq0kxOsys0wGxs5M3Fw9NkUc2rCnFJRBae6ayBFTnGvMdcijIg+Uae:+sVutJgqf9yyws5mFw9eUaGTGvMid2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783021026, "uuid": "a359330f-c2aa-4eaa-b1cb-ce052da556b7", "value": 592080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783021026, "uuid": "989a4710-e779-44e3-be21-2503e4cdcbee", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783021026, "uuid": "91c82b3e-a6c9-45a3-9bb9-19adcfaceba3", "value": "libjson_script.so.0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e5c21a-7623-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783002894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783002894, "uuid": "a21e837c-3063-4d19-9c0c-5a7a574a9475", "comment": "Malware payload", "value": "8b56c8a942bb564d0ec79032ac4137d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783002894, "uuid": "686d67ab-707b-45bc-a41b-fb0062bc605e", "comment": "Malware payload", "value": "4eaed7c8c20e84dc7953348f943b05095998852ec4c74ee9aecd199725bcc713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783002894, "uuid": "dc5a98f7-db6e-4c55-9c35-05bfe9b077eb", "comment": "Malware payload", "value": "9e17e5054199f5b887c2460029379d6320a55ad1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783002894, "uuid": "f72af117-418a-4cf7-aa35-03a3cc688f1d", "comment": "Malware payload", "value": "a9d6b465d910fd29fd22ec67bddc505ba36c7f8bdb134fe37f04627a4e07f4827ab13bfc3094a7c6603591602ac69aad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783002894, "uuid": "48b2e635-6d3f-412d-be8d-c14de4517a6d", "value": "T15C3533F09B268589E8B264667ABE4110A2F672F63E1CF6210511BC7C3964FC6D60F4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783002894, "uuid": "47a1ffda-25fe-467a-b815-3e8efd2e73ae", "value": "24576:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKV6x4WjyBgZbMrdo98hqrpi+Fl:5IrLqbSJM5ZlShz5uIKVGvjyAD9kqrp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783002894, "uuid": "75ca7d00-a564-4439-9c8c-122833e85cdf", "value": 1119788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783002894, "uuid": "62fc1a58-fe8a-4a82-8e3c-9907122079c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783002894, "uuid": "25d2fd5d-50db-4a27-8803-0876789a1e49", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db9e4f-7630-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783008397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008397, "uuid": "0c5ab4fd-022a-443e-b4dc-158bdeaf8847", "comment": "Malware payload (Formbook)", "value": "6cb55456e3e5c099a85a7314076bb741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008397, "uuid": "d21d1778-7ced-463c-8505-b012c1a6b19b", "comment": "Malware payload (Formbook)", "value": "4f0925945aedb397ad3cbdd0e9b9a3ebf96d64c242699a971c2c016636383569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008397, "uuid": "4d6af1b7-6406-43cf-9d48-99f78b2eee77", "comment": "Malware payload (Formbook)", "value": "1f9fc655026196029f316ccec34b19f63ffdd391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008397, "uuid": "f6dbc4cc-9024-4d97-8b81-be4ef1438c4e", "comment": "Malware payload (Formbook)", "value": "307250420752cba2bc76acc4528be2d101d18ead66a355dfbf1d6ad04643dd930a47072993e224f992f438983c0ce182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008397, "uuid": "d7bcfe98-5896-45aa-9e04-d61f5624bb0b", "value": "T15135021426DEDA02E5B20FF91872D2741B373E896931E20A4EED2DDF7B3BB115810792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008397, "uuid": "63e60bd5-62be-4f37-9e1e-7fd3595608d9", "value": "24576:9a6Uw1oHMCvI5DHl2vd47GgEcnvUf2b0P9+yAxfl:9a69Efg9wSGgrvUebAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783008397, "uuid": "ee8ea68e-2135-4d31-9315-57c6780eba32", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783008397, "uuid": "9a37b968-b152-4466-a781-d8200920f9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008397, "uuid": "1ef41ddd-628d-49d3-a92f-3d63530ff55b", "value": "1DIPRzBHQ1e8TJZ.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538003c2-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033446, "uuid": "901bff19-b1f4-40d1-a655-65026c29b5e0", "comment": "Malware payload", "value": "72aed3f8c3d012b826b4ecf98eb2ccd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033446, "uuid": "4afc01bd-26c9-497b-88c4-495d3b1759b0", "comment": "Malware payload", "value": "4fb47b9ea12b8893d4f91e4ad7230d20e30250abcb341a31d494d662d29714e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033446, "uuid": "de95afeb-7719-4b53-809c-65935db4369b", "comment": "Malware payload", "value": "0174d35778c65eea63bf7af8578fedcc3efcfdbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033446, "uuid": "fd5b3b06-0985-4a2b-9361-1a7eb812dd99", "comment": "Malware payload", "value": "4fb08c52c6100d5796b69f7ad048cfe1600be0e6a588720307c21f4a798ca7cbb675f627e7e50ffe17374d44c580a454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033446, "uuid": "0b1b75e2-87f8-4514-b8d6-9a601c9fb31e", "value": "T138E41B0AAF540EFBD82FCD3705AA1A0635CC649733A53B353574DE14BA5AA0B89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033446, "uuid": "90430a8f-fdec-49dc-9e06-371b7a49f03d", "value": "6144:PYcZ9PeDlfVuUyC0Y/ydHsGvsnyxpAvzzJUVl3SoddKrLVCU2VUp:6lXyC0Y/ydHsGvYuAvzuSoELJiUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033446, "uuid": "b628da13-18e5-4cc7-bc63-de0038d87b9b", "value": 660628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033446, "uuid": "ea050504-d05c-4743-81f4-a3e36a2ebc72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033446, "uuid": "def624a6-120f-4a2f-a45e-757d6db72613", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e99adc-760e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782994171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994171, "uuid": "d36b7fc5-31b9-4603-a520-f9deceb41f82", "comment": "Malware payload (CoinMiner)", "value": "7abe81a4699823626728990671b4038f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994171, "uuid": "886c2aa1-5f5b-49e7-9db9-8b5f8ad3ca3c", "comment": "Malware payload (CoinMiner)", "value": "51496979cca2c2e036b2993e9fd5b583175b6aeb37df0a635bf4453abd3cc573", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994171, "uuid": "d30fd0c6-54a6-4272-80ab-938c0c31e9a4", "comment": "Malware payload (CoinMiner)", "value": "342c4be8c2e13195aa0306abbd3f4f95937e8423", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994171, "uuid": "8efc57a9-ed3a-4677-9e76-fd10da556b8c", "comment": "Malware payload (CoinMiner)", "value": "a96abafb8b6273b2336b1bb537c7ee64187909207f8434c099f745188949021e5e775ef0c35ed6d7acc1506ddb190958", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994171, "uuid": "d721b8a6-f0d5-4130-8c96-aea9886e20a7", "value": "T10096CF09B3A805E2E666E634CA618733D770F8A16631C74F19A9F20A1F737814F6F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994171, "uuid": "7723897a-af79-4a89-86b7-c553a2f65f1f", "value": "3f2a4d4c5b5de8950db370118489cdc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994171, "uuid": "4060255c-6291-4aae-a6cb-757beda28c2f", "value": "98304:8fAMlbe8ev2A2/nJR0xpnKj/ybyzR0mKodMXm1bbjE:kS8evHMD0tbwR0hWbbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994171, "uuid": "296878bb-3bb8-4d33-9dc9-5d55133cd587", "value": 8863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994171, "uuid": "bc31c1cd-b0f4-4218-aa38-5f35e39ea54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994171, "uuid": "e60beac8-96e6-4537-bd73-1f8dcf01af1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b714e67c-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972195, "uuid": "edee5e6b-5fda-491b-8758-357f724d7d3d", "comment": "Malware payload (Mirai)", "value": "83945e28539b0e18c775d0e20f5c0ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972195, "uuid": "5ddc281b-784b-4a2a-876e-cecccdafa34c", "comment": "Malware payload (Mirai)", "value": "51607c6ab06747a45adfb7c1fc1ba11a20984bff49a4299f0b5b48a4fcb49acf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972195, "uuid": "640f86f9-821b-403b-9db3-3ed9100c1a5c", "comment": "Malware payload (Mirai)", "value": "03b14e02b522508f894143113e5b26ac09ea8075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972195, "uuid": "b63fe4d2-1db7-4fd9-b04d-6b6d4585c94c", "comment": "Malware payload (Mirai)", "value": "836d29f5aa4e89af0617c052b68ead461a624d8b4f4b4594606d6673e60d9ce63bdace789b3cdd81a2918ef27f4b798a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972195, "uuid": "142a698f-cf36-4a92-81e9-3f1dcbaf2834", "value": "T1509309D5FC81E922C6C25077FB9952CD722643E4E2F932479B245B6233939AB093FE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972195, "uuid": "2eebfefe-9432-464f-9d19-52d24aecb9d1", "value": "1536:tCjTTaqO2WllJpdWz4V7oQ9Kj4PvebH1E2s/gsZXNO7LyvPTA:tgTT6Jpd90jLkZDPTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972195, "uuid": "6acfa992-3a7c-48a3-982b-e28b80a48be2", "value": 95660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972195, "uuid": "ac70a4e1-c6ef-4da5-9d76-b18a0330eb87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972195, "uuid": "10d66784-a8ae-414f-9f43-7a3b920bb667", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17160a08-760e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1782993831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993831, "uuid": "e2f5d256-497b-4a1e-a76a-3cdae45363d6", "comment": "Malware payload (DarkTortilla)", "value": "e63bc44fbf3dd02c91262e309fb4d0eb", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993831, "uuid": "33011c9e-db75-4897-94bd-a2c22c304527", "comment": "Malware payload (DarkTortilla)", "value": "51e3e006da49bddcdfaeceb3ada3b0401abc6e1536098caf85d3897a9e3e48e4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993831, "uuid": "7571c799-888f-44c3-972c-9538d2cc9bc8", "comment": "Malware payload (DarkTortilla)", "value": "11758c6808e531b111b91997c67cb15a1e443032", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993831, "uuid": "446eebc4-8a25-49ab-8c5f-24a54f37415c", "comment": "Malware payload (DarkTortilla)", "value": "4d76cbab8f470ce95f5fa5449e88cad7b520dbfe995983b406d0bee226c0c16ddb6aaf6841a7abeda0c8569bd41fc31d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993831, "uuid": "b4a010d3-49b9-42a2-8c6a-a8fe1ae4a9b4", "value": "T12B25F1216E873B46C52E4BB4C121488863F0CA435357EB9F3FFC10E56EA2FE9D912596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993831, "uuid": "cc440135-051c-4203-bc3b-a2251391c5d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993831, "uuid": "44c605ae-79e1-4826-bdc2-c44f05666297", "value": "12288:Bi1pq0ebB5kODVKaZuCgHebdfS+Rw5j1ypmr0WEErUPBO9l+mbA02:EjefksxDZsv1PrLEjPPmMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782993831, "uuid": "1cd6cd68-0ab3-4c26-9b4d-1e1dd1a23b64", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782993831, "uuid": "a1151826-be0f-4aab-9f6b-efb7c3848fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993831, "uuid": "ea144523-f29f-4d59-be0a-6109cc6cec95", "value": "INV_POSON896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32554109-765b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783026948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026948, "uuid": "abbd56ad-5632-48da-a5a9-3e4fbe3a33f5", "comment": "Malware payload", "value": "562296b99a2019731809c99a846139e7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026948, "uuid": "f5fd1f88-e614-4bbf-aa68-14e5c8af8cf0", "comment": "Malware payload", "value": "537f08755139d0199fb1751068eb49a92b68e0d1dcadaf03758837c3832f99c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026948, "uuid": "aec5daad-54f9-4953-9a69-03e0528055ef", "comment": "Malware payload", "value": "c5727db19a90d4ce60636add597cf879ef7d84ca", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026948, "uuid": "35e4edcd-7035-452e-a873-2348daf4dc8c", "comment": "Malware payload", "value": "1690a98cb3770710d35dbe619c774e2900d6ceb0e541ac2a84bf8734fb8e03b4ec1c53935d97cc8def30ea79861a7fdd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026948, "uuid": "693f9867-8224-43fb-af16-93e888c93c99", "value": "T15E060117FFCA94BAECF243360E7563253602AC358B67A2879864327CA4B75D01F46DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026948, "uuid": "ac5c7373-ceea-4408-9dee-a224f52e969f", "value": "98304:fQc6eL7ACQ9GPjpZyp5tWR4qLUrWKDCURs/4:fLcCQ6pZyp1qL5KDhs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783026948, "uuid": "1dbfd627-af99-4ef6-87f6-b1a6cbbee130", "value": 3686002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783026948, "uuid": "9d569d38-6957-498f-b0a1-286b7f7066f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026948, "uuid": "10380f85-9086-4dd1-93f9-f184f1998a4a", "value": "res_obs_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e93652-7618-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782998092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998092, "uuid": "49ca2e51-22e4-4121-bd05-d8960c723bd8", "comment": "Malware payload", "value": "64955d7462de9ae2fc7c19de146ee872", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998092, "uuid": "27aeac10-24b4-454a-8a9e-bf8830d4853c", "comment": "Malware payload", "value": "5380bc5893d043bbbc7680d359e80ae7464b729fd128d313a56327a245c8e0b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998092, "uuid": "cd54ef95-ade8-4e26-bb65-0baf476fb98c", "comment": "Malware payload", "value": "cecc40ab71393b4b90df678b6dcc9480581fee91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998092, "uuid": "8541194b-9056-4b70-8d32-6c5b791295c4", "comment": "Malware payload", "value": "ea6abbde7bd3c9e969497856bae043e0f1089f98a9ccf932f1192c4b83def74a31eac3f66dd920d7a6b859c5ac2054a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998092, "uuid": "06635358-234b-4424-9016-e1d2b7a96155", "value": "T1DDD097F340B302B060E7A800F8C6A801BE0087BF8C22CA2FFA1768341F41306F2C03A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998092, "uuid": "692ce34c-bcd6-475d-884b-0c6cbbe6963b", "value": "3:TKH4vLYbFD1R8r8CnUU6bqfECFZAutDMFsMLONFYqGSrP/c5c/DOOdKX+G80bKVO:hTUnR6ZIQAulNXYq9DG+NjVsNXYrkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782998092, "uuid": "255fe7c7-6bca-4a4b-8656-620880a4c899", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782998092, "uuid": "eb6ecfcf-e20d-49e8-a4d1-a484bb3b8f3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998092, "uuid": "d09e76d6-d89f-42c2-8597-c5af533d3e7a", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da410c1a-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966671, "uuid": "a9427d9b-a103-40ca-a9ee-a73fbe14050a", "comment": "Malware payload (Mirai)", "value": "20d9b6cc89e7516f252a9aab8d6d8794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966671, "uuid": "b84cab74-b104-4eb3-9a91-6e0b0d268572", "comment": "Malware payload (Mirai)", "value": "54166148dad002881957d42c2b793285bf6534a60c1c6becc1da218b1e5d31ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966671, "uuid": "619ce659-78a3-41b5-b6d9-a95f68106e47", "comment": "Malware payload (Mirai)", "value": "62ec2bc83d9d91350cafa2106e0db245b1f56618", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966671, "uuid": "3274522a-9ada-4947-b0f1-8af1c3d1d578", "comment": "Malware payload (Mirai)", "value": "168e1f962b73f0fc3448fde5a7ab7df9e20a54ef2fb40c3d9d3dcbcb665abd6a6517755a51df17f7a6cf7f001df99797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966671, "uuid": "6089a281-9cf7-43da-8fbf-fab585f71032", "value": "T1E9633C4372280F47E5A249B4253F1BE093BFED5024F4BA88694FDB5A4639E761086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966671, "uuid": "f97fd78d-9d63-4892-bb25-cc5bfa5f5437", "value": "768:rtbRcTIqx+TV7Rn0/qPhTS1qBeaqPfH7MZff9rwhOm7SG26sMxH5R+h2xMBS62Og:4g7q0TS1qBp2DM2OPMx36EZIJuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966671, "uuid": "49c37624-9442-4099-a97b-1f014065a2c5", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966671, "uuid": "ed53d37e-f88e-4946-a839-1811026f2aab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966671, "uuid": "3094361d-31dd-4320-bf8e-ef229c5e4ef3", "value": "vcimanagement.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01ab2f2-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782988504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988504, "uuid": "ae5e64b8-80bf-44de-98db-601299f11ea1", "comment": "Malware payload (Mirai)", "value": "904c461f3a1f1d0e18f6edd020028de4", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988504, "uuid": "fb8231cf-0ac6-4022-8699-432336293b05", "comment": "Malware payload (Mirai)", "value": "5608c97e85c8983e982423e326c9bb9d5e2149a207239782fd06a90de95b34c3", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988504, "uuid": "83cbd0d4-32c8-4813-9beb-642bfcf0fa13", "comment": "Malware payload (Mirai)", "value": "6b5316d747e17fd525fa8d5d75fc821a2f7cf349", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988504, "uuid": "ce720397-2468-4296-8845-22f2e20ddcac", "comment": "Malware payload (Mirai)", "value": "06fddb24880ce654132e3db36a80528458543c147e26afecadcaa005837af61e3676d1b16697702657ee102c6e434c3a", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988504, "uuid": "da8b7d98-de62-4ec0-85e5-f9c66a3fcead", "value": "T10B155B16EA019479D4B270B1524FE336C8686B358527084FFF5A2D6CEA3A6D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988504, "uuid": "605818b9-b090-49a9-b114-6a08cb7632d6", "value": "24576:N3YpdGdKrqXw9D/pmCca14h1cwWsI7U9E5W:N3YpdBrqA9zECN4hiws7U9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988504, "uuid": "90ad5893-ca73-41ba-8077-d2bad8fc4104", "value": 891440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988504, "uuid": "389febc9-acd7-43d6-85f6-ccf0ebfe403a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988504, "uuid": "b6c1ddff-4816-4a87-a98b-bd08d6bf22b1", "value": "5608c97e85c8983e982423e326c9bb9d5e2149a207239782fd06a90de95b34c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a2c3fc-7625-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783003866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003866, "uuid": "c4799f74-ed83-403c-8bcb-f327393e4ec0", "comment": "Malware payload", "value": "57d02a1f9bbf896e1edd059094dec270", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003866, "uuid": "3c2c8460-a9e4-4d1c-a6d8-85440ea0e86e", "comment": "Malware payload", "value": "57d57d3679069004f8326a50ad82a7c89bb51dabc2c9e26db880d23cb6f4d78d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003866, "uuid": "992c4870-8a21-461c-85ce-d92bbad93b4d", "comment": "Malware payload", "value": "ab20a1a2d7115579361650fbcf58c5147ca17367", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003866, "uuid": "36582539-78e6-480a-8e5a-10b4e7f506b7", "comment": "Malware payload", "value": "4d17b0bff3e5dcccaca70414526664ef35cb0f32cf54f4d99403897dfce46f8c9ecf7b67e34543ba8bc91409a7284918", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003866, "uuid": "e0284f6a-410b-4479-8d3a-27b47c79993f", "value": "T15085D43C9527A26D11B5CC61DA8932A36C657726B82FF6C021E64784C5038AFFC65F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003866, "uuid": "78a6effc-4a61-4e0a-8381-cda86d3493d7", "value": "12288:/g9zLTyZ7SYGTW8+10PDwBf+/xMMt4Nd9pOmCS2dFhwZml4tnxibeOGWP4WPfMLe:JZfwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003866, "uuid": "cd64e30e-de8c-46bc-9c30-f2ab48725163", "value": 1831290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003866, "uuid": "add33749-1561-4116-b0cc-6059723845de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003866, "uuid": "e225c28e-0e7e-4dc6-b302-35dd1457dd22", "value": "Purchase Order Quote_Confirmation_November09-2025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e799a9e-7651-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783022807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022807, "uuid": "884d12f2-9331-456b-98e4-e7844fe300e2", "comment": "Malware payload", "value": "7e9070bbf6dc64d6edd5cbcd7aeb6a40", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022807, "uuid": "25aff54a-ce66-4026-b150-41fd72994b2d", "comment": "Malware payload", "value": "580877c7bf8d435f28741037a3e64dfefea32d9e594196e39308af80396596bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022807, "uuid": "c0aa742d-88c8-4224-9552-e8135d3a55db", "comment": "Malware payload", "value": "d9fac2178fae613ddc52b4c422a91ef5eea2edda", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022807, "uuid": "69d1588d-9f26-45bc-9da1-dd59743bf743", "comment": "Malware payload", "value": "7fd65801b2f27fcf5ee158d404e18bd0a6091b098e30406def4785f0c2f6eec35d1ba4d8789857f9daf33bfd7f3ca0bc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783022807, "uuid": "47f29afc-2b9e-465b-9ac9-87f31b69bb0a", "value": "T1B9236C6516857C24AE99C9371C7E2F0CB9A983E5320452EDBFCB3CF28C4AA9CD11971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783022807, "uuid": "41d87b9b-04fe-429e-afd7-9f592dc6f3ec", "value": "768:t+Z9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:t+ycB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783022807, "uuid": "3c9d9494-127a-43a3-b09d-be6b93c8c79b", "value": 48360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783022807, "uuid": "0a178c26-de50-4c26-a4de-e2d767cab409", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783022807, "uuid": "8db559dd-e9c2-461d-9d0e-937f89c11789", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c34b02-7636-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783011084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011084, "uuid": "3e5b552c-ee8e-4ccd-b2f2-c13681aac5ab", "comment": "Malware payload", "value": "06fc3297f923760dfd188c5b9877488d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011084, "uuid": "b0d8d7d8-02f3-4cad-9b6f-ffc72860ac0e", "comment": "Malware payload", "value": "584e53183beb40b458829a5d0091b9b451741b5f408f8096155a0911d170ba4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011084, "uuid": "04b0693c-52f1-457d-9a54-e6ea8e54bb2a", "comment": "Malware payload", "value": "db32e153aed67439fc3abd4d19ea16aa9c95312c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011084, "uuid": "c0419579-e379-4730-8f0d-848394863cd2", "comment": "Malware payload", "value": "88934dba84381d08b1e569e0a39fb1a1cbfa9a14d2943cab33ab3749eb7e12af958be6caa8e303175ce486e003c8c401", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011084, "uuid": "2594873b-3196-4c40-aacc-db8344b50e1f", "value": "T18BE55B40F79B82F6FAD3927904AFA21E013BEA1587604AE7C64C76079934AD17E37347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011084, "uuid": "ed8baad2-ea18-41d7-a669-5ec74067c9da", "value": "f82b681468e5ad8b7d142aae628a3d08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011084, "uuid": "a2eb69d0-5af2-472a-8aae-72fab77b83b1", "value": "49152:e/rpBGC2r7PbzFiHHBgg7K2eoJsv6tWKFdu9CuTgLyvL/6mShMZtmjNUVrciV5PX:+KDzi7VxJsv6tWKFdu9CHPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011084, "uuid": "d5ff4a9f-7e55-4dec-b6b3-ab965bb11415", "value": 3020280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011084, "uuid": "d06dd69e-0902-4fc4-a6f5-33b0de80b998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011084, "uuid": "775c28c6-9013-45c4-beea-01b63175a349", "value": "QtCoreADSK4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737dd738-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033500, "uuid": "fb9bc8c9-1ebf-4a5c-8a46-304a3e1a2173", "comment": "Malware payload", "value": "dcabd5b3f2b719c29782e6d355a703f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033500, "uuid": "d9de6231-6115-41d4-b1e7-d5cedfca1d42", "comment": "Malware payload", "value": "5891a3295e44a2a3e03cab01e78efa6c7e2650227fa611420d42b857c38d4dcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033500, "uuid": "811f41d5-c0ea-4723-952e-02ae7da94003", "comment": "Malware payload", "value": "da37dff3cd6a4fb813acb28511395bc538869696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033500, "uuid": "2193187c-05f2-4fc1-aa13-b33de5b8be50", "comment": "Malware payload", "value": "0d8ca669b98d354313a311956626e91e2e31aa4244fc64f729ddf4aee1f7f4041bb727e51553f38d9ebe5ca1498754b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033500, "uuid": "09ca3853-5523-41c2-b81e-f62622fd9361", "value": "T194C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033500, "uuid": "243b8a52-b07e-484f-b9e2-07cc5ac9daaa", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiycw:VoRNjmj1VGFVrRiyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033500, "uuid": "2921578e-519f-4129-99b3-de71ef3c524a", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033500, "uuid": "6b341f39-f592-4276-9193-f05fa24ade30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033500, "uuid": "46ad4998-9177-4236-a541-f88bcecb9a1c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a7a4ac-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1783015230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015230, "uuid": "00274a49-52e8-49d6-a41c-83470351ee39", "comment": "Malware payload (RatonRAT)", "value": "a95c4a4d11d588a6690fd1e95e4c3520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015230, "uuid": "e657ad26-9d58-4336-a981-0153123bcf38", "comment": "Malware payload (RatonRAT)", "value": "58a919673d1c3d581fe9e14a437a94297a77cce098191c286d5021a2211d6130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015230, "uuid": "fb6162d5-163b-4122-b161-b5bcf1c67e09", "comment": "Malware payload (RatonRAT)", "value": "aca1078490d18009171b614edaf5ba314d32ab77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015230, "uuid": "7a37a27f-e258-4b9e-be1d-649ae3307b98", "comment": "Malware payload (RatonRAT)", "value": "b9eb0bc1895492a791814673808f3994396dedae1a9efdfe064293de037f69c42f7ebcc114e7bcc99b3d6b2e008023e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015230, "uuid": "8cc90795-a4c6-41ad-9465-fda9fe664dd5", "value": "T158C5011833F9C618F1AF4BF4A47189664771FD179C62DBAC58E139AE04B6F44BA10B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015230, "uuid": "7fa79367-70ab-432a-86e6-218a02c105d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015230, "uuid": "761dc5f8-42bc-47c1-954c-4f7723b65e99", "value": "49152:/gVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4ZAn4n:/gVUuHjkDGjYQDGuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015230, "uuid": "8df9f8a6-fdbb-4cfd-b871-18f689b754a1", "value": 2506240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015230, "uuid": "775b8c65-baf2-46c5-9a89-7a52be757c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015230, "uuid": "f62d727f-a20a-4da3-911c-87537d140b99", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d06a3d-7627-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004546, "uuid": "64ecde25-b563-4653-b1bc-4825052280cd", "comment": "Malware payload", "value": "930b443563b09df610e688ef3cb6dce3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004546, "uuid": "881f29d7-b882-4891-b9b7-fbcc6d482e91", "comment": "Malware payload", "value": "5905d263c9f829a66d5d31fccc40be6f5d589990a079683f66b11633a78e6e02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004546, "uuid": "a1ed8fe9-62af-440f-bcaf-7c36e6419534", "comment": "Malware payload", "value": "44f9a05d1e09107fb28e79526d1f98212a9c58eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004546, "uuid": "b9eea592-4cfd-418c-ac9a-d0847caee38f", "comment": "Malware payload", "value": "783652e1177f83867d8ec511ef19d3807547c8eb31ca11e357579bd7e69a42887664086e018da4ca3ccca7cf61106254", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004546, "uuid": "7b7cb1d2-ba09-4885-b8cc-f6f89ca4e789", "value": "T15151B44322F36476072BE4A5F2822C152157D122B225CCE1FCDE65E60FEA068C223AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004546, "uuid": "c8b79ff9-1327-4e87-94ef-757554d658ff", "value": "48:l0mMZekah1tQpKKNfAE5nFGYqgOsNJKlUBsB/NS/k6JytsyxLob+7rkoG:zPhjgfbnFGY9NdsB1SM6JytsyiK7woG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004546, "uuid": "79cb052c-d724-4db5-8156-c05032f25c80", "value": 2469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004546, "uuid": "0c19e567-5bc8-4e21-b294-d847fe6e741b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004546, "uuid": "37984ec5-9540-46fa-a413-ce8b32dd7d40", "value": "5905d263c9f829a66d5d31fccc40be6f5d589990a079683f66b11633a78e6e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06a76b3-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966600, "uuid": "b7e844e6-0184-4b46-9688-50fd5b4f8c37", "comment": "Malware payload (Mirai)", "value": "65faae5d09d1ca53736a0e51c6f964c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966600, "uuid": "35f1241e-449d-4dd0-86c1-2d33a003270e", "comment": "Malware payload (Mirai)", "value": "5a4f83d9146cf4afc6eccab55e67b464d76ec6ec5343df55a5f98e59b57b8503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966600, "uuid": "913a543e-f7b1-4fc1-90e3-d4eadff81b2f", "comment": "Malware payload (Mirai)", "value": "83bc77a755feceb51d1a572b782acd5ac489c67b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966600, "uuid": "31747eff-e732-4eb8-9a6e-8a161e7de95f", "comment": "Malware payload (Mirai)", "value": "9d23dcd4e8a80c48d7502c3a6b3c3ddc4b688581f05247fbf808b8421f53f74d10229ff2a87abe066d1a736e28080219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966600, "uuid": "d181a06c-9c3c-431f-95c4-3fcf589a205c", "value": "T10C63079678C19A12C6E423BBF96E41CD332563A8D2DF320B9D212F5477CA82F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966600, "uuid": "219b5d0e-dc0d-4f6a-bad4-64f506903140", "value": "1536:U69Uvb15Wu1S7+hIVt5f6pxCCpRTYDdOcahWMUOH4g5b9/e35uEfh:U6ex9RgdOvhTqgm3nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966600, "uuid": "35cf383d-df56-45c8-b670-9268cf5891a6", "value": 72188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966600, "uuid": "74d5db93-06b7-4451-a954-c6b209ee2204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966600, "uuid": "41cc6d3b-7077-4b6b-aefb-4a89df355f1b", "value": "vcimanagement.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36189a9e-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006338, "uuid": "e022f869-7d2c-4f95-84a7-86dc428f9a12", "comment": "Malware payload (Mirai)", "value": "22ce369ce5390860cf18bfc5d775e450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006338, "uuid": "8dcf36e4-8a04-49e2-afb5-26e63c60019f", "comment": "Malware payload (Mirai)", "value": "5ac2d5bf45498009305004e54cb3067d9f9d07a964f44b59864059d3f8afdf8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006338, "uuid": "c1397861-1926-4f14-b8e4-0dc31eb11ecd", "comment": "Malware payload (Mirai)", "value": "b827f3cb83d680799f1776fb3486ed8cfeabfd15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006338, "uuid": "6f12d3f9-8e16-4c54-b758-f62a0c82d9cf", "comment": "Malware payload (Mirai)", "value": "284957be3d1b1c8f7408ee87585d9112961a50d7a64fb121e094874635a5d84ebf60c569cf03b9e2328ff83d318b6d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006338, "uuid": "125c135f-b3ad-40dc-b351-05a131c32ead", "value": "T1A0D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378696B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006338, "uuid": "2838912c-9c59-4f7c-acc6-7dc398c63500", "value": "1536:YKdzElm18uZJNb4ADFa8eAZHk4VB7fzTTzztqgYCv3WeqZP120lqSwyw6RNPQT6e:YKp50sU8e947LDztqzCOtx1hZHtKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006338, "uuid": "445d2283-557b-40f8-bccd-dcdadf6cd459", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006338, "uuid": "aba91413-2cdf-441c-a27f-42898bb9af40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006338, "uuid": "db446f05-1ac4-47e2-8128-72884c37fccd", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4372d17e-75b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782955251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955251, "uuid": "2b30724f-8f3b-4224-bf16-f40581b6538c", "comment": "Malware payload", "value": "720cac7fa7554f1b8fcc8b725ad76ca0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955251, "uuid": "c70ffba3-6979-4dfd-838a-9b67fc7dd48a", "comment": "Malware payload", "value": "5af8303a76db5feaac150cc350392fb8e2582c27adbdf59566528b741c14e3f3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955251, "uuid": "225241e8-7e95-437a-9a50-abeaabea0a77", "comment": "Malware payload", "value": "18e6f5c001feac288fa34dc3e68d33523b1ada02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955251, "uuid": "90d736de-ac88-4a11-8150-db3d50cb03f6", "comment": "Malware payload", "value": "fe7d1193ddfe4cecb6220529240b9490cb295a974f7d8a6efc9ddb6f9755d2b0bfaf157ab635e136c2058ad024dba23f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955251, "uuid": "9a447e17-7850-40b5-8c90-74bfb977cf70", "value": "T1C8F08203B487F032804439A89765F75AFC247C476262CD4CB8407A50DED24247861140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955251, "uuid": "7db7e6bf-9c49-4881-b0ca-463fdd464319", "value": "12:lSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXqNB:lk1gYpTr8i3fOq2bf8IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782955251, "uuid": "3d32a6d3-60c2-4f01-8d99-e1f0c2200373", "value": 493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782955251, "uuid": "dfe162f0-d3cb-4fb3-be17-ea27a0b33a52", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955251, "uuid": "1ce99804-446b-415f-b549-6fcf7c965555", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d779f349-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004462, "uuid": "34a9464c-f6e4-454d-8755-f86572182cac", "comment": "Malware payload", "value": "6ececfd648e8cef1b52b48aea686efc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004462, "uuid": "1b9a050b-dbd5-41b5-9680-54daf3a5984b", "comment": "Malware payload", "value": "5b44a434ede037e2caf676dbbb40a706676e69db02406ee589651298eaf60575", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004462, "uuid": "deeae9c4-e81c-49fd-9799-59ee48a42d31", "comment": "Malware payload", "value": "444e2ce449032e7cc6ec62ffc80ced52a98f15ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004462, "uuid": "5808ba8c-dc4c-47ea-a6b0-846c86c8fa7d", "comment": "Malware payload", "value": "c0569ba7c15968edafca778d992482d340aee7370d79c89043946f88d7588c5eaee78678af7056bf23c1ec7362529e7e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004462, "uuid": "1a366c26-9a85-47ed-911c-b92f6e8d4d6b", "value": "T1DA81532514F629550373B6E8559BEC71397B9393338CCB503E2C83709FA11288A72AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004462, "uuid": "5fff0159-bcfc-4abb-957c-7b97e3e12501", "value": "96:qqoAJJatDAlIwjpG98N8ipg9sRg3koYLtAuatfta:qqoAatDAlIwjpG98N7pgyR1oYLtStfta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004462, "uuid": "958cd88d-c569-4204-9f95-b3730362d214", "value": 4097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004462, "uuid": "7856537f-3fa1-4a6d-8d9c-cfda306394fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004462, "uuid": "8b945f7f-4c29-41f7-a431-389ed74f732d", "value": "5b44a434ede037e2caf676dbbb40a706676e69db02406ee589651298eaf60575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfaf6ee-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988499, "uuid": "326f7a14-845b-4592-8bd3-8b97c73623f8", "comment": "Malware payload", "value": "517e18c7121840a5ecbba066f8acb99c", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988499, "uuid": "a62e6eed-6a22-45f1-ad4e-58ca907d5a0e", "comment": "Malware payload", "value": "5b4659ef2ccdf5a839e1e509d77a53591bb964a857297aa47d18fb7b03fade28", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988499, "uuid": "1261abdf-b4cd-4577-ad44-4c599a345c41", "comment": "Malware payload", "value": "ee47b67e0b624c0192013ead0fb87704d7d42467", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988499, "uuid": "fa0de1c8-8e3d-4f67-bb7c-9c364c700821", "comment": "Malware payload", "value": "6f44b8547448b1d38de83e3305a845a43fa84558474e34cf934c95a423664ddb7874f3c12528c8fae6553159eb1a5a0f", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988499, "uuid": "dd24b502-3526-4a94-a26a-d8c276df84a5", "value": "T1E425E02AE91164B9D477A0B1434FE377C924A635462788CBFF5A1C28E6392D09F3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988499, "uuid": "236ba46b-cf53-4f42-b771-8c2eb6915d05", "value": "24576:lADyiTwO40PmhCXCtTvcqs5t0G944qegBXsb/ufd:lAWiTwH0PCPtTvcDt0XtXcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988499, "uuid": "3fec911f-029a-4065-9a25-b50b9c7a4eb4", "value": 994743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988499, "uuid": "71aa3164-a301-443d-a80e-990d831f424d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988499, "uuid": "d8739488-fe85-4503-a5fb-23bd1c6be5e0", "value": "5b4659ef2ccdf5a839e1e509d77a53591bb964a857297aa47d18fb7b03fade28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a6b0f5-7630-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783008463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008463, "uuid": "27ed2c71-dbcf-4227-9db0-e64a90f716f5", "comment": "Malware payload", "value": "39e2c1d8cbcdbfbc18bd9a42ab184fcd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008463, "uuid": "4f0a1d7e-2636-4ada-ad16-8e4484d488c2", "comment": "Malware payload", "value": "5b5b23977a85385836d159adf908f6de353ca69cfc390d1fb45247551afa6a01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008463, "uuid": "3237110d-79ba-4840-a4f3-db469681d15d", "comment": "Malware payload", "value": "6a7f6ab059ae637d7216286e815238b9e2319983", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008463, "uuid": "b8965cbd-9957-4fb5-bafa-709b44098885", "comment": "Malware payload", "value": "bf5c4858cbe53cc3bd6dc907ea1e4f6802236ffecc6a0aeeb54711f862ba09bcdef250f795138b4ca521a6a4e76e0eb7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008463, "uuid": "be8c6618-9658-45dc-89cb-0dcc33819acb", "value": "T1F0A55B38ABE0475E6235C91157D9314AD40FB7837BEBD89446B60ECD035308ABEBB25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008463, "uuid": "7e1e3ba6-5d50-4803-8d91-ee15e82d31be", "value": "12288:e9dcwgsBdgQ0N580j7HLbJl7m8ztLkJvWudDcFF32KAx0x9V0z077z:e9dc5r8y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783008463, "uuid": "132805bc-106b-437d-af97-bd4d58e04be0", "value": 2116636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783008463, "uuid": "c19a3f82-0691-4583-82c5-271e04b117ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008463, "uuid": "342566df-55af-4c50-aaa8-72c143a95160", "value": "Orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d8d626-75e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782976273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976273, "uuid": "a9415ee2-377f-4876-a47b-6e3f7a415c7f", "comment": "Malware payload", "value": "ac58629219a864da0b8d009eb34fd751", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976273, "uuid": "c2663047-e0cf-4723-8709-2b2e385a5ef3", "comment": "Malware payload", "value": "5bba965663e0d5a03be8cf57c4174ab408e022a5652db8addd238c12c1127cc8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976273, "uuid": "26d4630c-4819-4be5-8c11-1e3ebec72894", "comment": "Malware payload", "value": "1a3e1836c420300acb1fbcbd5c9b61f686b645ed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976273, "uuid": "b3260a7c-5534-4f44-8f44-77c208a4faef", "comment": "Malware payload", "value": "94dc6e129d449f5d5456e85fe42f590f343a176d599b51133bb5d76b52a5c65fdf39f977f891b8352cbc4a6f05809576", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976273, "uuid": "15666227-880f-41cd-9425-c52b285d7411", "value": "T111236C6516857C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C4AA9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976273, "uuid": "3832be3e-3c98-4b1a-b367-876c5da43449", "value": "768:qr9NyXsZztCQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:UHusZUcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782976273, "uuid": "0b2aac58-4b18-406c-aa9c-ad15dde5965c", "value": 48368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782976273, "uuid": "22df58c0-70d8-4304-bf21-10ff440bc044", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976273, "uuid": "ab874719-e48b-434b-83ce-70de8066ea0f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c82ab9-7652-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783023175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023175, "uuid": "bc28cc4e-18b5-412d-bbaf-e3201f8cb483", "comment": "Malware payload", "value": "0dcd4b0c11087e2085ba203b9a3eef7c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023175, "uuid": "bcd18bb0-1dc2-4416-82d1-2000a8433b8e", "comment": "Malware payload", "value": "5cad494f67808745489659cd077dce429fce364a673c44c9d238d14dcca81732", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023175, "uuid": "647c2e58-83c8-4766-953a-ad01c3673697", "comment": "Malware payload", "value": "e2559a0431c9aa6c1881a7b44b71a099adc1bde2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023175, "uuid": "a6c4bc88-0c7c-488f-a9c5-03f05996927c", "comment": "Malware payload", "value": "fc1ef5b69932c06b9403881a769910c5b55d06bfd73e6fa61878cca785ad67a661185a521a78f2bb01037f88884e6ac7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023175, "uuid": "1f13a692-e2d6-420e-861e-bc60ef2f3309", "value": "T124A45C06EA904E33C4AE127D45A31780373AA949AB43834B320DEA787FB33D65F975D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023175, "uuid": "4167b723-207b-4f24-a249-c8cd52d2c1cc", "value": "6144:iodf9exi7x2lV5RMFs53cogD53Mpd39RCjBbit+l:ioT7xsvMs5Mzmp+biI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783023175, "uuid": "ec2de6a8-8fcc-4cdd-ae49-73ddc6b87eb2", "value": 482236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783023175, "uuid": "70ba26aa-0e2a-4181-8df9-9ef2e7e5c6a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023175, "uuid": "7bf32f68-a57e-4601-9412-42787196ca52", "value": "dog_patched.tmp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30edf1f2-75dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972399, "uuid": "05003913-d2e2-4473-a2ee-48304c923b29", "comment": "Malware payload (Mirai)", "value": "f0c5e2eedf631963c9f639cd20e38258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972399, "uuid": "6a1f4c1f-3156-410b-ad47-91ec4530bc72", "comment": "Malware payload (Mirai)", "value": "5cfc29ff69e380152b8f65b447cc3958c1cce711a11f304f1351f9257126c1f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972399, "uuid": "e9f8379d-811e-40c4-be10-ea51f87a300b", "comment": "Malware payload (Mirai)", "value": "08f6dc5a9f68c4a40ab8d0b035d7604a65306334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972399, "uuid": "d058351d-46fc-417e-8286-30f2c4138cad", "comment": "Malware payload (Mirai)", "value": "fe0b264829ce6163809d05eb91567ef7a9c8122c01dd29c00c2d5d1d091c1c3051b14569bdbd5151f2a125a6884f689c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972399, "uuid": "6c06eced-06f1-42da-855a-911ba15132c5", "value": "T17FB34B63AE9A8827D4A4FE3A91FB8370F0F3478520780B2D7D230D4EDB3575525676A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972399, "uuid": "d32871bd-3cdc-4ae0-8546-41ef0a675750", "value": "3072:K+WueYbrbM0JclbatbdS1kjMZ+zE0Oxd5vlmCwsBj+8S3FyBwMTlN8259Tu6:K+WqM0JclbatbdS1kjMZ+zE0Oxd5vlmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972399, "uuid": "ee14381e-3731-4601-8059-a27e2ea733c8", "value": 107956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972399, "uuid": "452fddb1-858c-45a5-b12a-40c2a022b25b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972399, "uuid": "cafbcb21-a089-4ca4-ab78-fc9e320321c3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bcbdc1-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009267, "uuid": "733e9644-eaf4-4be5-8cc1-544833af28b4", "comment": "Malware payload", "value": "2089ee30a7d2a1dbac2d2d10f40abdfd", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009267, "uuid": "53e73e0c-ceda-4506-be84-42ebc47f0d55", "comment": "Malware payload", "value": "5f0f24ffa7b54bbe83538e1688c799747cd17e582a9cf8df7339234166191acb", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009267, "uuid": "0554efee-c795-412e-ab97-78468e1c982a", "comment": "Malware payload", "value": "c90188c9d68d9f570fafea65bb44bd9ca7c8d5f3", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009267, "uuid": "ccb9d746-54b4-410a-90dd-f25aab609a29", "comment": "Malware payload", "value": "57e6f72a91e9f6e1be5e9e9396b2e9385f6127eec92ed36d416c4c329d54b5c68bdbcd6a4cedcc8313bd76f3f05f2dc1", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009267, "uuid": "89032905-5611-48cc-9f42-7de6e9ca791a", "value": "T135B5E01651B7F6BF50CDC9C7A03D98C5C6C08B40AD23A52AED24AF56F652986F330E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009267, "uuid": "48ebe07d-1d6b-4c02-b144-9887e8ab8532", "value": "192:zd5gU+PzCdOQ7oHc/ewDGIozCv1HuDUFU6CDAZFyGovc952mWIq2F2ZQYjo2V0gL:CiGd+S9rnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009267, "uuid": "12313c5d-bbba-47d7-abc3-e257598b08f8", "value": 2345663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009267, "uuid": "5928453a-d883-4955-b274-12e0a9300970", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009267, "uuid": "f047751f-43f0-4a6c-9a94-27daf43ca537", "value": "5f0f24ffa7b54bbe83538e1688c799747cd17e582a9cf8df7339234166191acb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1c1630-75f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MustangPanda)", "timestamp": 1782985062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985062, "uuid": "c018bb36-a3fa-4fc8-9c4f-824a913f680d", "comment": "Malware payload (MustangPanda)", "value": "6b8111fb3872af45882278c794b74bdd", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985062, "uuid": "fab037b1-430b-4014-9119-ef69f3d5bbaf", "comment": "Malware payload (MustangPanda)", "value": "5f22ec5c14dfd47c92850a5fb3bd8e3754d538b8021b6238238e4020336cfb5c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985062, "uuid": "a04b59e8-38e5-4e61-b8e6-7453461a95ea", "comment": "Malware payload (MustangPanda)", "value": "dd599bf489bd545edfe0909cf9ef4f3e29f8f0e1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985062, "uuid": "2198128d-2864-4ddb-83f2-5f35715bdce3", "comment": "Malware payload (MustangPanda)", "value": "7c8fd518f3e2f9f1c51f91a06da84c4050e86d05353dd5c028da28ba36045103d2b293b7412ba1ef849a9d575f44b5b3", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985062, "uuid": "d0d76bfa-e6c3-4214-88ec-60a31a728343", "value": "T140647B11BA42C032D9AD44707579AFA6493DAC704BA095CBB3C41EFA9D345C2AF38F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985062, "uuid": "10005e0e-9975-4e5f-b311-98f019fa6483", "value": "5c3561878ba749648363ffd4499398b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985062, "uuid": "197e86ed-459f-48ac-b17d-4b1357095f5f", "value": "6144:KpyFm9hUAXnPHfSE/OZ5NC8L3QC67vWufxo7/:KNfKQOrh3U6Ax2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782985062, "uuid": "afefd046-cf97-46e8-bcac-8fc5ba611b5b", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782985062, "uuid": "e76994bc-ba04-410b-a092-eaa391add1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985062, "uuid": "308d671e-57d5-4fdc-8815-b42afcd3e718", "value": "5f22ec5c14dfd47c92850a5fb3bd8e3754d538b8021b6238238e4020336cfb5c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabf7b39-75ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782979905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979905, "uuid": "889c6aae-3663-492c-8036-3c7fe8d66485", "comment": "Malware payload", "value": "2261b60a4cf9b940c080823e6f5ac1cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979905, "uuid": "473ed075-28c1-4d68-b45f-77391427bd99", "comment": "Malware payload", "value": "5f64d5c44db38abc103bea9cd463e4c79681fd874c7f21e4ff9d0533025260cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979905, "uuid": "ca716b5d-d987-46f7-9a6c-3b7edec4db17", "comment": "Malware payload", "value": "00e392b548cf803ff0623feee5ca302ec0c60983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979905, "uuid": "1062de38-72f9-4085-b93b-e5eacde84a37", "comment": "Malware payload", "value": "b76c5a94e60a8cdecd6ee61017d653b51f937eb3afb9992e50e4ea41ced3cbef58943d6f04ad14841897c7932fae7acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979905, "uuid": "9f5e91b4-d1ad-4c2b-a70f-9cdd732ffde3", "value": "T18F873B47F8E11D94C4EA8574D169416BFA723C2D1B3C23DB16A0F7201F3A7E0AAB6B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979905, "uuid": "275b8f65-9d07-4a42-bb6f-a37c7c05efc9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979905, "uuid": "359a0184-dda8-4a8e-9ebe-778b7dc92f8d", "value": "196608:D53tARYufBcljTdVdrYz0eD1I5PGJSpA0EJ4m9ce2VDDuu/qjy6:D53tAKlj5c7u9OgA0EJ4m9cJdCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782979905, "uuid": "7f71181c-e157-4efe-b439-0173c745ecd0", "value": 38053376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782979905, "uuid": "586bf599-973a-4c70-a8e8-c30a497a302c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979905, "uuid": "eac942ec-6efd-4f3d-8339-ad1ce4dc5122", "value": "2261b60a4cf9b940c080823e6f5ac1cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac209e07-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966593, "uuid": "8127a879-3de5-400e-9532-b26a0632e4b4", "comment": "Malware payload (Mirai)", "value": "8a5fd113040c60ccd081bb5607c33350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966593, "uuid": "f95450a5-6109-4ad4-9e44-2ae9217a3d4a", "comment": "Malware payload (Mirai)", "value": "60cbc151ef10a9e7309638ea2d90c7da8a72af4c590308bca61f08243b64715f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966593, "uuid": "040c2713-990d-4d7f-a822-fc4b95a5821e", "comment": "Malware payload (Mirai)", "value": "ea3dc6d7f447b8ad0b4ab68e0f944449f5844765", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966593, "uuid": "9721a530-07bc-4a7f-9e0d-be6c1c602b16", "comment": "Malware payload (Mirai)", "value": "1409e07b1ecdaffb03ae3100a48ed1e045f147c8aa240e9d41f15f3a708ca0671088e6aa2667f9c015936da7e042fb77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966593, "uuid": "87a72b69-92ab-48e2-a022-54da7ecb1f75", "value": "T13483E895B8C18E11C5D413BBF92E018D331267A8E2DFB2179D206F147BCA92F0E7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966593, "uuid": "e308d2b4-7ff1-4ed2-9e4c-4fd6ef666cbe", "value": "1536:uRnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/cQ7dTMi6N1vGKYw5e5e995nZ4cuIfN:VgYLp/t815YNPeUqoMS/cod4pNFNL0aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966593, "uuid": "f408a4f8-0c82-472e-950b-7ca9533344e6", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966593, "uuid": "4dd43ef7-28c4-4398-9ad2-8b3fb1a3185a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966593, "uuid": "74d4a59c-9a50-4ec9-91c0-87d198c9b2c1", "value": "vcimanagement.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ed553b-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782966392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966392, "uuid": "64f47da7-eda6-4489-bbac-fcb84888cf75", "comment": "Malware payload", "value": "3e26666a681a09df3a6b80e475ec3fbf", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966392, "uuid": "9adb2a43-5d28-4be8-9bde-6f30c5ea379e", "comment": "Malware payload", "value": "614b2ac37b407b9a136255fa9709ed1fcfa8aa0b82b5a6065753a8eeddd111da", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966392, "uuid": "0548882a-30fb-4689-b2a1-df04a8a5ec55", "comment": "Malware payload", "value": "9e0f1ff4b4b4a8189ea6827dfbf6b7ebe9f891b1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966392, "uuid": "3e586be9-442b-42d3-9c4b-b41e250b4794", "comment": "Malware payload", "value": "96dabc49f1041f1a899cb510069a2de4c69c62b8db45463db9b36f890887238208c2b58e47c281c7367e25953c533151", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966392, "uuid": "5bab8989-6af4-4a64-9ebe-2bc7959f39c1", "value": "T19C873340552D8986DA61C6739FBB7C7238F61D40E1833EC75AB03DDCAE7A087AF5121A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966392, "uuid": "7f5909f3-1910-45b1-b1e5-b80d5020548e", "value": "786432:GDY6c47RFH8WEwnszZh1SC/JOEHW01ApgKQp4mDW/LyBGMhy4nBFh1V:+nc47RFcWEwszZh1SAUgJ1Apg2mD4uBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966392, "uuid": "3d740d74-efcf-4680-99e7-d274805d81b5", "value": 36231890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966392, "uuid": "d8de0e51-dd50-48f2-addf-e3639b70ac09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966392, "uuid": "bd8a2a93-2193-4da3-b022-83416dd28a61", "value": "\u6a31\u6843\u64ad\u653e\u5668.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84da6ce-7643-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783016892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016892, "uuid": "19d05a26-1b7b-48e1-bcd1-43ecc814a25c", "comment": "Malware payload", "value": "960886abaf8f3665e16ce0604b14d3ed", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016892, "uuid": "53ad7dba-f0c1-4e49-8b2b-63142f37db15", "comment": "Malware payload", "value": "62545321423f75c0f4774c868a1677087399353adda0fb361cd3884d2680dcc2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016892, "uuid": "4ec7eec5-eb44-4bc5-88b9-ed99e6787383", "comment": "Malware payload", "value": "b70ef320a7c20fa96a57da56455521ac5e40f4ed", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016892, "uuid": "d6bb917a-3f15-4781-94a0-7bafdf3e5402", "comment": "Malware payload", "value": "9c2f1ca23aa33ca41065d8b63b8a6477a31a019e31d8dba143497d018490958e0f3ad8e036b45cde67dbbf0d47e54c44", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016892, "uuid": "627f71a8-9379-4b18-97ba-55eb2b9021da", "value": "T1CFF68E43F7029D6AC9DDE73819B693C23335FD4A5B8747131419F2ACEEB2AE65B05280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016892, "uuid": "f56fc3ca-16c0-4efe-883a-e3a82eef0085", "value": "98304:9UDER3kg6q+7akTBZgVUz6WfQukgZBW6Di/5v6ERSzEYmmmYu9pTwETli9DKqp47:9UY3R6qOtcV1upvW6G//RcFET89DNE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016892, "uuid": "2560e316-f372-4847-91fd-85b4993ea56f", "value": 16685837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016892, "uuid": "a7ff053f-18b7-4afb-b148-27d51ad1d36c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016892, "uuid": "32a54693-013b-4111-8d7a-f9a77fdfc123", "value": "chiken(6).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1642c5b-7623-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783003082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003082, "uuid": "6b97c69e-ffe0-4243-bc69-7cb421d31573", "comment": "Malware payload", "value": "ff3d8e665cc0275da6d7a08b46192a2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003082, "uuid": "c61fa050-4cdf-499f-b58d-6d733a40c053", "comment": "Malware payload", "value": "63333c3333e6f055cbe0d4443191db5ebbdfde72a88b66583c0954554d5ec9c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003082, "uuid": "2124e12f-7fa9-4078-bc97-e85273464431", "comment": "Malware payload", "value": "fd9bde139995ac87bff27397de1e5d4ef92849c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003082, "uuid": "a70a98ef-aa89-4e78-a41f-78b24e1be648", "comment": "Malware payload", "value": "ed27da6ac29101959beabd5c58dcde1bc795d79735c344b6fbef9e223af8d4ab4d525c07cf948f5ad11e645d23765bb7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003082, "uuid": "375c22e4-f46f-4f1d-8a74-bf3e447ab805", "value": "T19CA56D28A794204B50307BD069D022CAB61FBDD1FBEB85AC15F48EDE9B3221595B47FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003082, "uuid": "6bf9032d-401b-4ea9-932d-4a3221481df2", "value": "12288:BiJZWKcox7BmNgvsPKVEk1ZYXHuoYuwoTUgpL:BiHtc2v2PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003082, "uuid": "fc9ce9b6-bbb4-45fc-85be-6614b7a3ccb9", "value": 2135152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003082, "uuid": "fa249c8e-6b3a-4e2b-b230-f1dfd47f2ef7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003082, "uuid": "2d9a7780-4717-47a2-9ce6-bac258dbfdf3", "value": "Purchase_Order_2231000_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de99272d-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1783004474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004474, "uuid": "631c6f8d-694b-4a83-83ba-e8dbba0f2a20", "comment": "Malware payload (SiriusRAT)", "value": "7427e3e9aed55255da5565a9e856f34c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004474, "uuid": "1834d510-a14a-4174-a8ed-527f9c403b35", "comment": "Malware payload (SiriusRAT)", "value": "639d39a39495c4df56f46bc04aa82ba5631560b4b8d840b7a8d5e0e6c156876a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004474, "uuid": "35d20710-3a7d-41aa-a9d0-26d11d7f843d", "comment": "Malware payload (SiriusRAT)", "value": "8499c9783c250cacb17bfebfd1bf2affe889b2ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004474, "uuid": "e4cdc8b0-3042-4264-8d0a-b84fe11c4785", "comment": "Malware payload (SiriusRAT)", "value": "6baa45878948bad10bd46a6c1474df3b093661302cf767e138a5d027dbbaa3fb4528ea499cda438177b3ac0d7b3b4260", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004474, "uuid": "3cdc05e6-1f63-4ff2-a766-0648edb94634", "value": "T19375D4A4434A312CF7E1395310240E6D4F9335A7A528BE4C6AA8578F9E37E8ACF4571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004474, "uuid": "38eed736-2f73-48f1-978e-d9288fd7b1f2", "value": "3072:YIvMqCO1X9cYy1sRrZAKxpRljN3TKz4VUpIHQId8jhbTp+yXIVyTvsy040t:fXiKLTyIHUhgyYWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004474, "uuid": "04da3e03-3b3b-48db-9270-4b41c46af3bd", "value": 1621306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004474, "uuid": "536b9d66-9a15-4217-a0c2-da0562bf5b7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004474, "uuid": "006986f5-7587-4e70-aded-0ec8e6bd9a82", "value": "Quotation_Supplier_Input_Needed#0069493.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b4989b-7609-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782991889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991889, "uuid": "88fdaf2e-5e17-499f-8ee4-40fe641bd3fd", "comment": "Malware payload", "value": "197e1c8dd621a8ac978e0cd7e5c829b3", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991889, "uuid": "5e4f760c-52cd-4c5a-9fea-f31bb37c9b6b", "comment": "Malware payload", "value": "643566fb0d942de9646fe81c5471363ca3859082ac1fd0deb622a253eeb3f803", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991889, "uuid": "83d44331-6b97-4897-952d-16666efcf06a", "comment": "Malware payload", "value": "78e1f1c74d018ef615d98daa55255cbd1ad535bb", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991889, "uuid": "18946f28-09a4-47be-9511-7028e5c40f15", "comment": "Malware payload", "value": "4dc1c1fc3b220e4ace635e1018a879ed8844d16065f749e46c99aad283b7bf35794def4647c2febb0fe849563b1f81e7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991889, "uuid": "e205a84e-ecf3-4262-ba46-42c2e67702ac", "value": "T1D481C7DD29CE1BB68BC7967103D222853D65BF4CFA416C2B2438CE49F17E69441D2AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991889, "uuid": "ff7ba575-684e-4c12-9617-6c70fc51cb62", "value": "96:/Og0RAmYPF6tuK/QViO1KWiJllfBS3AyCb6:/W8N6t3QViO1KWiJllfBSKb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782991889, "uuid": "a42ceb33-bc69-414c-b61e-6745a2443651", "value": 4091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782991889, "uuid": "16559148-5db8-4823-8e35-03c9fb6b3431", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991889, "uuid": "9a2a06b6-6979-4764-89fa-699401467038", "value": "47959_20251125_RERE57808.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0accbe-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033464, "uuid": "3cc0c29a-550a-4d22-97a4-f3aaaff6af81", "comment": "Malware payload (Mirai)", "value": "df41e644d7de9dceaad7e3e09337d7cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033464, "uuid": "e10814d1-de56-495e-bab7-c07b12f0adcb", "comment": "Malware payload (Mirai)", "value": "661bdb7b97063415dda2647862e4a1110b10f71beb1ff58ca4c9deaee350fc6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033464, "uuid": "0be27592-3462-457d-b3da-41ea89a571c8", "comment": "Malware payload (Mirai)", "value": "93e48d77fd86fd7c236661306c4ec45fce6c150a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033464, "uuid": "3d58386a-78bc-4506-8fee-fb0cf3a914f8", "comment": "Malware payload (Mirai)", "value": "55e02c491473b2c84eaf85b6a1927b1b6c855c9bd6969f4661e4c2b9717dafd448d81f43fc69bac5751bc270c49d6237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033464, "uuid": "6713f692-76e8-42d4-907a-649f64130098", "value": "T179147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033464, "uuid": "2741eb6b-c00e-4994-bbd5-45d9952c34cd", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRXUKG:IcY5JpMByVs9jSSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033464, "uuid": "e0a8c6b7-d0bf-4f79-93b7-fa8682cb0e08", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033464, "uuid": "1c5874b2-1162-4800-858f-c981cb8ea3c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033464, "uuid": "5946b66e-8b2a-487f-864f-72b95d895130", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e006d861-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972264, "uuid": "86fa9c16-1a5d-4a9a-a95f-d5dbec94ecfb", "comment": "Malware payload (Mirai)", "value": "e59287d78e6b39fd070e3c5d9c6ce126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972264, "uuid": "431c50fc-7778-4bb0-bd16-721b6a3de857", "comment": "Malware payload (Mirai)", "value": "66545ac471c7a4e98e3b00b213476a246790e0db01af67ad6b4f0826c9448c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972264, "uuid": "1bbb819a-4668-4796-ac30-9e6f922bec43", "comment": "Malware payload (Mirai)", "value": "4728094ed4c7325f2a0222b3efe02510ec45c222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972264, "uuid": "0cfc4840-37aa-4671-a4c8-06a2d3d9897d", "comment": "Malware payload (Mirai)", "value": "41f83a068f5e3e213c6c14b8d6dc0372dc15548da142de53ba6cc6976644b139968f4851f724b0d585b41b49e17b6d0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972264, "uuid": "ab3edd30-592a-4604-b395-3b0ef958b562", "value": "T133B3074AAF790E7BC81FDE37059A0B4A24CD525122643F7A7DB9C938FA0B54B09C3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972264, "uuid": "8c6d6ae4-1f6d-4c6b-bea9-9d716e653a5d", "value": "1536:/fywOJMgirwMN3Zn/mXMyCZArU+to92MtKoTP4T:0Jc/mXTCRkcTQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972264, "uuid": "3727e3a5-ef0a-429c-9413-a1fae858263d", "value": 117892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972264, "uuid": "883773af-f2a9-4f7e-9dcd-5792e38bb426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972264, "uuid": "5effdf05-3b62-4a0e-a1df-fabd411fd4f0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb7ad19-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036553, "uuid": "7159c9c7-f7dd-4914-9d9d-21711ad2e28f", "comment": "Malware payload (Mirai)", "value": "8b6dfd3e2a266f8ee02ed97806f6fb1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036553, "uuid": "a13442dc-4536-4be7-a3a3-f1c7b3a6d656", "comment": "Malware payload (Mirai)", "value": "66aedd8aa6bd95a344ce8b3f0ae0b9c898157e8b92d33a9d6b841baccb3b181f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036553, "uuid": "6cf51b19-1d2a-406f-a073-498c62ed8fd4", "comment": "Malware payload (Mirai)", "value": "a66b9cd97db40dcc7b24e23a9524d0d41384dc51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036553, "uuid": "62b66f1f-f922-48b5-9b63-211fa635960b", "comment": "Malware payload (Mirai)", "value": "4823f785e2c2549143bef9c6261bec84ee29ffd6ee21782fccdf592e35a17e89199a7394d2fb7c20463cef91715fe60e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036553, "uuid": "d115713c-e259-48da-a8ac-74cbebd69bdf", "value": "T16DE3492274791A2BC4D6987E91F70B21F1F1D7D929A8D90E7EB20D4FEF202502713AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036553, "uuid": "bc75cfdf-2d3f-4b38-bd60-7f4df01cb4a6", "value": "3072:MPXI8371j5SWNwhdg5Qk7NQX5qcXHqwAH309CryQl8x4bCfj:P8Jj5SWozk7kq5XYQmx4ufj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036553, "uuid": "c2c9acd5-740d-47c9-ae22-f7099fb857c0", "value": 146048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036553, "uuid": "5606f890-612c-4466-85c6-102989ad2ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036553, "uuid": "79c09366-6ebb-483c-b340-b6c65f06c8b1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38143181-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006342, "uuid": "8a6aef5e-0030-4be8-ac3f-20e426facfe6", "comment": "Malware payload (Mirai)", "value": "24638c08b16fdde071f7851d5f40c30c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006342, "uuid": "067f23ab-458f-4c45-b727-698871cd63c5", "comment": "Malware payload (Mirai)", "value": "67027726ac2b17d901679bed44996c2dc84565376305edcc244091dccd950b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006342, "uuid": "c2949844-f5a5-42ec-b2b7-cb16005b1be0", "comment": "Malware payload (Mirai)", "value": "0662182033f72f6269b682705f1176aa25e72b2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006342, "uuid": "ad3a3ebc-fff4-4710-b80b-bc0191c233e8", "comment": "Malware payload (Mirai)", "value": "cd5c5fd5a7945e4dd48e0742e8447e7b370a324cd65e42e427cda5c674b4c23835bd0bda185fb84836f2a65aba3c630b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006342, "uuid": "8452f78a-b29a-4a9e-914b-c65717671566", "value": "T185042945EA404B13C4D627BAF6DF42453333AB9493EB73069528AFB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006342, "uuid": "e982c367-4f5c-47b1-b07e-b28089db52b7", "value": "3072:OzeSvtfLQ4oELv2e8wa0GzORuuAvw99Lrd38YhTfYo+M/Rw6FDFVLn:2eSvJLoE7T8wa0GzORuNKLrd38+x+M/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006342, "uuid": "875abc81-e11d-4a3d-b0bd-3567cb677b32", "value": 181466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006342, "uuid": "bd85d392-f1f6-459d-90f3-4afb4f515c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006342, "uuid": "55c5743c-651a-4570-a995-78d6f22e78ee", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661f9431-75f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782981079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981079, "uuid": "2fea659a-5120-4551-983f-c8720b869a75", "comment": "Malware payload", "value": "3540b4c55242921142505b7be1c6d722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981079, "uuid": "7d2354d8-1ee1-4f78-ade0-98afae71095b", "comment": "Malware payload", "value": "675af14fec0e22b1cb51bf945b12b94809a97ffc1c84fab1b3239df69becc04d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981079, "uuid": "1b48c2bd-72cb-468b-836d-7514df8f86b9", "comment": "Malware payload", "value": "d096d3e90459d46d6c54747e63d675a444698251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981079, "uuid": "56238836-82ec-495c-b202-cf3d1173da00", "comment": "Malware payload", "value": "17c98f61f2f8bcdaf8e7e91619e9948b865cf0d87a0f03d624064d659c8c49c1e36cb476f43c6c517f6ba1c94dcaf2b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981079, "uuid": "ef8c9270-42ad-431b-94a4-bd6fe6bffe98", "value": "T1FBD3AEA7B24F2450C42506F45BCB9BAD2A2325014E3B96E77C6E363E6B735DF18063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981079, "uuid": "de06a3d9-7007-425f-8545-09a4fee5a22d", "value": "3072:9usSGG9jvKpn8w64QD82n3Pmq0iklg3CEfil7iq:9uv/V48DD8sOTiDCEfiAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782981079, "uuid": "739778d1-392f-4bb6-8018-7e9d82218ac5", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782981079, "uuid": "708e794e-2085-4ae2-8c44-8d63b5ac453a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981079, "uuid": "b089b90d-1c9b-45d6-8696-dab60bf0fbe9", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26958c5-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783015217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015217, "uuid": "918a58bf-c333-41a9-8347-e33bcb723704", "comment": "Malware payload (RemcosRAT)", "value": "e9d69275e98cd99b663a37f57d2f7532", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015217, "uuid": "ca0b8b5b-8a8f-4f96-b31b-8a967f810c2e", "comment": "Malware payload (RemcosRAT)", "value": "67aa3033ac68dadc36096277895080e9de3191d75541a884d761f4d38bd4a770", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015217, "uuid": "981585b3-8218-4d89-a8c3-9fa25713b22e", "comment": "Malware payload (RemcosRAT)", "value": "7e054718cb1088063eff8f3b196c80461e5a976f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015217, "uuid": "db219d6f-119e-46c5-8ac2-422014f7878c", "comment": "Malware payload (RemcosRAT)", "value": "11a13283655be91fff58bd7011ed910393bd9cd69480e56ff4f9031ad965cfd8d01503c72e6203a3733a6afa8d91a3a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015217, "uuid": "bc9259a6-1810-4446-952c-da90f32f34ec", "value": "T13A264B1153289276516DE76CD2379F6806BDE0135BEACF0C32AD47247A49F0B9B4CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015217, "uuid": "76fa5dfa-829b-477b-93ab-c448cd2cb49d", "value": "98304:SVEg3mr5LrIXRl8k/xwu5BL5EuOMuognRRQsQtjL4IGTG3tbw9TAocMPkPcRxiVC:S2AL5w4BIR2sD+tc+ocTpOkAg3wqMbgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015217, "uuid": "992dca6a-633b-4b41-a7ad-cdca327ac52a", "value": 4750246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015217, "uuid": "acb46f01-a3d9-495e-b7c3-1e103f22de14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015217, "uuid": "8347bf88-b976-4bad-8963-787e7ab3bb8c", "value": "Aircraft Charter Details-Sparts and Specifica.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40127db8-75bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782958251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782958251, "uuid": "8b1fd4d7-c948-4ea8-9363-dde86c622056", "comment": "Malware payload (Mirai)", "value": "e28002ea23f9d94b7b437cbe1fa36ce3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782958251, "uuid": "417223d3-25e7-4bfd-a25f-14c501622aa3", "comment": "Malware payload (Mirai)", "value": "67eaa2a0b90bec27372402195301867fae5fcb063dc006b13cc654ea2b74dbd5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782958251, "uuid": "8f7c1b12-5fc4-4dc9-a8ac-1573056ebff7", "comment": "Malware payload (Mirai)", "value": "f1c12d5b7fc1ac930e1b01751d7085e0f7fdfdbc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782958251, "uuid": "da21e29d-6079-4560-af03-c73d0e1eea09", "comment": "Malware payload (Mirai)", "value": "f9d10c6a0c4803a6fb8c8f730de17c9a9c5fd42e0af7d1ea8633897fda68f380e35818ff7a18f0efdcbd7a3a115555ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782958251, "uuid": "11e80dec-89e6-43f2-9cd3-f6737d8bc4e8", "value": "T1A1016FC681446D1050EAEA1D22E75594F810C3CE1A5A4F7AFFADAD3DEB84D14F026F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782958251, "uuid": "011a7916-98aa-4213-811d-8e9d3ccdd450", "value": "24:kXCKysE2hi0ziQvZohaiX41F3/M4EMtWZLXZOX:e9Qp+MsiXiEfMtWZjZOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782958251, "uuid": "f2e5d4e2-6cfe-49ed-bddd-af2eeb44f382", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782958251, "uuid": "68d3d08e-3f8c-4102-97d5-7e73b7321a6f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782958251, "uuid": "cecdeb31-8be5-426f-ae49-819e4d2e7c42", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f792ff3-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006408, "uuid": "2b7b605c-27e9-461e-b5ef-4f93a983287e", "comment": "Malware payload (Mirai)", "value": "dedc1a175b5f531b90319edfee89e502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006408, "uuid": "d516499c-909f-4ff6-978e-c2d9f7c93c39", "comment": "Malware payload (Mirai)", "value": "680eb7c3eac2f19a7906db81b7f0c389f60e09b630e4518c21207d982a4b982e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006408, "uuid": "ef540538-2897-499e-acb5-be5a875b7af6", "comment": "Malware payload (Mirai)", "value": "aec2c0880d193e1accd87654e450ad51d5b85470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006408, "uuid": "3db43361-e4be-4611-9b58-ba5f1df95eff", "comment": "Malware payload (Mirai)", "value": "0057aab97dde96030a2f48bc089959b8933ffd148662a787a3be12078c6633c8586add69fecbc340016d8e7b2c491569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006408, "uuid": "ecc8df33-12c3-454a-97a4-b80f4fdaa8e9", "value": "T11DB35BB3CC25AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006408, "uuid": "a955650d-f01b-4b8e-b453-2c1f604db15e", "value": "1536:+TW/VCxsHZusf2Li62C8j+KDRhPfPV2AZoeWMj/W+ARS7h:+ytCxsfx62NlDbV2ZeW8/b/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006408, "uuid": "0ddd539d-3c56-4535-9f6e-85f8f5f76830", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006408, "uuid": "eb5514f8-ae86-4163-9902-d2b967641678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006408, "uuid": "91dfa0a9-90f6-4657-9ef0-0f3d903ef80f", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a26290-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988480, "uuid": "5270557d-65e7-4106-afb8-31eb797c4d7b", "comment": "Malware payload", "value": "590538204f0c8009d025ff72295c32b1", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988480, "uuid": "dd59e2cb-2a5c-4aa6-a5d9-d03082ef619c", "comment": "Malware payload", "value": "6878e4e76d8922bc0a312b9e06e5a432bd8a465e18f21e68df919f9b9ec8bf5e", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988480, "uuid": "8fe1d74b-000c-429c-801c-a9a10f54e5de", "comment": "Malware payload", "value": "89b6b29ca3f2523421266b3d374f43420b7513fd", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988480, "uuid": "747695b3-077b-4eac-87a1-715aca8448da", "comment": "Malware payload", "value": "05c67db44033e89f7da3c14e28d7b2849d31d9b5b01c3e8a1ec9c76355beacb8f8ee489c0d83d4242d78e7128ced4fb1", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988480, "uuid": "f8931c38-1014-469d-90dc-34b83ffb7a22", "value": "T172350119F95181B5D5B374B2120FE776C92066309123CA9BFF5E0C68A63A7C0AF2D35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988480, "uuid": "7d03461e-8b09-4f50-9165-702f157b9fab", "value": "24576:CleCnrFRcFQJPTECJQiL+SaoCQXreOlR9+TiKhMXikoVaw:CleCrFRcFpCR6LoCQXXlRssxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988480, "uuid": "ecb81514-2e41-4fc7-b0fb-f572b6e3d9ef", "value": 1135675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988480, "uuid": "d6c810b6-ec37-4827-987b-71f95805af68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988480, "uuid": "26841b2a-6d6e-477c-8c16-045d0ad78f2e", "value": "6878e4e76d8922bc0a312b9e06e5a432bd8a465e18f21e68df919f9b9ec8bf5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d676dff1-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036672, "uuid": "f41f0578-f6b9-46b6-a972-98ea4becc8b2", "comment": "Malware payload (Mirai)", "value": "5f674f0ec6dc3947d6de0d0fc3ccf24b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036672, "uuid": "dceb9b60-760b-4c10-afdb-414fbdca62a8", "comment": "Malware payload (Mirai)", "value": "695b9a53c9fbf59f55dd818bd2bbacbb7bcc49b816d779bd9e8a9d0c82b5fc98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036672, "uuid": "f05d0d9c-d80e-4ec2-8e5b-948a2079f600", "comment": "Malware payload (Mirai)", "value": "1be34c554d99ba4e00504080aa6d265723f9c429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036672, "uuid": "6f342769-6b97-4c67-b24b-dcc115cfdd03", "comment": "Malware payload (Mirai)", "value": "64d8de827cd6bf9b210160aea29062209f65d7869584ce442de2006b6f2e3e80294dc2f8e49d692eebe89f1faede930a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036672, "uuid": "31332fd0-1100-422f-9e76-e9941a137df4", "value": "T13DE33981B9C25A27C5E523BFFA6E418D3325A3E4D2DE711798635F2037C691B0E73A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036672, "uuid": "4abc88e1-41d1-4bfc-86fa-1be36d2ab742", "value": "3072:83IUFhqIstIWkxTsk/Y4rFabolkCY4x4nTGdl:83IUF6YTlg4rFabsK4STGdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036672, "uuid": "70ba2935-f2fc-4dbf-9150-bc38ae85b832", "value": 148948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036672, "uuid": "999d8114-6c2b-4eca-b52e-7489327b3d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036672, "uuid": "d76a3dd3-fd26-49c0-a1e0-c9251061bb74", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8bc7b0-7625-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783003989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003989, "uuid": "693df04a-81ff-40c6-bfe0-58c11bc49a02", "comment": "Malware payload", "value": "ccaeec3790196a16bc2768bfe16d42bf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003989, "uuid": "d46645ea-6255-44d6-b5d9-5373439723cb", "comment": "Malware payload", "value": "6bfce1bf08377c2645bdaa0e710f4ccf91700038baba39cb464020373fab031f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003989, "uuid": "3405624a-95a8-40b1-a920-9d8e9bc07717", "comment": "Malware payload", "value": "320c0a8f7ac3ad6245443b7fcbf482004dc8b96c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003989, "uuid": "509aa184-4be9-4bda-97d8-63388d19f14e", "comment": "Malware payload", "value": "cf0437b9435c67ee9f26f4573ff69ea3ffca86c244eaaf5dc81ea96be60229c94d83be7c26e8f0f437706766438524ad", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003989, "uuid": "9010f2fd-ce54-4af9-add6-0edb52ac1760", "value": "T1A3D4331F43BBF19D859AE59A750CAE7863908EC9962B27F17DE9F740A1E01F12443C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003989, "uuid": "0d836f16-4320-48d5-a47b-c11074f6fb6f", "value": "12288:R3/h+Vo7PR2k3kK/uYxgZLri2wDlJb4m6v2uObCqfZG8W9zXx8kP:Rpi6JkfeVlJ0v2oqfZGvzh8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003989, "uuid": "2acbdfe9-08bc-4529-8564-804fb7d96e07", "value": 656020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003989, "uuid": "beaccfd9-e965-4cff-986e-9ff9217d4de4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003989, "uuid": "4a36efc7-07e8-48c4-a6b1-2d2598ca00dc", "value": "ComprobanteXdeXpago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c83290a-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783033461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033461, "uuid": "b77c8859-e0f3-4da4-890b-363ec42e43f2", "comment": "Malware payload (Gafgyt)", "value": "f893e8fbaea671eb60d80e1c4930270c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033461, "uuid": "33e818c6-d542-4048-a7a0-197febaada96", "comment": "Malware payload (Gafgyt)", "value": "6cb30f950e7f2f038e986b811fa758fa55badf9576bde9073ba9ae19768dcc9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033461, "uuid": "4d1e31d6-ad8a-40fc-b07e-5dc6dbe287b5", "comment": "Malware payload (Gafgyt)", "value": "3bc5a2d11de0438e693d30abdaf07aeb87830ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033461, "uuid": "4356c36f-e53e-431d-8972-ff9972aae099", "comment": "Malware payload (Gafgyt)", "value": "892714c90f505a18b33f5dcdae1884b744bb27e4c6b5058b67638bca434c928d56d01afedd70f21c261b1512a4566b53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033461, "uuid": "8e4aafd7-b1b6-42ea-a2b3-7bbf973d1a8f", "value": "T14D04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033461, "uuid": "5e966086-92aa-4e62-8117-c965c9d75aec", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w3UXS:7eJpJUVD1A8n0YNgEJi5aki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033461, "uuid": "0742df9a-a145-4103-9248-f040687666d8", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033461, "uuid": "ce178df3-d7c0-4c97-8509-c27010974055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033461, "uuid": "11db3bf1-28ec-422a-b48e-6f6b163bb250", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb417ee1-75b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782957170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957170, "uuid": "a32a399b-aa20-4609-829f-c6923e127009", "comment": "Malware payload", "value": "abad6c53cf28349353f381cea68dca1b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957170, "uuid": "c770952a-9895-4ee3-9afe-315a2333ea06", "comment": "Malware payload", "value": "6d08e6b1345dad62816b4612f92b0689eb937339ef04480ffe02bf58a28e8a70", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957170, "uuid": "8ce23c07-1780-4d80-8e2f-3ccf320b6fdc", "comment": "Malware payload", "value": "e830f446367f8a105e44626530eab77eceaa27f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957170, "uuid": "95aa5ee6-2a17-41be-aa7a-cb8a11dfd937", "comment": "Malware payload", "value": "ed9a34b0cf632fa675549e44f2669d210518b9f48c1bfb75451b929cbddbf8829108b93b5f18143ff3d47beabd4c69e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782957170, "uuid": "9d112e5e-e5c7-465d-b0b9-71305914d6b8", "value": "T1F3D097A3622302B060316858F0CFAA80B2081B3E8D80C62D7833743B3F46309F0E0B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782957170, "uuid": "6b02db71-b4d8-4811-ba1d-e3891122cb06", "value": "6:hTNxy9MLWi/LpQ87x0DGQAulNXYq4HvXDG+NjVsNXYrkJ:VNxy9M9X1QPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782957170, "uuid": "578901c3-3386-4aec-835b-f5ccfb06859e", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782957170, "uuid": "dc0c6407-cc64-4e93-91fc-a77d383e6d26", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782957170, "uuid": "123cec57-1f9c-4de2-9976-a67b25c30dec", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e459f4c1-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783015221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015221, "uuid": "4ccae963-c348-4806-9697-8fe4562dc031", "comment": "Malware payload (RemcosRAT)", "value": "64be9719cd0cf6fa1d33d27953aab23b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015221, "uuid": "e50e691e-1fa0-44eb-a58b-fdce10cb8e08", "comment": "Malware payload (RemcosRAT)", "value": "6eaa4e25359d0b61c37a9884fbdb8c53bf00e8e9a5478e325e63338d0d2ad51b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015221, "uuid": "17dc12d2-f3dc-4322-bdda-d154c36807cc", "comment": "Malware payload (RemcosRAT)", "value": "7fe5367b3573ae5f1b1f61d288777438a717c740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015221, "uuid": "9e9098f8-7a3f-4c6c-b974-b649fb61ce52", "comment": "Malware payload (RemcosRAT)", "value": "3bc9950b42cc2566baf136ded8099404d46cbafbafdadacb51c72919369fb98e68b2137f302bcf847de0c9987f485591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015221, "uuid": "2c3ba698-1a41-44d6-af12-64cd4b8ce806", "value": "T10955129823A8CB06E4774BF84A71C275AB746E8C7912D20A5EE57EEFBD7678414003D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015221, "uuid": "959e0cc4-91e1-4b0b-85e2-185971ebd8e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015221, "uuid": "06a0dab4-90a2-4634-8866-43d775ad6759", "value": "24576:Ua6UwIF9QJkXtGx5UDEGy1ddsOUpDy6HfW2AzP70arK3ZmW5gF3HAJ9LMGQGIT93:Ua69IHQJfX5GiddsOUpDy2fQP70+uiF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015221, "uuid": "f00ab76a-49b0-446f-87fe-a86c0bc423ad", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015221, "uuid": "fa4ccfe1-34dd-4d15-b22e-879a3a4da4e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015221, "uuid": "bcc67053-b269-460f-afcc-c7ba36ebf951", "value": "MT103 Payment in USD Transaction Swift.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfea3f97-7603-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782989417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989417, "uuid": "e9f84e9d-9022-44ad-a933-c63f3802bf45", "comment": "Malware payload (Mirai)", "value": "0fb1b8f2a269e792d10a42e4c72f38f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989417, "uuid": "caf9c6d6-2bd0-4703-b575-bf5ab38188ec", "comment": "Malware payload (Mirai)", "value": "6ef0d97c894769cc1c7e731d549a022a9b10e7ce381a5d95b807a379a7a7b2f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989417, "uuid": "da4bb90a-9e5c-40a8-aa91-80994aac50f6", "comment": "Malware payload (Mirai)", "value": "a1564bec646cd4ab898f78545bd20a7dbbdb47d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989417, "uuid": "cabc9732-e730-4102-bf94-c09c12d1c573", "comment": "Malware payload (Mirai)", "value": "8e4529fad358e55799a332134d37bfacd503f6d880088cb4c1565d6ad2abc3e5d450747cd4a7b2fac985b280075da1df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989417, "uuid": "24d4dbae-8ebe-45e6-806e-fc43f876f10d", "value": "T1E1B3F146D26641AFC42BC6784BCFD927637978D2A62C7BAB6705F9312C16E02163C7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989417, "uuid": "5c0a8cce-85b1-4c7f-b9c5-cfd5010a3a34", "value": "3072:Nov4QV8UO6mCvCL7Vg9Szlr6UIj9wBPHuI/CX:Nov3OUOpC6HVgOlwhWn/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989417, "uuid": "91286356-dab6-4da5-9a71-a22536122882", "value": 115529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989417, "uuid": "c2663a46-bd38-4746-b89a-809b5efcb3e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989417, "uuid": "535a288d-0abf-49ab-a156-95c2a8d7ad8f", "value": "6ef0d97c894769cc1c7e731d549a022a9b10e7ce381a5d95b807a379a7a7b2f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f9be32-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783033453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033453, "uuid": "4e1e8447-70bc-4ece-87d1-3b7fed40c94f", "comment": "Malware payload (Gafgyt)", "value": "3eb2dc993c71aa18458b8df06f0bdc69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033453, "uuid": "1ce5f2d7-0e58-481d-b09c-e4157cdd87bf", "comment": "Malware payload (Gafgyt)", "value": "715a4e536e913c7eee6f4bf1c072e564045d9880f3043e788c9a2c13dd28b957", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033453, "uuid": "8e85f8ea-2226-41c2-8680-a05d14ae5893", "comment": "Malware payload (Gafgyt)", "value": "f84daa11f0434369319b8d473c9806465d97f33a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033453, "uuid": "303e1c81-c4ff-4484-a0a2-cec04a1adbdf", "comment": "Malware payload (Gafgyt)", "value": "7f95945b9a093e67e5bb57c96d846efcd623ceead33b6108e064beb607f95f62f95c5e1909466428ffdca6076db45116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033453, "uuid": "6d81969b-3881-47f8-a9ca-e675d8e9b5d7", "value": "T1DAB3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033453, "uuid": "a4ad3edc-bea3-49bb-ac2d-c52f6adf134a", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzN8rSR:t3SrlGWnKTU83AQB5A5Liy36fBUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033453, "uuid": "fdbb128c-a9ca-49d5-9df5-da32046be2e4", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033453, "uuid": "6188ee3a-9964-4a1c-86db-9e829eb6dd2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033453, "uuid": "d6eaad31-12ac-43ba-b18c-a7a7548b8c24", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d13d9a-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783003544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003544, "uuid": "31f3ece1-1bc0-4cf5-b3c4-0ba97ff92513", "comment": "Malware payload (Formbook)", "value": "075eb78eeae6f23401e6f41a024dc50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003544, "uuid": "1f91f3f6-7afe-4fe6-a90f-cdc862731edd", "comment": "Malware payload (Formbook)", "value": "7212a9cb63a6703ad235ebb4db18d5c7eab2d5a3e13dfced075daf4c440f0900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003544, "uuid": "69c139ab-a3d3-4db5-b819-4ad8c9ed5edc", "comment": "Malware payload (Formbook)", "value": "6fe4d55cb024c87c9196d7f9f138cb5d61e2a8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003544, "uuid": "1f53cdd0-b80e-4ac0-a9f9-733b42c63eaf", "comment": "Malware payload (Formbook)", "value": "8b25cc64b6e0eafc5d123674f030da6a4cbd13f699e2717b92b70f8d76ef77b8faffb45c81c915740855d2b9ebda0cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003544, "uuid": "53ea1fbc-02ff-4bdc-b237-6a17043e7e85", "value": "T169351264236DD703D4B34BF409B1E63853B83E99A522D20B9ED57DDFB83A39066143A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003544, "uuid": "0fe4cc87-1e13-4a9e-aa02-d72325e44dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003544, "uuid": "1be47419-ece3-4e8b-9be2-72c68f708f56", "value": "24576:ua6UwLYBmZfik5agJer4/3Y3vatIkjQzLMg2K:ua69LYAd9BB/3hIyiMtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003544, "uuid": "a071d319-c044-41ab-8297-bf9f8cc7c00b", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003544, "uuid": "66130594-c4ad-44d8-bd4e-2a14cb3ff915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003544, "uuid": "832ac61c-16de-4725-a134-de3d1f897b29", "value": "PO_1400083954_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bcafed-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036671, "uuid": "0b392b21-eee7-4756-ba81-cfba4026864b", "comment": "Malware payload (Mirai)", "value": "14a49aec4d6b36545cd4652fb4a17908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036671, "uuid": "64a86a5f-2a2a-4381-bd2c-78204491816d", "comment": "Malware payload (Mirai)", "value": "723696487c125323ef50aebab1864d41de10bf0b94a34b9faa3cb6226d469b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036671, "uuid": "9db866c3-9332-4e88-8ff0-482801ccea94", "comment": "Malware payload (Mirai)", "value": "ac7eb04dfd1cd949e0145b70e6ca796b7ba62830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036671, "uuid": "560c00f6-6c72-4478-b05a-fa1127d5b270", "comment": "Malware payload (Mirai)", "value": "9bbd2bbcba0b03a75ddb7962276d06482969ab9cd7257bb8623f41424590d0d69a424eede362cc7947624ef2c71a7c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036671, "uuid": "bbcb51c7-bfc4-41c2-ad1c-25c4e9efd43f", "value": "T1B293F885BCC3452AC9D413BFB52E519E332173E5D2CE7212D8A30B653A8762B0E63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036671, "uuid": "573f30fc-0024-428e-a1b5-8eed43366149", "value": "1536:zlPOIwP1VibOMQ4Vi/ciz7Ou8Wu1bfPRPRY5VGv9s4PfP9af:wFGOELp1m4PfIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036671, "uuid": "384102e7-1f43-43d4-ae4d-870675297b17", "value": 95836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036671, "uuid": "cd8950ab-adb8-44d2-af48-3549130b1631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036671, "uuid": "9e5c1c20-5ef3-4b79-a7eb-7349259f1a09", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e996d51-765b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783026942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026942, "uuid": "4049c2ba-13ed-4e86-85a1-5c77c47c2258", "comment": "Malware payload", "value": "50d360fa0767101e1409cf6d6708ee40", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026942, "uuid": "44548672-28a0-4a70-aca5-6c429a8c3789", "comment": "Malware payload", "value": "72f18d019123393ae610dd73b25e5f30a4945430f6f835700d6bdee19f566a30", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026942, "uuid": "282a11e0-a379-493d-b775-310ef5aad77b", "comment": "Malware payload", "value": "af62ca2c7e32e16474acdd46c311dbdb69664eb3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026942, "uuid": "155d46d6-da7b-4ef4-bbc8-8e47b7b20aa3", "comment": "Malware payload", "value": "219ea39fe4283e208bbb6229ae6cab2f4c2a613eb9722b287b84cbe82a62f9119b775932c00c1c659c8dac7e2ea75d10", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026942, "uuid": "1758d15c-1489-4cd4-9558-475fde05edd8", "value": "T16AC70157FFC655BAFCF643360E3553692202AC358B67B28BA814327CA4B75D02E42DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026942, "uuid": "36dd06ef-0bf5-439c-b6aa-31d449a533e3", "value": "98304:1q6eL7ACQ9GPjpZyp5eWR/XmU+2bDiUOBCw:QLcCQ6pZyplXmebD+4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783026942, "uuid": "53145f88-262c-49b2-a53f-1d1abbca0a2c", "value": 56141487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783026942, "uuid": "be97566a-b75c-4526-bdd5-9c4667039aec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026942, "uuid": "5fde1eb5-1704-486a-aac7-f0d20058b661", "value": "output_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a071a459-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987189, "uuid": "5e2125d0-2502-448e-860f-e816b99e17ea", "comment": "Malware payload (Mirai)", "value": "9348d35b6c4bf4fd1a26599d4a52fac3", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987189, "uuid": "037f1346-62e7-4776-816c-4a397d4e517b", "comment": "Malware payload (Mirai)", "value": "73b54a103d305a7bf5f989bf1a26f711b8cd719c9e50944d5b543517c2c94c12", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987189, "uuid": "0b893bbd-d0de-4f04-a79c-a50dce67504a", "comment": "Malware payload (Mirai)", "value": "8f6f401fa81d7c5380147c6192886e1120ec5dd6", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987189, "uuid": "c1fa14fa-beae-4b21-8a80-ee68ed4f5d96", "comment": "Malware payload (Mirai)", "value": "8bdaf0079398f053c0a4e3cfec1170e4d4c82508f751a20dc8553ba6fc692ee024dc578242102bc41514b6bf4be1a3f1", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987189, "uuid": "a2dbc2e3-bdec-45c7-9951-e596661a5cfe", "value": "T17FF49E03AAD040BEC4D6C0744B8F9217E677F88962387B6F22D65F913E26F61675E780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987189, "uuid": "2155dd95-2638-4255-8717-b5e0e3d278e3", "value": "12288:MZffGOv0mbu895JKg1yCyqZscs1qFgNOSPv3x3+EKs2SauY8Rjd0as2apNkUaUHG:MZfOiu8FLPZgMSPv3x3+Hs8uvRjI3NJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987189, "uuid": "c5b50fc4-2487-44d0-bd69-83f9590d5446", "value": 739040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987189, "uuid": "8d1aece1-7583-4e8d-bcb2-4d6a8c9e6710", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987189, "uuid": "00b5958f-e2d8-4f08-8001-9bb92d60e2d5", "value": "73b54a103d305a7bf5f989bf1a26f711b8cd719c9e50944d5b543517c2c94c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef69bcd-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036552, "uuid": "8b12d2f2-15ca-478a-9d2b-f5a3e4013d95", "comment": "Malware payload (Mirai)", "value": "ba0ee7dd2b150692a679dc01745e6584", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036552, "uuid": "47e853e5-b610-4a80-9d17-272862e7a7c2", "comment": "Malware payload (Mirai)", "value": "75031c5077a2fac9ced0dec41e1b15f403684d40f8b67ead30ba92c898d70b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036552, "uuid": "c8076c3f-e387-45e7-b207-22bb176b00d7", "comment": "Malware payload (Mirai)", "value": "23f02743559cbb8101a99639c3433989dec97b1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036552, "uuid": "01130e9f-51e5-4c37-b1d2-c1f97af5993b", "comment": "Malware payload (Mirai)", "value": "b96461163aa62804797fc68e0d4a7264895d54dfcb5dc810fb89056b7525ed65b893fa0295e48654b357d2ae721153e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036552, "uuid": "b5aaff61-5b31-4a51-8489-978e3d3f8779", "value": "T1C2D33902F48DC0FCC486C1341B6FAA3AA935FDDE123CF2A767D0AB126D8BE61591D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036552, "uuid": "ec05234b-9ed4-4c8e-962c-051a87c4f47c", "value": "3072:WuFDnONmxGrw5oqs+/Yy4210G46nhpvIzxwprXcGzQH1XViDut9O:tONmxGrw5oqs+/z4210G46hpvAqjzAFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036552, "uuid": "643d68a7-d20e-463d-b8ed-b50dda79a4a4", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036552, "uuid": "68bb9222-bf76-4ed9-835b-e271d6c70fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036552, "uuid": "db99309a-a448-4322-9bd6-159fb3353ef0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df968d2e-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783003616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003616, "uuid": "d46e8b9a-aa60-4c9e-81de-ab4c668911be", "comment": "Malware payload", "value": "6f276ecb5418919ff523069163b83603", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003616, "uuid": "fd51dd4b-ec6d-4200-b3aa-c1b50178d17e", "comment": "Malware payload", "value": "7513010f48f8800448cf4ad7ba40a260b25c66d46de2037d0d3fab55e5339299", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003616, "uuid": "4c2a558c-bd7d-493d-9526-6043c6b0bc89", "comment": "Malware payload", "value": "03b28fdb268e974c62ba0515b6c418674b4fc7cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003616, "uuid": "bf0e92f6-77fc-46d9-9d3d-a2808c81dacd", "comment": "Malware payload", "value": "5b7fc2d24600180ac575af07f54092f7daf876e01abb8c76ed6f23b731d0e5e3792105ec9b817c099b5386ea69443895", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003616, "uuid": "01a9995e-5e2f-45f0-98ae-b610220fadac", "value": "T1B1959578B9D5151AB0F762099CF2F4C9F15F33C22739E9BB4096095F0A170891AE8B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003616, "uuid": "1eba1132-a7b2-41cf-852c-8f42a9e095ab", "value": "24576:/OwIz+ismRqsKbJu8SSMTzkHDZK3PQ+83:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003616, "uuid": "a65e09be-0864-4075-bd1b-f753e39168ad", "value": 1965036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003616, "uuid": "91b8d341-6f8a-4fcd-816a-97164bf5591a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003616, "uuid": "2ce4de4c-8fe0-45d1-aeb5-88652f55ba26", "value": "Doc_RFQ_Order_July_2026_397565847454674884574846547484554.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe5f9f9-7638-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783011965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011965, "uuid": "173989ff-2dba-4ca7-96dc-20f48a3868e9", "comment": "Malware payload (Gafgyt)", "value": "6c7b6e851e8f011d0d87acb643c475ac", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011965, "uuid": "9b9bd089-a98c-4ab5-8409-21ff26ac311b", "comment": "Malware payload (Gafgyt)", "value": "7553a402609f16a6e8c832ebe754697d724ea4f4fc8aded03b61760a825642ee", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011965, "uuid": "c3b06498-2e6c-47e7-9441-d9386e48653d", "comment": "Malware payload (Gafgyt)", "value": "fea8cb8609674cc41b4589a1a155d7d5e2093300", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011965, "uuid": "33b57b99-3213-42a1-b7bd-9130255c5b52", "comment": "Malware payload (Gafgyt)", "value": "352ef988da203de0c32e162d5e0ff5ec9fc90fc649d5f0dea71c3fd5c5053d00ad096752f9b93d19823095c816d20bc4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011965, "uuid": "92f6cd5d-1255-4f97-ac5f-15056dfc4aff", "value": "T13DE34A05EB408B53C0D21775BA9F43117323DB68E7EB73069928ABF43F8339A4E62516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011965, "uuid": "b3d7498f-fc60-4eb9-bcbd-779ef341b040", "value": "3072:DUiN/zjaG6O8CET8oA7690NGeIzo4L/KKmtH:oMbjaG6O87T8b62NGJz/L/KnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011965, "uuid": "a37d0cc5-72fa-498c-9cd0-75f8e42ecd1a", "value": 150367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011965, "uuid": "17c1ac82-9b76-4c32-8988-63725dce4ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011965, "uuid": "b6a97c6b-4ec7-4f2e-8077-db873101e826", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34980bbc-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006336, "uuid": "fabb1919-a278-402c-997f-32bfa9ae83d3", "comment": "Malware payload (Mirai)", "value": "4bcb5d27af8ae504de245020419c37a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006336, "uuid": "17795c79-d625-4264-8c7b-7a34c8479016", "comment": "Malware payload (Mirai)", "value": "757519ad212e596c221e1fdc9eb63ece437d388c1ffeb69050a4cec0ee04d06b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006336, "uuid": "8b378bb6-534f-4097-ab0d-aed2d1fb9970", "comment": "Malware payload (Mirai)", "value": "afe837f434db503558d60ab5f8a59a4508574443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006336, "uuid": "3e04ad8f-c4a8-4560-bf51-f2d24ba3dcf6", "comment": "Malware payload (Mirai)", "value": "36dc1635a49aabbc57d7fb5de2087049d42244eded58c4c009eb4380723d951affb8f88418414c728de264721500be1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006336, "uuid": "992cc301-bee5-4d7d-bba0-6707fb3ce801", "value": "T12904881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006336, "uuid": "66b3c189-2769-4e9d-996c-391bb2627eaf", "value": "3072:jg57RN7LHZwbq1YSBan1yvbysxr1uGSgI:jglRN7LHZ0Bqyy1BSgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006336, "uuid": "3a60436e-97c0-4bc8-90a1-d577f2cf0bc6", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006336, "uuid": "16cf3992-e359-479b-be0f-f11a466e08c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006336, "uuid": "91cb6d47-4789-4f50-99b4-b04bb9531258", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13211f48-7615-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782996831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996831, "uuid": "db33508e-c5f9-4247-bd1c-64dd8df3fdb7", "comment": "Malware payload (ValleyRAT)", "value": "3a7a359c92ebc3cb971f278c538b9ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996831, "uuid": "67e5796b-242c-4de1-ae73-493c174c7633", "comment": "Malware payload (ValleyRAT)", "value": "75ccc97b9fefe904ad711e32f29fd337d78b7560dfb96252e421a643a1796c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996831, "uuid": "6395dbda-7029-4c7b-bf5e-0ff632b5dd7e", "comment": "Malware payload (ValleyRAT)", "value": "401d2e17be9c43c3e63af409ee1e3758180b477c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996831, "uuid": "9d4ff80b-a0cf-486d-a536-2c4dbf424d41", "comment": "Malware payload (ValleyRAT)", "value": "e27b1802831aac04ab064ab385830c1cb92d674ec3879065183d5d56ab5b700092bf9e962eeed0819e552bca6f5cf200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996831, "uuid": "1a241fa5-1094-4329-a06c-30873a76d887", "value": "T18C163C0F6BE0A2E7E85E607D14F9326DEA5B0A411B1088D7DA871C7D853EBD7C9F005A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996831, "uuid": "e56765ad-9125-481a-8232-8622e892b9ea", "value": "84a8a560f0ec5a7656d1fb539f0a1936", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996831, "uuid": "d99b2386-dd03-48ad-aac4-5adac599d2ff", "value": "49152:4D+DxeE9hFl69CPEjNeihpIydefPu+gQrJo:4D+DxM95EwbPQrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996831, "uuid": "bc390f0d-bb37-4f6e-9655-eddb4066ade1", "value": 4126896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996831, "uuid": "d1e0ea06-4cce-42b0-9115-101db15293d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996831, "uuid": "bc6b742c-a584-4be7-8b7f-da766ffb75aa", "value": "\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aceb7d-760e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782994178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994178, "uuid": "6e172d66-3f4e-4f7c-9149-2d3346b0ec68", "comment": "Malware payload (RemcosRAT)", "value": "03aa29a77292f081ee247b798967687e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994178, "uuid": "6fc3c9b8-393a-4b7d-8e47-02302d849936", "comment": "Malware payload (RemcosRAT)", "value": "75f0a13b548a29be733e8e7dcff844d4b2fc151aa01418b1ab0ed968c17aa040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994178, "uuid": "48e3b5c1-860f-43ff-bdd8-fd5e696ff083", "comment": "Malware payload (RemcosRAT)", "value": "4dcfa720d50f0ca0b5ab3a79184181ebb4d466c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994178, "uuid": "70d4496b-a533-44ef-8d9e-70f72a7e1b05", "comment": "Malware payload (RemcosRAT)", "value": "9b6333f3e06fa617cc3a7f40d6837c8243a7467ccf3ff0698c12874d302a049215e8e8ad76ec4cddf9b511509b0ac515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994178, "uuid": "89f0c644-3978-42d1-8b2b-9ea2002e747a", "value": "T10442F4D8BA24168570FD9E0B158733DE37B0868301C794E3E39D4BBEAB1870625AF578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994178, "uuid": "4f73f948-4c92-45f8-99f1-1d34690c9cb0", "value": "384:Fb/w5aEhEDxO+gu+EJOnKkeNJ1xW0j03PUsPAqpTg+w:F5EaJmp0jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994178, "uuid": "06ffcf23-9e70-4332-94c3-c4ae822ed6a8", "value": 13028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994178, "uuid": "2252097c-2d60-4eba-a314-4977c8f6dd8c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994178, "uuid": "487e64c1-ac89-43fa-9659-7993f9b0c006", "value": "wegivemebestthingsbetterplaceforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d69a972-760a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782992338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992338, "uuid": "51017678-ec8d-4cca-8307-0de0a986d680", "comment": "Malware payload", "value": "e974347465a495e3589aa2e4b713181f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992338, "uuid": "47e8a32b-a9aa-42a0-8a24-b3a92f45ec55", "comment": "Malware payload", "value": "7616f0be60de42a513ed07309f668518f86fe95f144af3edd8a620f5bf0867e6", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992338, "uuid": "a2df756b-6bff-4ec4-85a5-c520b245f991", "comment": "Malware payload", "value": "8828e7082e2a50bb3843e8a1141551720fdcac6e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992338, "uuid": "e654bcdd-fedd-4091-a930-8de49e88645f", "comment": "Malware payload", "value": "b3ced04d9e965aa292455a8cd8ba121778839c906eb884e842d21e305115802032c2e4ba1478caa3527756b535c42cb7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992338, "uuid": "cb4f79b9-7c1f-416a-998f-4fa89f7e6f7e", "value": "T11751CAF3498F07A2AB9543D49C0CE7458C3EB6C73D81D4A64438BC4A90AA7B158E24D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992338, "uuid": "5adce812-5df5-4a1b-85ad-6ade72de9df7", "value": "48:/oCgYEKJmePCV1CCuBiLMvwK+w6GTuK8KiCi0jEPnx/WDrkzLvOkhBf8x+wAU:/HEcAsCuB+KucaAPkmkTEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782992338, "uuid": "8751ac89-1c8c-4070-bdad-0a02eac29d20", "value": 2846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782992338, "uuid": "39d4d94a-9f80-4e8e-b1ad-7e5490b90572", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992338, "uuid": "1d03ba0c-3e1c-4b7a-8569-e16546cfd175", "value": "AR10-10584065_2.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199ce722-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783004143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004143, "uuid": "614128fb-0054-4b67-9306-4161ef715085", "comment": "Malware payload (XWorm)", "value": "6a26cc31650fd8ca3d62532cd1106899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004143, "uuid": "fd3dfedc-e23b-4e40-926c-52ed84f9be41", "comment": "Malware payload (XWorm)", "value": "7776706d26fb2dfd7cb96910810bb4c3a02b343a228035a0ca4db3ccf8e4d26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004143, "uuid": "5e898c96-642a-4f81-a5bd-ad8f862e0755", "comment": "Malware payload (XWorm)", "value": "f04c0953e5169beb168fd9ebcba96ce5d2d38a92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004143, "uuid": "1b57a18f-586d-41f0-9e87-e744b03af205", "comment": "Malware payload (XWorm)", "value": "36458da7ebbeafe8e8b82eac8a7fec3b37c6fb74363147b7559baa83a1afd72ffcc87051e42f79cbea90016a81890a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004143, "uuid": "450395a4-f1b5-45aa-8328-11d488d097af", "value": "T13EF412656748CAA5C8FA47781972F27003B1BC5DAC16C22F4EE87CCBB422B815E647D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004143, "uuid": "02f7d4bd-cdf3-425a-9ce6-4a6ca9bab306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004143, "uuid": "709348e3-6d48-4ad6-9347-426b0d85fb19", "value": "12288:4XGLc4LNMs/iArYKidL6wvNEpEy8qNDBsOhSCvHFBjDv8jsQ8EO9KLMKq:4WQ4LNMtacpVkNDB3/FB38qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004143, "uuid": "c44b9e66-d88d-46ac-b33f-f6cdc6200ef1", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004143, "uuid": "23ee4a8c-9c6d-4f6e-ab5d-1dd01e1f2059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004143, "uuid": "4919c55f-7cc6-41fa-8c3c-7c046a4cc612", "value": "Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88beba95-762c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783006907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006907, "uuid": "7ff5137e-62b0-45d5-8fd0-deffc7c1ac3a", "comment": "Malware payload (SalatStealer)", "value": "1204670b07905cd586d001137e3c690f", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006907, "uuid": "aa851e66-3552-4ed6-8f9e-20b3d8ad2a9e", "comment": "Malware payload (SalatStealer)", "value": "78695b566b8aff8f42cccc5e264693a64582fb29d814650830a16a8a210e82ba", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006907, "uuid": "f40fd948-07b1-402f-88e2-4875e6eb39d7", "comment": "Malware payload (SalatStealer)", "value": "df112662c9613fc8a7459bc31708d9d96278d4dc", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006907, "uuid": "b9dde6f9-d390-4c8c-98a2-78d368707c88", "comment": "Malware payload (SalatStealer)", "value": "eb78d10621c2852bee4a662af42028f5b3cb5b823f2bee6117623b60cc92954107d6be3ca2a928820091cfbf691be9a1", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006907, "uuid": "de32005d-af72-4e34-b454-8c57b36eea22", "value": "T1E4F53375A6480A2FE4F2F2338060246CEA5ECD55B9FB536E31957309AE3C75E22F814D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006907, "uuid": "43cac1f2-7866-4a25-bced-e03a7d37a6c7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006907, "uuid": "d8c0ec57-644b-4f2d-908f-5f79281c0dca", "value": "98304:nltvfHIAgh5BXY726fqrblP1JYipAa6MeA:ltvP0oIca6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006907, "uuid": "575c6059-fe7c-4197-981b-cc594c5b9d0a", "value": 3591680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006907, "uuid": "934642d9-031d-44fa-bcf8-18464da58a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006907, "uuid": "a08a3435-faec-4d3d-94ef-98f326d1028b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c94e241-75de-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782973385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973385, "uuid": "da2a515f-e7f7-48cb-bca6-e3ac63a715cf", "comment": "Malware payload (Vidar)", "value": "2e42b3fcbf647905c34f0994dae9b828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973385, "uuid": "c323d557-6bf4-4772-8a61-471a7361a391", "comment": "Malware payload (Vidar)", "value": "78b57218b69f2fffc59f837302394ee4013c9e72d2ba0343fa5bd41b549fb723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973385, "uuid": "96c13776-7222-4640-af7b-83ec0df41f4f", "comment": "Malware payload (Vidar)", "value": "d441a8a169dc1ee88be6c666972fcb02d6f0e5ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973385, "uuid": "238eeb81-0ca8-4565-89c9-cffbdb7db3ea", "comment": "Malware payload (Vidar)", "value": "809600b2814f2850489ab294abff31818371b8aec77d13b9801d4dbc80b56402c4f73ae1fa87c3b5013bb16e1e2c88cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973385, "uuid": "d4800ddd-5cdb-45f3-aa80-4c1bc3c31bc8", "value": "T1FBF58C0BBD9108F6C09EE23588B7165A7B74BC490F3127D72E90B6782E767D06C79B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973385, "uuid": "923bdec0-3fb0-4089-ba3b-b67f593b53ec", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973385, "uuid": "90c4b81a-73bd-42cc-8447-a43c504e0c3a", "value": "24576:azEFZBN3i53S4MMTIou9eAqnBbpjyo3B5DiaWANpVAePP7ITJRLqbVaj4RCJM9+E:azy7NS5/MMUougA6bhXwaWAW7tyYQHOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782973385, "uuid": "e9121b16-6344-46aa-b0f0-0ab040292756", "value": 3473792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782973385, "uuid": "81f6aebb-d00f-4984-8b5c-c58ef0c05a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973385, "uuid": "251907ae-980a-4455-8e6f-2b3a3167e9c2", "value": "b6067ee0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ef337d-7611-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782995124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995124, "uuid": "efcd9119-c6df-4f2f-9d9c-cbc6a6081dce", "comment": "Malware payload", "value": "cfcaddac729f993163a7961baa5b4a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995124, "uuid": "d440a62f-e324-4bdf-94f2-c399fee78816", "comment": "Malware payload", "value": "79892f2107bd75857363fcc12373f7db961061cc89ef5fa0914d5603fa8219c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995124, "uuid": "57e7e053-ba83-47a0-8121-4247b2d63fe8", "comment": "Malware payload", "value": "cacfd15356d465f1d8048f26d4450100ba6b862a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782995124, "uuid": "2e62f8b7-dddb-4258-9bcb-2bb4fc4cf924", "comment": "Malware payload", "value": "53fd4e4e0711a0bea7ea2f620ddeceec01d13ac88a52a6fdc8d5e93f998011e4c08c6000ef2d523cb2092829d550ef78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995124, "uuid": "e79f5a0a-5e8a-408e-af9b-b4a59de5bee0", "value": "T1E8F1FEB11637C26035DB3227E64A1B09A67A510E2CCE851DF56EC3D4EB33A5A47DB4CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995124, "uuid": "7fdcd906-1c48-450f-b76d-b26394fb45d3", "value": "96:VTpAUGKzcCWWzkC6HfL4LFKzqCVOxQSZ61uo61z+WzkCzzoau8EW708JM+BfWj79:Fpn6TJRHzsQbEUJ5yM/7uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782995124, "uuid": "7dae7d35-bfc1-4ccf-8e5b-39c8247aba6f", "value": 7690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782995124, "uuid": "6cb8894b-2228-4f05-8bcc-6c2f73d2344e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782995124, "uuid": "3390ceec-17af-43ef-a3c2-b91133961554", "value": "greatthingsiamdoingforbetterforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ac0028-75dc-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972401, "uuid": "1c47ba71-38d0-49a6-8e1f-8e13fd231e3a", "comment": "Malware payload (Mirai)", "value": "0f25e553c8e0dffecd70870d042bc796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972401, "uuid": "5d921c57-3f8f-46fe-a07a-d25e63c2ed42", "comment": "Malware payload (Mirai)", "value": "7a79cda885e4b50fd3a95a94b2b376bd8e8120efa7952eb7156bd3e9a80e359c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972401, "uuid": "9d9fe01c-863e-4db8-8be7-35803f01e18f", "comment": "Malware payload (Mirai)", "value": "cf6fe474a6e4ede96927ec6ddc3f7abd0bd70864", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972401, "uuid": "f4b0ae62-5884-4c0f-8bae-de5cff39a866", "comment": "Malware payload (Mirai)", "value": "fe8c09b7db9c9350ede844836b944b0490e26e36c006288314f0e166a9cce179278917d93706fc88fb31d7e376bafdac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972401, "uuid": "733864f7-0413-4042-a5d2-85309d709960", "value": "T14D330A90080F715CF8A42177A00F27694BD206F53DED67CBE4338A36E9977299DABE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972401, "uuid": "f615593a-7695-4641-803e-d35b4a78ca06", "value": "768:vm3+hHi2go/5498BUTFvwLWIbVE9pk3T:vmsBgo/2eBaov6+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972401, "uuid": "6d70f06e-d70b-4a55-8086-59074c89cad9", "value": 50648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972401, "uuid": "3220e44a-3ae6-4676-bb54-06f8cd2bb989", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972401, "uuid": "852c07a7-d375-403b-b5c7-b97ebc539009", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878dad6c-7663-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783030527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030527, "uuid": "e87d30c5-b334-4c61-9c8b-ff2424b6574f", "comment": "Malware payload (WannaCry)", "value": "01498deabb5500164c89021f8ff6d330", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030527, "uuid": "12ec3326-0da8-4b11-b2ce-7aaea0345e25", "comment": "Malware payload (WannaCry)", "value": "7c4d1e3bff4c3d62adb8352b78e586b01eeba9e6d4b96715df89da84bae79c92", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030527, "uuid": "0311f616-253c-43aa-a282-1acb2365a889", "comment": "Malware payload (WannaCry)", "value": "ef763b740a730abd79ca5c97a69933bd887fc207", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030527, "uuid": "4d93e8a6-2704-4d48-853c-b1254bbaa97f", "comment": "Malware payload (WannaCry)", "value": "f79a03476c55c5eac962e612e18f3c842e52e7a80d5c131d22e7931ab50d57f13e6cdf657d00d7b15b9a3dc1e59243ff", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030527, "uuid": "47e12fbc-9049-493f-83d0-50e885b7a2cd", "value": "T17536E01A6F9F84A8C5C5DCBCD961CB75D0F76D882079822686F07DAFBE7A3C41D02192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030527, "uuid": "de1994f4-336a-491e-9c41-5b896034a35e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030527, "uuid": "0b85acc1-49d9-488a-a4a0-1bb0559b5865", "value": "98304:DMGPoBhz1aRxcSUGBBBBBBBBBBBBBBcBBBBBBBBBBBBBB:DMGPe1CxcIBBBBBBBBBBBBBBcBBBBBB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783030527, "uuid": "f748a09e-9bbf-4be6-9922-dc78fd7b4283", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783030527, "uuid": "ab45297f-ab06-46bd-9ef6-86ff6e698697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030527, "uuid": "9524b664-7ebf-4977-9482-558031c5a1a4", "value": "7c4d1e3bff4c3d62adb8352b78e586b01eeba9e6d4b96715df89da84bae79c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea55dfd-75e1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782974704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974704, "uuid": "142583b9-b3ec-4e7a-8f4c-760f70940511", "comment": "Malware payload (Mirai)", "value": "9aec46058130ceff8171d4c8ee4c664e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974704, "uuid": "4463ac83-f62a-4b69-9260-7fa2e187dfa7", "comment": "Malware payload (Mirai)", "value": "7d92769c58547632948174e1d5cbb799b2a042c77a533fc1ca0f15f2150763c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974704, "uuid": "6b7f7843-858c-47ef-a697-14e853bc8052", "comment": "Malware payload (Mirai)", "value": "e798f965b87ada0a877c0792ab0bb59772913f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974704, "uuid": "5016923a-488a-454c-967d-624e94eecbaa", "comment": "Malware payload (Mirai)", "value": "e27d7e15a46919eef576bf757b14ec1b36193474839077b24d0c8106d978472129c934d86829ce293176420b62b3523e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974704, "uuid": "54cdcb9a-6a42-4f25-8efd-935e68adaf27", "value": "T13FB33A6AB880AF06D5C6157AFE5E538933531BACE3DE3112F9105B2C37CA95F0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974704, "uuid": "61df7a31-2799-4c72-a843-749a8cbfe026", "value": "3072:SM26nOBE5xsGaP8g181CEnGOYuFBass7shfFlZz:P26nOBE5xraPP181CEnEuFBaK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782974704, "uuid": "2baa4cfe-c57e-4e30-8f10-a76c82f27b7e", "value": 112492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782974704, "uuid": "5aded559-d89b-461c-827f-119877d69f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974704, "uuid": "68dc38bb-225f-450d-a27a-cc27aeb708de", "value": "m6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d27ba6-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006340, "uuid": "b151164a-b488-4457-9f09-74d4eacbfd28", "comment": "Malware payload (Mirai)", "value": "0f8e2d4da0872dd081d6355ef2c43dd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006340, "uuid": "22cdf2b2-887a-4805-81f5-89329a2d231a", "comment": "Malware payload (Mirai)", "value": "7e413dc89f92f414387f1f1df5aca6a3e3d1499735ed0ff9667b0782467f07e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006340, "uuid": "ba618958-86a8-41d5-a70d-0d26889dfcc7", "comment": "Malware payload (Mirai)", "value": "2db57be23b2e7822f7bca74f4530a6206da2dcd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006340, "uuid": "99bbc52f-c5cc-47e1-9f14-6ac42c3d12b5", "comment": "Malware payload (Mirai)", "value": "024471a71ec589325ffdb19770733c4e08bdbf3603cba7f26ba1284e159c85fd7ac19885baca4e643c123611217f000c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006340, "uuid": "157f0577-031b-4d57-98b3-8f03b5ed235c", "value": "T15DD32A06730C0A47D1632EB03A3F67E197AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006340, "uuid": "de48909f-9eb4-4760-ba66-90cd27617048", "value": "1536:9roGHNTUZNRNIBUiCxfytutew0rFPaHwAo7lT0JvAhhnrZ+5BQfqYI07IJ:nmUUiCxltyiwR7lThgw0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006340, "uuid": "b947a2dc-ab9f-44ca-8817-cf9660b7b51e", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006340, "uuid": "4f913800-38d6-4bbd-b2b0-4bed89738b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006340, "uuid": "9e948065-dfd0-4ea9-ac54-dfe2963a17bf", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf82942-760d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782993624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993624, "uuid": "527314e8-27b2-413e-948b-98faf4465ac8", "comment": "Malware payload (SalatStealer)", "value": "4e9def021931e28ae897bcb608b537db", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993624, "uuid": "46440dfb-cb35-4f61-8e82-3fe2ad8fd95e", "comment": "Malware payload (SalatStealer)", "value": "7e7ef5b1cc82799cff8ac357bc6f7b3e5c1bfc4275b0c93da61db7e458d611e8", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993624, "uuid": "429fc765-858b-4942-a4ef-85a1fd1d9ecd", "comment": "Malware payload (SalatStealer)", "value": "ae588dce549e626c8e4f48a59a774d6340f6d9e0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993624, "uuid": "2497afa4-f624-48ce-9e4f-8a8321e17d7c", "comment": "Malware payload (SalatStealer)", "value": "6bbeb481299bc25dc14d0fe989876fe09b173344710c1294f83718bdc909aeee1f60068b9373ad09563c9486d99f6b41", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993624, "uuid": "56712a90-529b-4d91-a465-9947d96b7b39", "value": "T1C3F5339611B70779EA2052B07F86B6C9588B0E738593183097EFA7395E3ECD453AF708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993624, "uuid": "78fcd3c6-39d6-444f-90c1-a0da127bf7a9", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993624, "uuid": "4d9538b6-798f-467f-878b-b1d07170b000", "value": "98304:uWa3rTPf3V/GaurmP1jDvQ8FIrygnddybYX9p4:u3rTHQaqm9w+YDrta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782993624, "uuid": "2e8eac8b-7739-4854-af19-e948a989731d", "value": 3597824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782993624, "uuid": "98442e3b-a00a-4dc0-b285-d546f79f5dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993624, "uuid": "decfbc0a-4e64-4f06-9585-27ed475a4ef2", "value": "Patcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1a5005-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783004201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004201, "uuid": "93bf61bb-049e-48e5-8de6-b49dfee333f5", "comment": "Malware payload (RemcosRAT)", "value": "b7d79d99cc4c9e1ba512e5a24d3e9708", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004201, "uuid": "72e1a379-e1e3-4d56-943a-7e7d9d691bc9", "comment": "Malware payload (RemcosRAT)", "value": "7fa36027da764a24b5a5978390a536d3608ff7e5272b6c51bfb299b33c5ed094", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004201, "uuid": "930b95f3-e0d9-4c45-8e15-5bf2295c9d36", "comment": "Malware payload (RemcosRAT)", "value": "55fc85a65e2b1a668c4be048f1b18fa3996cdf73", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004201, "uuid": "c688c056-0182-46aa-a7bf-236df792e292", "comment": "Malware payload (RemcosRAT)", "value": "b64cf1bd519dc1141539e456c67d1dd48e992d9d1292e0d34f7c27260f0434f8f5ea43489daa0a511ea6ba48657818b5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004201, "uuid": "5864ef79-6c71-402f-9640-c7f206a9a1ba", "value": "T129A42349B0EECC2EC2679174CFC8C187924AFCB36F85D54BB240B34D883579A575E98A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004201, "uuid": "6f8e40d7-0ced-406f-b98c-72f0356302c8", "value": "12288:kAPXRC0Yr+79QG0Z3S6793jshEdeUgqG0tAKkvO:kA/El/P3g9EG0tAKkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004201, "uuid": "d1583b5c-63bc-4724-839e-f3f7ea94418e", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004201, "uuid": "06cbb41a-9840-40a2-97f7-ca5a29023f9d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004201, "uuid": "1d63e4da-f3e8-444b-adb0-791be42c6763", "value": "New Order PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a73598a-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987179, "uuid": "c1c13c5a-bbf9-4e8a-bda6-a2aa327b5481", "comment": "Malware payload", "value": "0cf7eb5647bd53fd79663f37d577483c", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987179, "uuid": "b47f1912-c209-43df-806a-ebbc6fb21b7d", "comment": "Malware payload", "value": "7fe589608ae5316326ce6d672b72265319c3e57024d7094d7bf81ab6cefeab0f", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987179, "uuid": "87ac89fa-5813-44e2-a343-d0f6756b4fe6", "comment": "Malware payload", "value": "1037c6f9bb4af5c6898e1f6a5d28be8305519e09", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987179, "uuid": "d35d6e22-a755-4475-b8ea-c978bc69b619", "comment": "Malware payload", "value": "a2ece0460eb8678282c45f94a9de9fe4c96a7dfd9985f9be821377cff0ca9d94bf055ebfcd01f8a7b17cb5b6c9bf3dcf", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987179, "uuid": "d658ec69-d5b0-43d1-872b-ee815b662cb4", "value": "T191D42360F358701CF6EDEBB1DAE9135B79326094A1E42B76D3D08B062E57FA07F51A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987179, "uuid": "93a84e1d-5951-43eb-a7d4-362e10714d74", "value": "12288:Q71ZqO0dbwUGOw7a0dy1L8z5tS4LsQYwLfvDSJTMlNOwYWd6Z0KliO:Q1ZBKw4Sz5hYwLf7AI3YLZiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987179, "uuid": "efcc5794-db4c-499b-97a0-f15aa0613fe4", "value": 646221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987179, "uuid": "2fd2a281-63af-4182-b4b5-62116eb38f56", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987179, "uuid": "62c31db2-e49e-4215-8584-15857e4642fd", "value": "7fe589608ae5316326ce6d672b72265319c3e57024d7094d7bf81ab6cefeab0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1a1994-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987857, "uuid": "c89d3673-a487-45c5-9205-74023628e381", "comment": "Malware payload (Mirai)", "value": "874376413753b6523ce253fb60b0137a", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987857, "uuid": "e12fb1db-ddce-4ba7-9e44-662bc4391bd5", "comment": "Malware payload (Mirai)", "value": "801981e684d9bc7776b73622f14a5870613a31e3e5f6a83a5493abfebdde4016", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987857, "uuid": "a7b33872-9889-4eeb-844b-3bd7f0caebe2", "comment": "Malware payload (Mirai)", "value": "a25d0a33aac398634e9dcaed8cc1c25cd51bb547", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987857, "uuid": "088a2853-16c2-48a3-b763-4fca75c87007", "comment": "Malware payload (Mirai)", "value": "d0a37869370eef5c9a5b6790f1afe3e33500550c7ede4eeeb9b77f31e7f6ee8ae4fe990caa3c1d430f90148c85e2e60b", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987857, "uuid": "e8945fa7-fad8-4228-95b3-60e6d5ea1870", "value": "T145358D5AF2F371BDC067C030839FCB626835F4B955222D7B25C4D6352E92EA01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987857, "uuid": "63a822a5-b7ff-47ae-a5c2-1f4f29585ba6", "value": "12288:aQ2H/UHZE5QeJGgoYU+OHYeUIzzEUqmfrmykghQ915kx3QVYg6wR:bEUHZE5QeJGg4++YeUIvPfVhwmAVYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987857, "uuid": "898b94a9-39fa-4db6-b885-c1b36ae83a68", "value": 1101008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987857, "uuid": "7a512554-b915-47eb-8c02-baa693a5c24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987857, "uuid": "735ebf41-a5b5-4936-b678-3166d7cab140", "value": "801981e684d9bc7776b73622f14a5870613a31e3e5f6a83a5493abfebdde4016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3d6b50-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033457, "uuid": "7018d4a7-2875-42b7-a838-14e39c177ef4", "comment": "Malware payload", "value": "fc0df51ad0b663ad98e2159e20834943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033457, "uuid": "612c4010-a1ab-4ec5-bc66-37f2b7a78276", "comment": "Malware payload", "value": "8168a485ec800b17645de89c8201a335287c9fd57e6af15600eb5bb4d16b895c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033457, "uuid": "46915b25-30b8-435d-a6dc-f68157952acc", "comment": "Malware payload", "value": "72dd48f868a2f6a877b277f6993bffa031352663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033457, "uuid": "d52c3a42-3e72-4dc2-a15d-463696837242", "comment": "Malware payload", "value": "a4050232e36851866f5e8932ea9106c81cc408b9b33b5d49469ffcf01e88d31a8921fae5da4ed81aed48290f6abf57b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033457, "uuid": "ca05ac73-dc60-46b7-86d0-0ecb734c2487", "value": "T1DE5302EBA0D4BDCCD19A4330050F0A0B3EC666B86099663B72C4F6A54AF2750DFD8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033457, "uuid": "5c04f2c3-59aa-412e-b0aa-a3ff7a1c0f8e", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASADQLkg4azHs:CM5az1Fy0oPgdZX6hTo8R4QLGazHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033457, "uuid": "13cbf0ec-c044-48a8-a03d-df2636db8200", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033457, "uuid": "47982e5c-8e50-4e32-beba-d2e5c0d5854d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033457, "uuid": "7bdc9ac9-dba2-46ae-823b-566cded963db", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd0136b-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783004234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004234, "uuid": "82369fcb-916e-45fc-bfe8-27d9ba10e682", "comment": "Malware payload (AgentTesla)", "value": "298d154922e8af51c4e06f2b7ecf4ee5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004234, "uuid": "a708f184-a6aa-4552-b0a6-b2e5cfec6248", "comment": "Malware payload (AgentTesla)", "value": "818e91c590bff9ef7a8388b1aaa15c1e2d306afdde1409ca78df7aae1aff7e4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004234, "uuid": "0d2649fb-0ac7-4fcf-9735-a1d756eae97f", "comment": "Malware payload (AgentTesla)", "value": "02d9d28ac6cf06652b575b83b3fc9357dd5bb501", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004234, "uuid": "45df37f6-b2db-4927-9147-a46917f88f32", "comment": "Malware payload (AgentTesla)", "value": "90bbd3ac2bc77253660e75f25de160a7aa0638c4b165b78c4ac9803c58ac47edfbd14bb44cb68fde3174917fac02bea1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004234, "uuid": "88f9f780-a70f-409e-b57e-41f2304ab227", "value": "T1BAF508015B68A1377228E3AC513BDF78944FA04369E9CF44306ED328791CD4B9799BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004234, "uuid": "d7d84181-3a11-4e91-bf7c-0bcec8a0ea87", "value": "98304:vsJUeKP9H5c3D87V8fin7EahH32avsZi3ahxYmcEqiNtXRkBAcSwn:0upeDoOy9hH32pZiahxYmctmhkB1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004234, "uuid": "9a9d6e74-9c42-4fb0-a0ec-274bc1499353", "value": 3344854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004234, "uuid": "d72c7d8f-9ace-4440-b319-9c4337c5444a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004234, "uuid": "bb193950-f2ef-44e2-af51-8816759e20ce", "value": "JUSTIFICANTE TRANSFERENCIA 01_07_2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e2c046-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033497, "uuid": "5e5df758-ea08-4d84-aece-eda882d03bcc", "comment": "Malware payload", "value": "d0656ffb0c6e265e722788faf4fc6934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033497, "uuid": "425350f8-297d-4cb7-8739-41bb82e67bf8", "comment": "Malware payload", "value": "83f2f05f1b8734caea6a85321e9dfbf29ba321078f75c288de7d19b369db0c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033497, "uuid": "fd5233e6-63f8-4bf6-8ad2-0183d5f410b7", "comment": "Malware payload", "value": "0062829f32d51787b97f9a95392cbadf20b501d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033497, "uuid": "588a6ca5-17c7-4f03-ba80-503a8d2aa552", "comment": "Malware payload", "value": "5d3464c3aea40534e4c499731686a22be331d6d9b7595fb4bb338ec483ed9c2421d488cead960adfccf80315a1393e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033497, "uuid": "9b309292-baaa-4997-9ce1-cea1e3d49bc9", "value": "T16D148D68FE4F78D2D2C7E37DAE4A0FA2312779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033497, "uuid": "9942dacd-5682-44b6-aef4-9ba50fe758cb", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxD:bOVfbEdxm4iubR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033497, "uuid": "30b392ad-ff35-4432-8570-39898076db93", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033497, "uuid": "3b77a863-5fc8-4f56-856e-c717c826bf07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033497, "uuid": "2363d300-eb70-4e26-96d7-f7a61521c671", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddd76ab-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033490, "uuid": "c8de405f-d1e0-4d96-91b2-e3da60f79150", "comment": "Malware payload", "value": "80734682211af4a5502b81b1d2b02389", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033490, "uuid": "c2fb302a-2086-447d-83ef-4fb3d3a14f57", "comment": "Malware payload", "value": "84006c5bdfeeefd4e541150c016fca2235e94686091383e4b0f92d6a2c569ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033490, "uuid": "b53108e3-2d91-46a0-bd0b-7a2d78447977", "comment": "Malware payload", "value": "26c35de87871ab69d536674bcdfc2cec17a3c919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033490, "uuid": "df4a3166-ed72-4a69-be28-bfba10aa9490", "comment": "Malware payload", "value": "84b9adf112fb8b984cee8032944a9df6e0d2565717002c148c9491e2fb0fcd1bafc5338fb11f2bac8703b5d28ebbf45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033490, "uuid": "a7ffa397-acfc-4622-8933-bce84bedc381", "value": "T103145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033490, "uuid": "4bd43a34-4503-4f5c-8a54-fce0affb852d", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NX6UaN:HZ15BTYCrYq1QDY634", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033490, "uuid": "81798baf-1a79-42e3-8812-80cf182d098d", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033490, "uuid": "5de0afb1-ad7a-4757-82bc-a3593b930b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033490, "uuid": "b8e4d8ca-637b-45bb-bc8d-70e07597327a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a08e254-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988467, "uuid": "16303f0d-17bc-4791-9e71-6a96346ca645", "comment": "Malware payload", "value": "c38fd4273d4fc47f19c152b77d0c8ee0", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988467, "uuid": "bf9e58f6-c749-4728-a69e-e4556ac73bf5", "comment": "Malware payload", "value": "8497eb6e3df9620d23cfc772d9b891fd82f0c2dc191e49fd416b256e57ce0f6e", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988467, "uuid": "7a49c501-b553-43a3-bc83-89ac1ace97f0", "comment": "Malware payload", "value": "da1751b467b0f3c932ee8f2791bec20e83a36863", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988467, "uuid": "b2251eb0-3525-4fd6-90e2-24468119da60", "comment": "Malware payload", "value": "384e653798489b37639402827fc869afd918ade232d77d0b8a16c2d115be306b4b09cff769c8dc92368f85d0c97cc9d9", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988467, "uuid": "d4668b0c-97da-463b-bf77-8d5d5829ad83", "value": "T198156B06EA016579D47271B1524FE336C8686B358527488BFF5E2D6CEA3A2D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988467, "uuid": "da3ecdc7-46a4-4100-8355-c60880e4b0fe", "value": "24576:pePXBsUAJbR0RZDIHCVJFY21VpGw6SmPWooZQ17:pePXgJ1kKuFYCTG/PWooe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988467, "uuid": "1615df7f-62d4-4c29-a57a-94b7cb0afb01", "value": 883248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988467, "uuid": "58a3bba8-fa95-4dc0-864e-be54475c06ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988467, "uuid": "713a4794-2fb0-4a81-a181-dc871c9774ae", "value": "8497eb6e3df9620d23cfc772d9b891fd82f0c2dc191e49fd416b256e57ce0f6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebbcf90-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783004286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004286, "uuid": "955dfa9d-d77d-4597-9507-3111fd04f2ea", "comment": "Malware payload (RemcosRAT)", "value": "0c871f4eee5af94f3cba5fde93f23149", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004286, "uuid": "16347b63-9d90-4e55-bd31-b9a501c5d317", "comment": "Malware payload (RemcosRAT)", "value": "85564a1a23b7e97d0cc205cca6783aa5e67a8c22b63f360b069ea8ed5462ac1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004286, "uuid": "3983ed87-36ba-4c9b-8ae6-519857ff0bc9", "comment": "Malware payload (RemcosRAT)", "value": "e143c951f0394fa0bca5aec720fd3cefd603540d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004286, "uuid": "ca02bf84-3beb-4d4f-b1e0-63b4a03575ca", "comment": "Malware payload (RemcosRAT)", "value": "e0f3d44c42f6155a34e78f77958ce6ca43a01f2f37dc87bac52804304d13b64a5b0cd84ee24d952ab6028d2211183729", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004286, "uuid": "a6bbda01-6981-412b-9960-102059d65808", "value": "T11EE5F2114EC42FB8CBAC5A1D50BE151EE3F18E8A5019B98AFB33BD46EFE7604510B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004286, "uuid": "a09630df-face-4aee-b85d-f753daadd7f4", "value": "24576:c5GGA+Renb3vwWk8qGj9vpY+BWVLywoOqviTacFlZ8zWqqMabg16KNl9wgqT4yJB:CRenlxpVLiGolZ8Kq0go89W/kv5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004286, "uuid": "3c675dda-d81d-4b7a-8c8e-1d0eb310498d", "value": 3266947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004286, "uuid": "b05982ff-bddb-4e3d-9eb2-d46aa93df084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004286, "uuid": "5743372f-c88c-40f5-a963-673192b3d718", "value": "Annexure - Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244ad32f-7615-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782996860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996860, "uuid": "05db0f22-ed87-458e-a952-871b377f85d2", "comment": "Malware payload", "value": "8c06edbca2b6ad3ba1ace2670cf5455a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996860, "uuid": "9740dd95-d523-4305-afba-3aba6d2e8462", "comment": "Malware payload", "value": "85a44fd5134cf1d317a7637f1fb47dcf570a93e925c365b2e8f103a0fa459290", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996860, "uuid": "dfcfcb00-570e-49b5-9448-2112f23d5b45", "comment": "Malware payload", "value": "f5ebd6276bcec5c37e41cb9adb624677ddbde5d4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996860, "uuid": "0c82b0d6-d65a-4ae3-904e-ec92fceb6847", "comment": "Malware payload", "value": "036dd942bc66ccbe6f00ad104826ddf2f66b44725db8b78e6306c1239130f13550817e7e3f611859b3f615f92fe0fdf6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996860, "uuid": "02ea3fc1-d8f2-4b8d-b3eb-17225ba8b4f2", "value": "T17D562381EF06D81FD0BB803B5A6607322255DD1ECA83A34795EC76286D3BAD44FD9EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996860, "uuid": "ebc5d318-493a-4b81-8e67-a4f9195d12c8", "value": "98304:7m0REBqfQ1fOyhRbxeW3dKzUd/w5j3H/Bc9iIK5exlV:i0+BqIl9veWk15bf+HdlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996860, "uuid": "82e10df5-a6ca-4978-bace-1509f2c55f07", "value": 6126576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996860, "uuid": "da25b496-ca63-4fbc-9649-ecac523ad7bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996860, "uuid": "22053826-e177-41c4-9b7f-8e8a2e9ce3e9", "value": "Ti\u041at0K2O+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8558add9-761f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1783001317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001317, "uuid": "5939422e-9e5f-47b5-8b37-e4112196ae62", "comment": "Malware payload (MaskGramStealer)", "value": "2c9cbf61771160a3644e4a4fcbe98dd7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001317, "uuid": "18f70790-1f81-4649-bb78-6860231cbb4b", "comment": "Malware payload (MaskGramStealer)", "value": "85e1086d548cfd37e2550a0e74e6540394c555612a79f6afad183a8d7bf3eff4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001317, "uuid": "8d7fbf43-8848-4e13-8367-1aa94a957f36", "comment": "Malware payload (MaskGramStealer)", "value": "eb54c551fb56feff3054a01af9877eb16f6ac09b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001317, "uuid": "ffed05eb-5127-4060-85c0-56aa02b9514e", "comment": "Malware payload (MaskGramStealer)", "value": "89ff78e53da2778a09383c31be7850963e60a944000e74332d14cbec81c66d9fb556e5f6451bafcd7f4ca4f7d475100f", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001317, "uuid": "741222e7-2d64-4b27-bd98-92e50a68cbf7", "value": "T19C044A5BD8D540E9EC1AC6348999E237E4B3F8561936BA4F6BA0DF051F90B30B71AF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001317, "uuid": "56e8406b-59d5-499d-abbc-09043e787794", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001317, "uuid": "dc8fe54c-0e6c-4825-8c22-73ef7514bdfb", "value": "3072:4YVIoPwWJnxZAzJn4ldBxEWh1ZoPBmG0QllO7ek0ght:dbzQzV4ldBxEW/MBCQllKeght", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783001317, "uuid": "fceaeac5-509f-4310-ba3f-c8190fbd735f", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783001317, "uuid": "3949a20e-2f6d-44b2-a8ed-88d1f711f733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001317, "uuid": "8e90fee5-1047-49bb-9559-c4519445b9b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f34a85d-760a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782992288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992288, "uuid": "11ac0f71-6ac4-42de-aeaf-5fac358f929f", "comment": "Malware payload", "value": "7fc961220e1c271c75e9b1f13598f28a", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992288, "uuid": "8947b3fd-f998-4fc1-a69d-90c723117cb5", "comment": "Malware payload", "value": "85e2f32e4c27897e91f832825060f6dc236cf38af8e7a6bfbfc3f93606da79c3", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992288, "uuid": "03070456-bc47-4f7c-a21a-489ca27b5e20", "comment": "Malware payload", "value": "1f850a7057cd6cea284b9e782e04fa2a5022d715", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992288, "uuid": "3092d162-05e3-4008-9968-3a3cd974ca43", "comment": "Malware payload", "value": "20516799c0b6fea5b7a36e7c4f26a75413e8d21b926f11a4a0d9521a890c8b3d1a0e22ac32e591ce33f04b873ee0ac67", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992288, "uuid": "a9369ab8-93ef-48a0-a24a-fe565b40c9cb", "value": "T19212B588DD130CAE171072F162CC69C904FDF3CEEC8E88F099B6EE4A59BC04497D9A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992288, "uuid": "e8820b69-52ac-4581-8d6c-4868b7b3a846", "value": "192:/E8/wPfnxCt9GRhrBouvlh7RLKzexw1xGGS5iZiiiiT8Z4uiii4ZiifiiiAfiiio:N08crPlh74SvhiZiiiiw1iii4Ziifii5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782992288, "uuid": "723e2b5b-435e-4294-99e3-fb9a33f2a065", "value": 9488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782992288, "uuid": "988dd155-ebce-4765-86bd-93afbbffc23a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992288, "uuid": "8534828a-b627-4b3a-9142-38d111337b06", "value": "AR1-1815574.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63da237-7663-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783030659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030659, "uuid": "6ae8f2f8-d9ba-4c7f-85d7-7f57c13f533a", "comment": "Malware payload (AsyncRAT)", "value": "659981348eab7fcf5fc2f0ead01628bd", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030659, "uuid": "fca8a0fb-027f-4715-bd88-8f856f15ba19", "comment": "Malware payload (AsyncRAT)", "value": "85ec743443fe4830daddd95a454fc05b6434adf486a6889134b5d50c29570c9d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030659, "uuid": "1f05e045-33ef-4b91-a851-3187b2eb2f0e", "comment": "Malware payload (AsyncRAT)", "value": "f57b0b8dbde00c34f3b89fcebb10a3631caa2a5a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030659, "uuid": "30d39814-0933-4163-bf5a-e05eee86a04f", "comment": "Malware payload (AsyncRAT)", "value": "2bbcd4153c3854231b73c12f69794f2de9364e79092dbb8c7f3c4c4349363c84a6807e125a0b0578d83e485cde1ab46c", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030659, "uuid": "c1a466da-e2e9-41da-8c61-2431472f6238", "value": "T133536C013798C965E2AE46B4BCF2550106B5C2772112DB1E7CC850DBAB9FFC60A527FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030659, "uuid": "dfaeadee-bf9b-4152-af1a-13af58936b9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030659, "uuid": "5854a0fd-cf7d-4dbe-bf55-2a4f0006db95", "value": "768:wcUiy5HN578DsC8A+XQPeWqfmqIKE5PpF1+T45SBGHmDbDPph0oXspEpNJSucdph:KpN/RmH9xFWYUbth9NpNgucdpqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783030659, "uuid": "825ba54e-f85e-4491-a1d5-e8d1ed1a0289", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783030659, "uuid": "64fb98bb-fda7-4e42-86eb-708d682af33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030659, "uuid": "b2420cc2-39d2-473c-aae4-47e78241d861", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc95398-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783033460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033460, "uuid": "68711ec4-ffc1-454e-97aa-791b6cc3fa74", "comment": "Malware payload (Gafgyt)", "value": "4912b63d5c3f88f5530bc8405bd0f523", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033460, "uuid": "c0967547-c1b6-49e4-941a-8435ef917055", "comment": "Malware payload (Gafgyt)", "value": "861782bd78b9ff5dedc79d8c6c6f03f8abb1fc9a8b81e0291073637cface272b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033460, "uuid": "0b64089d-2fbd-4174-ad4b-dbcdcb7715f1", "comment": "Malware payload (Gafgyt)", "value": "b570ed873eccc0decec870511a239b3648331e4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033460, "uuid": "45f92e53-445e-4f60-9466-9bc99de8c1ec", "comment": "Malware payload (Gafgyt)", "value": "544b52e2fcc31c4bd2189786c88e8f852922aeb75bbce658f119abf56a91cd34994249a70af0ef6c2cbee29933097262", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033460, "uuid": "b3419094-d0ee-49c1-a961-45527b9c6684", "value": "T109D3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033460, "uuid": "a718ed00-144d-40a1-9173-9b34e69d15cc", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0Z26:xOFgpOEoVv3MXL5NhGO26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033460, "uuid": "ddfb201c-b951-497f-bb41-55ec0629d868", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033460, "uuid": "ba6ecd17-8ba1-4945-ad14-efc39aa3c4bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033460, "uuid": "a1dc232f-fb8f-406f-8215-d090751c9f99", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87374012-7609-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782991872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991872, "uuid": "65a17158-bc42-4157-a200-491b195f8612", "comment": "Malware payload", "value": "ceaad55006ddb0f8d8b3d829f8a2a410", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991872, "uuid": "6d0507a3-b859-4e60-8394-7bb3601a67b9", "comment": "Malware payload", "value": "86d9c83dc03e55d1c15f2d393bf6d4e55b47ad018a2c45202721a86a472ee978", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991872, "uuid": "4f065197-b6c3-4d2c-90dd-8e6842eee0d3", "comment": "Malware payload", "value": "1cbed24605da895ffad4f135e86791599763a5e2", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991872, "uuid": "6554c5c7-7e27-4618-b606-8cf562e2d196", "comment": "Malware payload", "value": "a06e61685fc791e657ecf7d9d1d17ea58388f00a1df0c233f9d8aefbf0936fefeaae6816f4e1d99403e9423470a3eb4c", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991872, "uuid": "d6339176-cf0b-4ed6-8939-f4b0a01aaae7", "value": "T1F3B1E8C6808411F29BE27E597D0F331A055C77CF11A81537CA725F4EA134F7A26D1AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991872, "uuid": "f05cfc16-088c-4e55-9763-0f5990a426e1", "value": "96:/zxNInKZfRaenv9TbldlHvrXVH/admajXryqMHLrUGHb:/zxGnofRaeV5p/admaj2/LrUGHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782991872, "uuid": "27694da7-e045-46b3-bef2-dc23b6e48d7d", "value": 5155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782991872, "uuid": "dd79048c-1ef1-4f30-a138-f0ad48b8d4d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991872, "uuid": "39d491e2-9a14-46f9-a3cc-4c2654db9c51", "value": "404-2252493_Servicerechnung.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94054239-75ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782951950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951950, "uuid": "fac8a3cf-9d67-4aa6-a140-24a07c754624", "comment": "Malware payload", "value": "862a7b8d1c157196f69bb509e08cc890", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951950, "uuid": "98bc0722-a328-4384-a2fd-6642f6623f11", "comment": "Malware payload", "value": "871e5390aa140633638e9a377ed9c3bb38adbe51152bd363d809716aa581cd47", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951950, "uuid": "5800d69f-34aa-40e3-99ab-a0fc66b6e354", "comment": "Malware payload", "value": "24c4ca7105ec28e0112807c72e3a79f295021e08", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951950, "uuid": "0482786b-3a51-4ef2-b940-d43ecc8651e0", "comment": "Malware payload", "value": "c63ba1c00a914128ca042223cea6a6222a1605f1910603facb15c0cea40e4aec4548d1c8ab8bf84e5d17477d93cf7031", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782951950, "uuid": "64f2be9d-f821-4ca7-976d-0fed59e758a6", "value": "T18CD097B391B302B01821C814FACBB400BBA4AF7E8C92C91DFA0310B61E1B30BF4C12D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782951950, "uuid": "a61e4601-4617-49b8-889f-175e53856012", "value": "6:hTamI2Z4XpcK2ZTWwF190ZpAulNXYq9DG+NjVsNXYrkJ:VahN5IZTWw1ePiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782951950, "uuid": "984e03a0-d217-4c9c-8be6-edd9bd48bc92", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782951950, "uuid": "7575d3df-a061-4f85-8f04-8e79f5e3f637", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782951950, "uuid": "ebdc1b18-ddc3-43d5-bb6f-84b71a8581f6", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0f04f3-7637-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783011610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011610, "uuid": "10d5b74a-0e3b-4d1c-872b-34facef02eb3", "comment": "Malware payload", "value": "5c5761a28ff4a9c7943872ace2bb4da6", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011610, "uuid": "4a6265aa-58d9-4eed-b0a8-ebfd49238e8b", "comment": "Malware payload", "value": "8a515a3baf6b12e0d7e99fc037583fe4a2b8a3926dd1dc2effa59e5faf0fb121", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011610, "uuid": "a449e0d6-a811-4701-a186-1950253e7e8a", "comment": "Malware payload", "value": "af760ffa146ebceeb7d2cc50782bf3d236caecc5", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011610, "uuid": "ba3a0811-5120-4551-a0d9-6d9a4f61a3d2", "comment": "Malware payload", "value": "5a2f1c5c2df815aa7f02788f1da3c956f0d03ea842e1698c926b17dfb5e9565029f04b11da4fbc0614ab88432d4f602c", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011610, "uuid": "7dc8a3b6-8c5b-4569-9d3b-091bbc00123a", "value": "T107C47B46B7E007F6C8EBC2708E4B9723FAB2B9452524AB1717A0D9661F23B315B3D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011610, "uuid": "d9ad2237-f479-4e3c-8bc3-fe4d0af3108f", "value": "6f1cb7c2f5223366d046d9d5b75129b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011610, "uuid": "c3a50fe4-a181-4a26-9cd5-5b964cbda99b", "value": "12288:5UGjTuw6Ru/MP4fuuFOfH1JernMJQbw7g95JcuYzM/kta9TjJM21k:6Wuw6Ru/MP4fuuFOfH3inMJQbw7IcuYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011610, "uuid": "d0d254f1-1caa-4c7a-af45-424d7468bd67", "value": 588072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011610, "uuid": "e6653ca6-6cf0-4658-9a84-7fbd46c4ee45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011610, "uuid": "309dbdae-d8e0-40b3-97c4-6e4b1af3e775", "value": "SCNPST32.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7602476-7644-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783017400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783017400, "uuid": "b2d73a2a-c42a-4399-8865-2c7329956ac6", "comment": "Malware payload", "value": "58baae9122e1c82906840954a573f1c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783017400, "uuid": "f69df866-900f-438a-bfc1-6d705e79bb2d", "comment": "Malware payload", "value": "8a9d9d3e4fd81614dd7895f09072520e7600b38c738293ce45321fec0fc43dc4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783017400, "uuid": "04f084a3-d6c4-4550-a329-acbf894d10db", "comment": "Malware payload", "value": "1e1eac7d3964c63566829bec6e6b9c5e37857b72", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783017400, "uuid": "37f288db-fd3c-4c16-98ea-bd9220dd1f17", "comment": "Malware payload", "value": "a8e1264ef59d678334a034ed4c460af41d051c26bab343f00362afadb76847457309be842fb9c278a17b57c00ce4747a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783017400, "uuid": "0f387c72-7aa3-4097-81e3-d28f339f92d8", "value": "T1E70163CAC5005E1041ADDA5D26975568F861C3CF165B4FA8FF9C6D39EB58C04B066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783017400, "uuid": "0de68309-a2d6-4e63-a281-37f6b6364c13", "value": "24:kXCKysE2hi0ziQvZoha3u1AOfj36erRqj2+X:e9Qp+Mse1Tfj39dqj2+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783017400, "uuid": "6666e586-b04f-4b51-9399-f0046483d17d", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783017400, "uuid": "ab3788ca-6395-4c04-9317-afd891a8e97b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783017400, "uuid": "fc172204-e4a8-4fe7-90e0-5f5612e24178", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e72d1b0-75be-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782959457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782959457, "uuid": "411b1d8b-ad5b-4eb4-9ade-fe11daa86619", "comment": "Malware payload", "value": "fdf49c199d004f0df236984852106d71", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782959457, "uuid": "b1a891db-eb47-47f7-a6b7-6da50c4dfeb2", "comment": "Malware payload", "value": "8c51a2cf33720cd5afa5739816bd52b0dd2ce2a2f27601ea6b3672da0de5c98d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782959457, "uuid": "e7d8976f-1a59-407d-b7df-ab9112c4181f", "comment": "Malware payload", "value": "0cf4ffbee4914729c9d585af95afb32854a9fd89", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782959457, "uuid": "d5742c04-8bf1-42cd-a39c-9a59aaf6504a", "comment": "Malware payload", "value": "995b0e7ab5e3a07099df4147c6e5dc83b14852866af9977530a57db27d79144266275004c1405a5690051cc959a22d35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782959457, "uuid": "a0da8deb-b27d-4846-a037-be818e56bf72", "value": "T1D9C08CAB04A820048281EC927863423F329FDBC01024270CD2C83523CC84000F820EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782959457, "uuid": "0812fb7e-96e4-4d53-867b-314d6d4aab96", "value": "3:LrJZARFpnhFVTyGBzSEyLTUWnD9nhFVT8TBzSE8eUwn:LrJ+jphvxI/D9hvcZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782959457, "uuid": "bfdb33ff-685a-456a-b214-3d41e130fd84", "value": 136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782959457, "uuid": "af7312a0-138e-4816-bc03-e547d30d20a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782959457, "uuid": "9cb62df1-41a9-4b22-b406-095fea1adb66", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d8f980-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033319, "uuid": "d8deae74-1634-448e-af58-50fd2159b165", "comment": "Malware payload (Mirai)", "value": "1493a70f8de056117a008662bb850db3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033319, "uuid": "263b3d75-fd6b-48f6-a726-ebb564d55b96", "comment": "Malware payload (Mirai)", "value": "8ddea0d6c3b4a5560b9cf33e7f2d0c9a76a0ea0291199730489345dbae93da2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033319, "uuid": "c55fe67f-7059-427f-8701-8dfc89479dbc", "comment": "Malware payload (Mirai)", "value": "2ea832d9de0ab0f848433b5c632abed0eb9216d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033319, "uuid": "830d2af4-52b7-4c3f-817d-a9ba3c00f870", "comment": "Malware payload (Mirai)", "value": "b72f52f4d16a5f9376fffd6a7cea6c720fe6cfb957d5a464c268433eef010e820d9c8ddf354ba1007cfae4cb3db20555", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033319, "uuid": "83ab51bd-f748-468a-89aa-ba61c7cf498e", "value": "T109055B54AD5EF803D1D7FB78EF89A3E1931FF192C74382137881124D89E5EA8D9A7884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033319, "uuid": "d94edbdc-da0c-444c-b8c9-b1d3336ce4e8", "value": "12288:pcPTrCitMzme2VB47tTZ8RjMYc4oDl0PVs5stx3n:CPTumpMTZ8Rw6oD+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033319, "uuid": "7ae79c34-3c8b-4637-983e-47de7b94e283", "value": 821944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033319, "uuid": "db7255ac-51d3-4b15-b669-40006df2a009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033319, "uuid": "67dcb012-3e27-4b32-82c5-96a77b3dae81", "value": "fuck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb20a8ba-75d3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782968766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968766, "uuid": "88e73d38-ef68-4e8f-82e7-df35d4b7fcee", "comment": "Malware payload (Mirai)", "value": "1f4c6acf3b50aead80b0e96bef9176e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968766, "uuid": "99318468-7e62-49cf-9920-458b792790af", "comment": "Malware payload (Mirai)", "value": "8dfbff3c975b5479bcf3136f65a69c1841b6c581c07959c02d9896ea6eecff1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968766, "uuid": "c3000b3e-8e38-44eb-865e-10092bf14328", "comment": "Malware payload (Mirai)", "value": "23ab7e5aec46309378565818e7af3760f7600391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782968766, "uuid": "d65a1f9e-f8b8-43e3-be66-8c60d727e4d3", "comment": "Malware payload (Mirai)", "value": "dc3c3ef719d078daa98c6fa32793379dacb712a8a6efcf0696f3057f7018672369621ca7f81c4421fc8bec8121eac790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782968766, "uuid": "1055b4ec-a699-42c1-8a07-5f14739f096b", "value": "T1AD937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72EC91551EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782968766, "uuid": "a912ae2d-26ff-46b6-a808-4b9f95e1002b", "value": "1536:W/QCZaxGdvts3i5JPhobAxPu++AjloUIKqI4FrS4LSD:WYCZa8dvm3oJPhOAxP5JlKKfUmDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782968766, "uuid": "a78d7cd3-6eac-48f4-8b0b-6f9cdbe7db49", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782968766, "uuid": "edb8cddf-5ba3-424b-b73e-69bee0349f4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782968766, "uuid": "7142b499-276e-42bd-87b9-1ea2151e3db0", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93070585-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988455, "uuid": "a2483519-75eb-4082-807f-829e06747dbd", "comment": "Malware payload", "value": "668d6ecdf075cd55ccf3fdafdd7af4b7", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988455, "uuid": "abb9f9f5-f029-4fa8-a290-38688d38d37d", "comment": "Malware payload", "value": "8e7f324f64b01a24bf0fd8fbccd78b489f5b6b17faa0513ae648b05733b9db7c", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988455, "uuid": "2f180838-c868-4468-bf21-8d3226b54e2b", "comment": "Malware payload", "value": "e4a0e816ad51161ae4c9501e715a9892f5e94a25", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988455, "uuid": "84ceb544-94c8-4a75-b3cf-edf105c18538", "comment": "Malware payload", "value": "c743e1b6bc4e7cfcb2c7ce88462190c80c7cb36a7cd6bbdaa29606b9ebbe4810246c9cc74fc58cd7aea6d220efc5f5dd", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988455, "uuid": "0e38ca30-db38-4a91-8ded-6e3f8c1e3b77", "value": "T18F25E01AE911A0B8D47360B1530FE376CD24AA3455579C8BFF5E2D68A63A2C09F3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988455, "uuid": "b4cee8e7-b9cc-411c-9ef0-b101e4026d84", "value": "24576:lADyiTwO40PmhCkDoPefXHTjaNYrJ2UQmL5hi39i1p2kw0Rk:lAWiTwH0PCWPUjeOtlQq5ei1/w6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988455, "uuid": "a941e3b7-dfcb-48a5-947c-643be9d2ae68", "value": 994744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988455, "uuid": "694dc7ce-7b8e-42b5-b649-9df459beb564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988455, "uuid": "a999cbf5-a6a6-414f-9990-2ab77d3ffddb", "value": "8e7f324f64b01a24bf0fd8fbccd78b489f5b6b17faa0513ae648b05733b9db7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddb43ac-75de-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782973200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973200, "uuid": "4a7b180e-278e-4e83-83ea-9f01ad1fe23a", "comment": "Malware payload", "value": "e08102d71970049d9256e09f62a76f50", "object_relation": "md5", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973200, "uuid": "d1a80d02-fad0-4f3a-a2ad-6109a02fe0c8", "comment": "Malware payload", "value": "902ca0af65c502fb6be26ca2b86610f8a6d799e9478091eac326e74ff7aa85b7", "object_relation": "sha256", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973200, "uuid": "82ed916c-af3c-49e7-856a-5b5a3ba00fb8", "comment": "Malware payload", "value": "150a72e7363ad389dcbccd2254d1b13f8ffe5606", "object_relation": "sha1", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973200, "uuid": "c14681d2-d974-42ce-a35b-c45b9b6e5c0e", "comment": "Malware payload", "value": "357f2b7b29c68bfe19e268dcdcc1a41691f0326c326c7dffec3ca0d9b7c0473bab86bbb52d31cf3d8632c0ed0ecafa43", "object_relation": "sha3-384", "Tag": [ { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "digital-magicians-com", "colour": "#3C225D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973200, "uuid": "0590ef6f-ca64-4eca-b5c1-7f02b72affcc", "value": "T1AEB0921018A4633ECF8FCF1A9296C2224D3A7111626592B1BA308A2979445A9D226948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973200, "uuid": "b553fe34-7ee7-46e2-b483-c0acbf6312ce", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIFQ/OGTDHn:s8GFGMFI1R3Ks8zsO0cK6xHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782973200, "uuid": "132ac2ea-b81c-4c86-be0b-109cfb038849", "value": 119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782973200, "uuid": "8fe060dd-97c5-4545-8ccf-08e3f370c15f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973200, "uuid": "30df550b-1689-45d7-9f50-ceb47066e66a", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f21aff-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987202, "uuid": "33460794-39fb-4fb0-9772-fafde36bd425", "comment": "Malware payload (Mirai)", "value": "080b7fc74f651a84eaa6015211fc8613", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987202, "uuid": "5680679a-b5cf-437b-8b3d-24c058831329", "comment": "Malware payload (Mirai)", "value": "90fa34ac9a9beb5ca31f5928e0adb224c3c81c81ef0a3017263f4084f826970d", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987202, "uuid": "bde04f5c-be4b-4ea9-b018-54e1b3c744f3", "comment": "Malware payload (Mirai)", "value": "e10ea55e47cbff44cb3465df8c1cccc9c32e8488", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987202, "uuid": "029d8c26-cf51-4352-98e0-ca8212ad8117", "comment": "Malware payload (Mirai)", "value": "6c3c7e9117329c0f0efee4f8b8c74652fa46f156394b34a954854c28b32f50e0d25b96d8e83f08f7e9964b724091d8ee", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987202, "uuid": "d96b58e7-b888-4a50-b06d-991b6e5f49f0", "value": "T13C659E03AAD040BEC4D6C0744B8F9217E677F88962387B6F22D65F913E26F61675E780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987202, "uuid": "9f3175a1-a1da-4a8a-8d6c-74d1ed320f60", "value": "24576:MZfOiu8FLPZgMSPv3x3+Hs8uvRjr3NJHG4ZfOiu8FLPZgMSPv3x3+Hs8uvRjr3NI:XipLRghPvhOM8uvRjrNYipLRghPvhOMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987202, "uuid": "7af1cf53-3c5b-45ab-ba2a-879fba3961b3", "value": 1478080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987202, "uuid": "d21280d7-f094-42fe-a35f-3811664a6d93", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987202, "uuid": "2f6eadaf-1314-4564-a87f-f110a1de8a5a", "value": "90fa34ac9a9beb5ca31f5928e0adb224c3c81c81ef0a3017263f4084f826970d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a808755-75aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782951048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951048, "uuid": "1d71d4f6-4908-45d7-8ce2-bf6d99fa1f7e", "comment": "Malware payload", "value": "169efceeb1c6bdb76fd3b6a871ffb211", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951048, "uuid": "5f1c756a-9c75-44f2-ac11-c2ba55b3edb5", "comment": "Malware payload", "value": "90ff88acf500948127dd71befff24024fa531f59154f788b4640e2b396e5cb30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951048, "uuid": "205f0eee-7b71-4563-9eea-729153ef197d", "comment": "Malware payload", "value": "5300aa649c6e1d5f66c606780ba5dcc559973b06", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782951048, "uuid": "c70595f5-afa1-43ba-b0fa-521620628ed9", "comment": "Malware payload", "value": "02f85ad371dfb4b09bdd15450f1974ba46380342239c779abc0d818141728cc14ad3552752eecbca2b13bed41aad0dc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782951048, "uuid": "d3338366-15be-40a7-9e64-6b2287df984d", "value": "T1A7F0A007B48BF036808439E8DB66F75AFC74BC476262DE4CB840BBA0DFD24347861240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782951048, "uuid": "92de23c3-ff88-4c59-bb9a-b190e06c29ec", "value": "12:lSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXLS9r:lk1gYpTr8i3fOq2bf8Ijer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782951048, "uuid": "a3786a6a-d51c-4faf-b489-5ed6b9b9f712", "value": 494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782951048, "uuid": "b2aaf28c-b50d-4ac3-98f3-79b7161ff5bc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782951048, "uuid": "f0529402-fd44-45f7-b353-61fa80fe94ef", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02d41d0-7638-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783012100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012100, "uuid": "35df1099-403b-4b98-8945-12415f79ba9c", "comment": "Malware payload (RemusStealer)", "value": "4d3ed418cb63b8f513d97835a761e391", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012100, "uuid": "864595ef-ff78-499b-9fdb-c501c75ddc45", "comment": "Malware payload (RemusStealer)", "value": "91e7539be877509b04b7425e35185615e76cabd3e9cb9e9ca4bfad36ad9096b9", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012100, "uuid": "1c319dc2-3254-43bb-a428-88f76fc9970c", "comment": "Malware payload (RemusStealer)", "value": "d612db0abb8aed772564df401b18a04dbdb2af1c", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783012100, "uuid": "649dbba1-2922-436a-8a41-2fbc4f7e1f6c", "comment": "Malware payload (RemusStealer)", "value": "6f2024862ae012f3387082fd2f85e57d523782344b84e4585fd9edf021597bbb9fc4ba39dc580ce959e250dad4e9cfca", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "PWS", "colour": "#41A0FD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012100, "uuid": "d3e5cb8e-8722-4ed3-a496-7b3f4d8dac09", "value": "T14A957C07BCB004B5C06E6239896B92927B31BC570F3263D72E90B6782F736D1B9B5761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012100, "uuid": "e6678fc8-03ec-4ea8-a038-305e4b6032ff", "value": "0da63366911fb2a1760d6f1fb1d657a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012100, "uuid": "998aded0-541e-458e-a0ca-b4be7af40fee", "value": "24576:1Gig227ev0pNxzpizQk6HWvXIXS/iV2Wj/SUEyJiPr:1Gb2yev0pNxzpizQkwWONYHU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783012100, "uuid": "3db46bf3-9045-456f-8c38-7a6a556d21bb", "value": 2058752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783012100, "uuid": "dbb845b9-49be-46a9-85f5-2c05c3782a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783012100, "uuid": "1b3d3f74-5bcc-4e6c-816f-2b2b2251a9af", "value": "816038639.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fec06ec-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988450, "uuid": "2538cc19-fe1e-43f3-8bb3-269632a52cce", "comment": "Malware payload", "value": "6cbf98e43ceeb91ff50729f285a845bb", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988450, "uuid": "9eec3fab-6c1f-456c-a087-5da96b8a3da6", "comment": "Malware payload", "value": "9344a381cc6b2c2efbcd3bea6ae58e1011b443de24006b5448679e4ad3d568e6", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988450, "uuid": "10b57145-f025-4922-a441-d98bab4f2a7f", "comment": "Malware payload", "value": "91f641b217ffaa1314b6b49f1f410f27b1b2b85d", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988450, "uuid": "d77a6ef4-b332-4fbe-832e-b963203ae2c9", "comment": "Malware payload", "value": "deb4f0bb987bf639d5ee2750fe90d32c3573cf8eb9e7196bbe27b625bd80ebc7711241bd14a4ae4c43ef4574d488a88a", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988450, "uuid": "32d4038e-33c6-4675-9c84-bd4c5ecfff45", "value": "T1A925E01AFA1154B9D47360B2530FD376C864A63546178C8BFF1A2D68AA3A2D0DF3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988450, "uuid": "7e6a3a05-74dc-44f9-ac7d-2d9d5a0d70cd", "value": "24576:lADyiTwO40PmhCi8vFyKxIq9X7dJHkPoOmvWt53IlKNgoFV9nQ:lAWiTwH0PCh8LR7ddkkvWjTNnFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988450, "uuid": "88f12237-3307-400e-9871-0586825f0a10", "value": 994580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988450, "uuid": "b35c48dc-aee8-4d99-be39-8c09e40e6984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988450, "uuid": "5512b324-0298-4486-a6f7-3ad6fedc1232", "value": "9344a381cc6b2c2efbcd3bea6ae58e1011b443de24006b5448679e4ad3d568e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929bbd4b-7618-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782998333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998333, "uuid": "6b54def0-9892-4577-88fa-e43256094b0d", "comment": "Malware payload", "value": "d91e9ceb300156c3027dad644290ad48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998333, "uuid": "6e3da42d-5d7e-40b3-aadb-168dcea3c17a", "comment": "Malware payload", "value": "9450d836e9c62d01bb66245884141665005fc4978f046d91afcdb99459187816", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998333, "uuid": "2f8ec01e-147d-4739-8218-475fb7247c79", "comment": "Malware payload", "value": "7f8c6d84878f791e5280a9d4772d85f0c5cadd32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998333, "uuid": "a9b9882f-74db-4d22-be89-6793ee67eb48", "comment": "Malware payload", "value": "e40fbc013d421257fa64551694be68e2e609e39dc364b536b30258363f21872e3184e3dfe7287408d7864a074d22d953", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998333, "uuid": "ad61c047-59ee-4a10-a332-4a73689b21b2", "value": "T1F3236D6516853C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C49AACE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998333, "uuid": "bd57d08d-4ec7-479f-b28c-530d7dd84bc3", "value": "768:Hr9NyXsZztCI9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:LHusZMcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782998333, "uuid": "3fb512f2-d90c-4db3-a537-7e7909eac6ce", "value": 48384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782998333, "uuid": "a1b1a6e1-3ac1-4177-a403-1f536874daca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998333, "uuid": "40b7a1be-a9d7-4540-9010-fb646da68bbf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56765e57-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033451, "uuid": "4adc9466-c499-4286-b465-43eaa09fc32d", "comment": "Malware payload", "value": "bda5d5d3f4668f0421c7e76e8ce45d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033451, "uuid": "583ca74e-500e-4e30-8914-93b779d97255", "comment": "Malware payload", "value": "945ce51902a9d83386e58a0da359216fd6d51bc9382d96381f898c97d58a4a33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033451, "uuid": "6fe4674c-df0d-4785-9d7f-2e262e0cdcba", "comment": "Malware payload", "value": "1e1cecd9eb7aa47d89d8ee1e77e0023835523013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033451, "uuid": "f78812b6-7daf-49c8-8f28-2a2067f02506", "comment": "Malware payload", "value": "d2e39df0bab83135435741589913ad7a388f68ccf9d7013ce6066bb35e91fb5bee5f55578770dbe13880814b90a3789c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033451, "uuid": "6fc037d9-9e83-4fa5-8d93-e9d6de687761", "value": "T172631247FFDC1BA9ACD92ABD07AB75DB2762A032547280B40CE54895805FE6114DBCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033451, "uuid": "38480cc4-5fa3-49aa-b722-d198724b9dad", "value": "1536:37MbwKNGjjH+Xq34n/q8Zu41zmX3sDgqrPw:37Mbp2L+Xqdfoz2sZrPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033451, "uuid": "fc65c1b3-2406-4dff-ba0c-ee4a460a3cb1", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033451, "uuid": "3779292c-364f-497f-bb54-7f85ec00baf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033451, "uuid": "af5d5e4b-3eb6-4359-924a-73e42498f00b", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcd5f20-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033326, "uuid": "2febb7bc-faa1-4175-844b-2fbe90f298d7", "comment": "Malware payload (Mirai)", "value": "a78cd1059025faee6ee5980118a39e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033326, "uuid": "94c5196d-8832-4c13-bb3c-03351fc518c8", "comment": "Malware payload (Mirai)", "value": "9517c95d736579963374276fe45955a73129e3cf23a5821fb34e61cecc800a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033326, "uuid": "b63e97ea-d9c7-4b19-ba93-288093475013", "comment": "Malware payload (Mirai)", "value": "cdb8955af8c9e263de16032c9b5b8c33d676940d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033326, "uuid": "0c108da7-7319-4412-b6fe-9a8757d108b6", "comment": "Malware payload (Mirai)", "value": "334c2c6297cfc75aa79fd0d8f19e5ea18c09999365489b43a9b511ea565452897e719cde6908842d72e67d48d97fea8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033326, "uuid": "15eec213-b6a6-4c31-93c4-6022521e2cde", "value": "T1F9042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033326, "uuid": "75c35702-bbdc-464b-ae69-696503655c11", "value": "3072:OzeSvtfD84oALv2eEQakGzORuGMzw99LHd38YhTfYo+M/RM+FDhdLn:2eSvJvoA7TEQakGzORuBGLHd38+x+M/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033326, "uuid": "179e0eee-907b-46c7-a304-a6348870c3e1", "value": 181466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033326, "uuid": "c4d38cd2-09c8-4e8f-a132-9b5bfd5a9f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033326, "uuid": "274837cc-be0a-4fca-883c-929b560779a2", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffcae8a-75dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782973123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973123, "uuid": "b7a5e493-2216-4bba-8ac9-89b600ebd878", "comment": "Malware payload (Vidar)", "value": "5174acab68d3ec42c3980a78848ce61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973123, "uuid": "fe73422e-d940-43a9-b0bf-3cadc6f9a0f9", "comment": "Malware payload (Vidar)", "value": "9583a8b2f14ef7262bc14e2fa0a1186fa13a27a1eb256b78e7310f22ef93aea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973123, "uuid": "ae936f8d-8919-45fe-bd72-890563151f7a", "comment": "Malware payload (Vidar)", "value": "943a4c0de08386cc9b5e9c5578bc6b562827459c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782973123, "uuid": "bb66a5a0-9669-4833-ab11-62ffc9a219cb", "comment": "Malware payload (Vidar)", "value": "fef38e45bb62b6c15a01cc9a3a6fd82dca8ed4d35bdbb868390311473d1c03c18cca0f2b69fc9e6aa83fe3d8de66b8cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973123, "uuid": "8afcc5c4-a8d5-4f75-91c0-c10f87f589e8", "value": "T1B5E5AE077CE009E9D4AA633188B642527B75BC0A4B3263E73E80B7782F72BE19D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973123, "uuid": "88d53d53-d97b-4d4b-b645-37277f915f70", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973123, "uuid": "2ef418ca-379f-47a8-9a43-286d443fbd7e", "value": "24576:0Woizasyn3JKhNBxEloXHk9WM40wopkbxbP6esHB6ZB1mJbFtHT9ng4OGMN4aztc:0WoIasy3J8xkoUo/bPU6UHhTFROzT4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782973123, "uuid": "9b821c3a-1ba7-415a-8b2d-d1983ee40977", "value": 3021184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782973123, "uuid": "0df40b0b-a75f-4b0d-a3cc-fbd92d745263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782973123, "uuid": "1e55a8fa-3d69-4750-81d4-b285d9802ac3", "value": "33821841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dab3fe-7637-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783011683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011683, "uuid": "c9a783c7-a03a-4542-ac9c-a886b03de8ce", "comment": "Malware payload", "value": "e50bb850266028ddffe0758a9132cff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011683, "uuid": "fe4c344a-964c-40df-aa25-712881b208b7", "comment": "Malware payload", "value": "95ef16cee49895c1073bc7a62b1141e5c8fb4e836368c12e5992e75a0429309b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011683, "uuid": "2ff0cb29-8b18-40d3-a805-f35949c2a0e5", "comment": "Malware payload", "value": "0b5ec4b6cdc2a1e41b54e52b1f1713f7dff0e28e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011683, "uuid": "6e271a90-4e1e-486f-bc9d-849ebfaf034c", "comment": "Malware payload", "value": "d97d9d2b362d6ff59afd279c12d1fd6d6e6b53838d068c587965b9308dddddbeaaa6f70ea16d38665889f01e8300fb7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011683, "uuid": "551e5dbb-9134-4e67-afa9-9beb94b75771", "value": "T1A5B67C73905334D9E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011683, "uuid": "f486a8b7-3fed-4530-bce7-6f043bf8a71e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQN:cqYUQuVDt0TZEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011683, "uuid": "b0ba94dc-348e-42d4-af29-dbb4001bcd9b", "value": 11403264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011683, "uuid": "031114f7-83c0-406d-9be4-16f4d79aaf91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011683, "uuid": "c3fc33dc-840d-486b-a81f-2f110c9bb37b", "value": "95ef16cee49895c1073bc7a62b1141e5c8fb4e836368c12e5992e75a0429309b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236c5c58-75ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782980108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980108, "uuid": "00ad55cc-63e6-41e5-ad02-141b8e72287f", "comment": "Malware payload (Vidar)", "value": "58d802c3f17f7ce2132e90817f0fbecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980108, "uuid": "fd148915-ecbf-4f1c-ac08-83e7682d060d", "comment": "Malware payload (Vidar)", "value": "96a6875c5ef401924adc9370e83d058e1bb23a4299582802ea30089df5dc7fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980108, "uuid": "7ec0a6e3-556a-4537-ae64-bb7cb1eb2f64", "comment": "Malware payload (Vidar)", "value": "10f465798c516868b0e202b2b9758769180bf9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980108, "uuid": "76fdaddb-aaa3-4928-af7f-627fe63ac7a4", "comment": "Malware payload (Vidar)", "value": "d24b008c3b55d0e74c453bde265ceefe6002937bcbb6c93eb04ad6833a45446dd360edd425a7116025a79e09ec1ad085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980108, "uuid": "0cd5545d-759d-4cf8-99b9-89a910b27987", "value": "T179E59D07BCD009E9C9AAA23289B652A27B31BC590F3177D32E40B27C2F72BD05D76755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980108, "uuid": "9b064e9f-6dd0-4d11-9d8a-81c8d0503ef4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980108, "uuid": "9fdb75a7-f154-49ff-b212-7d1a6d6dcf22", "value": "49152:AxnOeT6xoUaynB+3LYWa0jXfBlMGk9ZQ18LUql4auqgn5KLM:Ax1G+c0jTiweLdlITb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782980108, "uuid": "59b9471e-d830-4885-8e79-edbbe1dc3451", "value": 3111784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782980108, "uuid": "59dc8730-8fb3-4d20-9f9b-a6a5330afe1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980108, "uuid": "dacc93ff-960f-4b1a-b564-8214809d948a", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2133cdc-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966603, "uuid": "e4ca6d0e-35a7-4250-b799-f9718cdc8d83", "comment": "Malware payload (Mirai)", "value": "a192c62b5efe6d5ed51e7754dabb8696", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966603, "uuid": "0577f788-c0b5-402d-bd49-a2d2da1e9bc0", "comment": "Malware payload (Mirai)", "value": "96bbe280b9b8bcace06dacb11ecc83f9f94c6e74d301d2e02e00ccf33179fb76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966603, "uuid": "902e7dcf-eafd-46ce-8f41-1baeedb19592", "comment": "Malware payload (Mirai)", "value": "13e5f3c585c81f76241c031a2121a72ec3dc144c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966603, "uuid": "0fbd7064-a279-4bff-959c-77f63581d30e", "comment": "Malware payload (Mirai)", "value": "f75f6c07e2323be3fb1d55ad4e8e6f9a0ec3a16fa20812733ec37a7a60cce4440a93ff65e153784cadc3495e5d87affe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966603, "uuid": "19bb962e-0b30-49de-933f-cf9f7c56857f", "value": "T1F8213E8D23ACB1311DCEC916731EC2EA39E295D2A4E40934B274DC34C6BBA8A3113F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966603, "uuid": "f28eaf1d-5089-425d-9fa7-8e4672c6d6aa", "value": "24:3J3T5iHlwibV5Plwjy51NIplwi55xlw3KCk5Qlwcj5hlwVU5j8lwcj5llwJQ5plf:F4F7RrPqjFQ+IvRLZafR/d7D0ZypDzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966603, "uuid": "e4eb0a6c-4025-4e0d-8793-5700a0d6be41", "value": 1330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966603, "uuid": "f4657c64-fdb5-4683-8d4b-b25951d2994d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966603, "uuid": "33eaa16f-d0bb-4343-8d61-0bcef48b1296", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6915de19-760d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WallStealer)", "timestamp": 1782993539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993539, "uuid": "57efe294-da76-4004-9591-0326cc6ecd04", "comment": "Malware payload (WallStealer)", "value": "1961ed753ca8e8eb1e7e450aaa8bfc65", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993539, "uuid": "f612bbe5-0e2b-43cc-8076-879a944c35f1", "comment": "Malware payload (WallStealer)", "value": "97c5aed61b4b0a2d143311922cd07ac720e452781a98ed03a9e7002e315e2b8d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993539, "uuid": "787fe391-218c-4a64-928c-16e1c3a8d86c", "comment": "Malware payload (WallStealer)", "value": "976231882b659eb065029bb587605279922ea68f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782993539, "uuid": "5d86661d-4515-48bb-b753-4ecf03249c15", "comment": "Malware payload (WallStealer)", "value": "65611bc222baf77155131d510ee5071cff898673b4e4c1c3407df97fb56852b46a7712bdea84f188a7242c7b957b34de", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993539, "uuid": "90642811-ca67-4532-9010-82b92e986c19", "value": "T178D5338B4AE6E569E5BD4B7988B614D35134FC222B6A56DF19D0F07C0E93EE4B031B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993539, "uuid": "869e4d7e-1cf5-4a66-800c-133d64cb51d7", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993539, "uuid": "efa7047e-f199-4ce8-8e58-ca35fb8a40ea", "value": "49152:4uw1U6zaKz6bAZg5gAZsztO+lIJpXA4wfLeJxwzJi4gOV0n6wJaZbhnMIXnsXGGj:o1UEaKCgAZs5OmYA/DHuOin6wJGb5nsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782993539, "uuid": "f1ae20fc-4dd7-4f2e-acd6-5e45ef5fdee7", "value": 2826240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782993539, "uuid": "8e559be7-e0e6-4f37-8426-e21ebaf8bcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782993539, "uuid": "5b720e4e-1527-4752-8cf7-903480c2b874", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d12d150-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988445, "uuid": "72b55dc9-75f0-427b-a5c3-2555b003f608", "comment": "Malware payload", "value": "fa9db192403169739eaa25b21cabc4e1", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988445, "uuid": "11eb6663-a799-4011-8130-787ce095a2e1", "comment": "Malware payload", "value": "97dec8dcac1b1cc5961dcd73fd98788651dc90be7e4714cad9b796172269808d", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988445, "uuid": "0aff7fbc-12af-4dc6-899e-aed94c6be416", "comment": "Malware payload", "value": "4af23e25aa3a5478290aa9f07939ced35fc04715", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988445, "uuid": "82d8655a-08d8-4252-bcdb-9020b5017504", "comment": "Malware payload", "value": "25453a024dc854489bcf546c936a9002e779c2cc7f21d1f8d2cdaa395702b9a93179c57aaf079789afb3e02da0f533a6", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988445, "uuid": "4bcd05a4-d21c-480a-b7ef-4d29eca4b3ec", "value": "T17B156B06EA016579D47271B1524FE336C8686B358527488BFF5E2D6CEA3A2D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988445, "uuid": "3bc15bc0-378c-414d-a11b-014fd4bf7109", "value": "24576:qeXXBsUAJbR0RZDIHCVJFY21VpGw6SmPWo0NQ1W:qeXXgJ1kKuFYCTG/PWo0CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988445, "uuid": "4430cea1-cf68-485a-840d-c1c433f278a9", "value": 883248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988445, "uuid": "a02b87ec-6ed8-4e5c-830d-7d4b614ebd07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988445, "uuid": "d8eb5006-0c22-4797-a4e3-c1db67303354", "value": "97dec8dcac1b1cc5961dcd73fd98788651dc90be7e4714cad9b796172269808d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bd45cb-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972265, "uuid": "1c420482-72b5-4c19-9c5c-052a57d5c51e", "comment": "Malware payload (Mirai)", "value": "73724d37f8d9b2a5d7eba77540a3af57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972265, "uuid": "f51f5c25-f38a-43cc-b9d7-f4a5cd1df13c", "comment": "Malware payload (Mirai)", "value": "991a2082532c68ff2cf9766b14f9cfb246bc6d2466a65a6ad81b908ef76e3f1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972265, "uuid": "2d813213-d5c2-4aba-adc9-160c96282a99", "comment": "Malware payload (Mirai)", "value": "79c3301d4172e0ca2bb71e429d80e62e9f390760", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972265, "uuid": "274969f0-3e2b-493c-9e89-9a2088348130", "comment": "Malware payload (Mirai)", "value": "af153a812ef07567610e80efea7157994ba2f359e826b4a00fec5ed41704ae4f6dde1b28cf57d2c57164722fa9d58391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972265, "uuid": "5103f302-4aba-4fec-85e5-40d09aa30f10", "value": "T123832A95D9B2D8B8F41108F0303BAB17C271F8A5866FB647E7A27C75DCA6901BA05F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972265, "uuid": "bb5c8346-873f-461c-ada9-8fafdc46eb82", "value": "1536:k6do5Mhn5SvciBCECLxyzIOEHk/3xCVpamuTg:k626hwUZfLx0IFE/cATg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972265, "uuid": "6765b0ef-93fa-4c50-a5eb-c3646ad6fa23", "value": 87244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972265, "uuid": "d57b7d4d-9310-4ab7-a732-08a63b514c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972265, "uuid": "17415b4d-c3c4-45d2-9cf5-df9604398075", "value": "root", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d949da-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972196, "uuid": "c9f26e0b-f21f-46a1-b02f-77e5eaf7b8b9", "comment": "Malware payload (Mirai)", "value": "b83e1a178acbe2e2451b2948de2221dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972196, "uuid": "7c7222b3-7317-43f8-ae0c-2210b52f6381", "comment": "Malware payload (Mirai)", "value": "991d66e2860b9e7d56ed92ec89e5fa78ad44c05b6b7e75ca8d853dd87bcc9b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972196, "uuid": "65302ab1-947c-45ca-8faa-837792f09b9f", "comment": "Malware payload (Mirai)", "value": "b01bed3c551979727e77c0bf7a93f1f79f4e60e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972196, "uuid": "95c6ae3c-e96a-4346-ba28-6050fc80eedd", "comment": "Malware payload (Mirai)", "value": "bca721a56c1b8572cffb4f026a7b2fb7c8286c8e40ce6608d830051df9989bcb8f55a22d62e5c320842d9a78741fea5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972196, "uuid": "008f6096-a21e-450e-bc47-b9c31e0a580f", "value": "T1FD9319827E1C1A23D3151BB42E2F23E5D7B561E004A596062E1FDF468133A7359BBFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972196, "uuid": "b577ed1e-92d1-47cb-b039-44ab24a5d3c2", "value": "1536:RA1ONUGf0PMm7l8ieT0G0TA5yIAFvxsoJTzCG4Sb0iYC3XtcrTDT4Q:mYmI0fF73/b0E3GzT4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972196, "uuid": "7857c5c3-20a1-49b2-8200-3c6f33030529", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972196, "uuid": "2566a413-e975-4602-a81f-2afd58ef4852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972196, "uuid": "9b6b02db-5bee-4bd6-9f55-7bc0d6f5454f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb4aca0-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966599, "uuid": "ffb30b7f-fea5-44a9-89ee-d6fc2f04c0c2", "comment": "Malware payload (Mirai)", "value": "b13553b5c5df72062399709376d2eea0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966599, "uuid": "cd9d1b67-d18f-40ab-aa10-4db7c82e6acf", "comment": "Malware payload (Mirai)", "value": "9938142110657a6e02605d6da7466d06fa28767c20fd237b92b1e04c003a0380", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966599, "uuid": "2298017c-737e-4039-8c53-0b1a2769adbe", "comment": "Malware payload (Mirai)", "value": "74e4efedd4ee3a0f05c8e611ff6d4f1828e9756d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966599, "uuid": "6bfcc7d9-27d0-4a96-8148-65c8ebe712bb", "comment": "Malware payload (Mirai)", "value": "8697437076b5f53b4d2ee47db49f1b9383c6b2147deb0675ae67ab1bdd1789ece89c14f2328e09ac9387a9a3c7398a1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966599, "uuid": "c79e377d-d0de-41e5-88b5-1a32759708d4", "value": "T19921378D236CB13408CEC912331EC7E239E396D294E40E3866A4DC36CA77D867117F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966599, "uuid": "64e3e645-7216-47df-bad5-f0c2aed614aa", "value": "24:y5iHlwibB5Plwjc51NIplwi15xlw3KCi5Qlwcj5hlwVy5j8lwcj5llwJ+5plwdoZ:y4F79rPqjFQYIvR7Za/Rfd7D0VyFDzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966599, "uuid": "2621d158-1df0-4025-9896-1cfbe51978c1", "value": 1317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966599, "uuid": "30e3dc13-d39a-4409-b088-be92227bf440", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966599, "uuid": "aa84a6ed-0a74-48b7-8a53-f25ffb06549e", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e44ade4-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010674, "uuid": "c1f63645-5d01-47dd-996b-8ecfb54bf4e8", "comment": "Malware payload", "value": "2341e8091c52ea36c9c3135b5b7b2ae7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010674, "uuid": "c1efff5f-a05d-4dcb-9f13-9485ae92dd83", "comment": "Malware payload", "value": "995add682c83f780b4e7d99235f4a0d2265b013f9e68f7da033336b7d41e4102", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010674, "uuid": "318dd6f8-723e-40a6-bef4-02548184cade", "comment": "Malware payload", "value": "516c8399c56b80f3fa219a0101f1a2874031016e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010674, "uuid": "cd9b42de-49d3-45de-b209-f9a43c982883", "comment": "Malware payload", "value": "0c7ca8815a742ed37d55a39a63edd194a9f18a263d34dc1d47c507ce154ead8319204410684d662504ca5a5d1e33a1f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010674, "uuid": "6301236a-7dc4-4b0d-8215-7145b376c3ca", "value": "T12A236C6516817C24AA99D4371D7F2F0CBDA983E6320492DD7FCA3CF28C59A9CD11872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010674, "uuid": "af83b309-8aec-40f9-a462-3e80ebb22108", "value": "768:PXRWNGxV59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:plxEcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010674, "uuid": "4f9e9e7f-2287-4645-a3bb-02ac6b314d6d", "value": 48380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010674, "uuid": "70750b12-b81d-47ef-b043-9ddcc6025d1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010674, "uuid": "6c95e31b-d1f5-463c-bf4c-e714096c3e5d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede03fb2-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010942, "uuid": "41904626-f9af-493b-9925-0cfad63ae0b4", "comment": "Malware payload", "value": "ae2039ae5b6731b6b18b3612e0b61429", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010942, "uuid": "18bc8eed-6b6c-4c56-9e8c-6067d65d2dbd", "comment": "Malware payload", "value": "996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010942, "uuid": "a12b7f34-70e4-4227-8dd6-caf3309f3d29", "comment": "Malware payload", "value": "5d1138ac0ebeb2e78d1876e016292c4b6bd1c3b3", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010942, "uuid": "19b80a08-12a9-40a8-bb8b-785a6162e5ae", "comment": "Malware payload", "value": "66ade9cb3d615cead22120b675a10603dff3bc721aff05f3c3c694027334f14ff98cdcfa901feee5f69cf4f87ab0c97a", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010942, "uuid": "e72d8cc4-6ac2-40c0-8615-fedb37105457", "value": "T1B5E44B1BA2A801A9D5FAD1B98E674417FBB3BC154722D3CF02E192590F277D89B3B710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010942, "uuid": "9774b558-241d-4ba2-a5aa-bdfa10490d85", "value": "447829d222821e3142012ffbfc54758f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010942, "uuid": "5daf00f1-7c2f-468e-a563-6ca68340bb1d", "value": "12288:ZPQR8v+FozH+VJTDfAqybaJc9dw07iUpU26R9K6s4b:ZPHv+FozSTDYZA2dw07iUpyR9Kcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010942, "uuid": "2e25c2c5-8dce-4b5f-b49c-5ec82eb66a46", "value": 695656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010942, "uuid": "2d074b2b-32b0-4206-ae4c-2434d2cb681b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010942, "uuid": "3222ced0-89d5-497e-a980-858db084b1dc", "value": "LoggingPlatform.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab638506-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966592, "uuid": "0b1cc236-d0dc-4872-9a67-73a179d8ecf8", "comment": "Malware payload (Mirai)", "value": "8beef39733a2cda45fdc9330e4eb024e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966592, "uuid": "b15b8ad5-afbc-4fe9-90db-373497c84c56", "comment": "Malware payload (Mirai)", "value": "998c6056363bdd5ae5f299f06ec37d7a2e4a3807366a48fbc84de821cd6ba52b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966592, "uuid": "a062021f-2da9-42c1-8580-b39783ff62f3", "comment": "Malware payload (Mirai)", "value": "3786ce0ab7c68ba06c2e67a60e96d28b2ea1e537", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966592, "uuid": "04b01589-3184-4b4d-8058-5e722dacc06e", "comment": "Malware payload (Mirai)", "value": "60b4536e4f70f8dcca7f6bb9437e6bd6cf39f162bf20a7963de95dec5370c38cecf37606e9d5ea7a074cc953fd8e0509", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966592, "uuid": "13a0082c-b843-41b6-9d5e-181a2b618e6c", "value": "T104210ECE23ACB1300CCEC952331EC6F639E696E254D40A3866A8DC75967BD9A7113F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966592, "uuid": "40bab6fb-b02c-4a6b-8e2a-6efa2d93f4a1", "value": "24:E5iHlwibXk5Plwjak51NIplwijk5xlw3KCMk5QlwcFk5hlwV8k5j8lwcFk5llwJi:E4F7rkrpkqFkFQOkIJkRdkZa5kRZkd7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966592, "uuid": "be1efe94-2482-4108-8e66-f1802c770253", "value": 1426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966592, "uuid": "1a6c8355-df38-4db3-8f59-b39f86a88c49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966592, "uuid": "76cc49c9-7bfe-4bee-a657-dac5c6cdded6", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09950e9b-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033322, "uuid": "3319ec38-4f95-4e8f-a9c9-d1616d6726a4", "comment": "Malware payload", "value": "363b3d42d09ab34082f195b01c743c84", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033322, "uuid": "5ac6b316-57e3-4098-ba40-923181f27517", "comment": "Malware payload", "value": "99ec0e5a73529d9bc0ee7c385e46c802a2f94be1dabdc2aa954f2ba8de2b4d58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033322, "uuid": "be0515c7-776d-4f5b-8192-4850b8c85a51", "comment": "Malware payload", "value": "f880cd67abafc6a22a96efeb4b49e38aef2fbb6d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033322, "uuid": "54563a63-2eff-409e-8beb-7bac06d65443", "comment": "Malware payload", "value": "1cb3fdb51c6e2bb54fd9d8022856f5451f677e353b29230a6fe838cbb0dc5369e07bdb6973ada6f8849dea019ae01e33", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033322, "uuid": "e6b76188-66a1-4e4d-8f2f-bb4076bab485", "value": "T19951F8AC55611A774112FFB2B4118B2E35BFADC512A36B1C939D36AACC6C804F93C5C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033322, "uuid": "5d3d3b39-4e33-45e0-a4b7-b2d0da11ce8b", "value": "48:rMpzaC56ZLaQRN9ahHJHCzXXaejrNZ3dt2TOti:r8+s6bhdri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033322, "uuid": "6466edf8-9492-4981-8ff1-bb305a10a112", "value": 3042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033322, "uuid": "394d5c5b-78a5-45eb-897f-5019c184ff6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033322, "uuid": "035f7493-a566-4b7f-a26d-67ab55c03297", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9871d6-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783003448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003448, "uuid": "037f3883-46e3-4952-8b4e-84c9a4b94135", "comment": "Malware payload (RemcosRAT)", "value": "668012498421c76b8a9d344ce6acfc67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003448, "uuid": "8d054d1e-1792-4dbd-9431-ddff3a74182f", "comment": "Malware payload (RemcosRAT)", "value": "9a6475f5c793000640b312a5d5a9b18edf9d570cb2b86204dc9b7101ce5b4fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003448, "uuid": "e824f68f-ee70-47ed-a664-16317c01a0e1", "comment": "Malware payload (RemcosRAT)", "value": "093ac47b4dcac8fa8d3487b73be98fea003513bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003448, "uuid": "0d2c8edd-c41f-48d9-af4c-657b6bc8d78f", "comment": "Malware payload (RemcosRAT)", "value": "431108508b15dd7128f8e56c3fdc93932fd89428d74f61c0401a55ede37690f20112c2087ec73485022d5e329bb0f55b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003448, "uuid": "a8d2b48a-2f9c-4b00-9fd3-182afbf75307", "value": "T1E7D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003448, "uuid": "f163d265-50a8-41a4-9f2c-db307d747521", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003448, "uuid": "14f579cd-9406-4845-acf3-def0312a8e50", "value": "12288:EZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:iQKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003448, "uuid": "404a06b8-2a31-4cbb-901e-5a71552c0b15", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003448, "uuid": "1d90aa83-5387-4223-9d6b-f0d5aba7cfe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003448, "uuid": "5f1e9585-857c-428d-bb6e-750f918e9d69", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d71c89-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006343, "uuid": "06d1e2e1-cb0d-4e48-a7f9-27494b370ac8", "comment": "Malware payload (Mirai)", "value": "f80095e7a60164b7dd72980ff5246349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006343, "uuid": "35e552b9-aa8a-4910-a509-841a82c860ea", "comment": "Malware payload (Mirai)", "value": "9a74c2490b6cd65e8ee1ba30d1ae03efaec0a18efaffd5aa6636a7d0c985e01e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006343, "uuid": "0e97d866-8c9e-4ce5-8e8a-c5b870f5487b", "comment": "Malware payload (Mirai)", "value": "2d4d8bad2e21a605b9397bdf95b8a928cdfbec38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006343, "uuid": "f52e7747-2bb0-4be1-8dae-46c97463bcb3", "comment": "Malware payload (Mirai)", "value": "1d262109d862cd03bf9a2a004fea3f985804dac858ede82295f7180d4a80941051799ec60af6b5d8c248a04e52e4ea84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006343, "uuid": "94985f40-a1ef-4cf2-979d-88d741d53474", "value": "T17404B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006343, "uuid": "6a899c3d-1d1b-4b33-aecb-b340d669d994", "value": "3072:nKpzG4eNkSfcQqmav8SqaRVlnYz65WVt:nKY4eNYQqmeqavlg65W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006343, "uuid": "4d95c9de-7fe0-4b6e-9af5-2a852ebff62e", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006343, "uuid": "806b1ead-e6e5-4f94-9405-33158837e7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006343, "uuid": "f2c98b73-49b5-4b1e-b35b-5a3ec79629da", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0fef28-7643-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783016814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016814, "uuid": "dc1f4646-aef9-4c81-b119-8406289191b6", "comment": "Malware payload", "value": "885c7c28b18f9353d715538a286ec50d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016814, "uuid": "87f90d8f-2027-4a47-8c3c-7aeda23dad34", "comment": "Malware payload", "value": "9a836ef59a4fb8cae0543fed24ca8c53015bee86d6b0ead0086917681c7576d4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016814, "uuid": "77fed75e-af60-4168-b869-7c635783ab81", "comment": "Malware payload", "value": "6bbaa1dc37f07c14e5b1da71b0c7aab7bca3d501", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016814, "uuid": "c3d80ea9-8757-4d39-9124-6a162dc86fab", "comment": "Malware payload", "value": "fdc9ab879d93c8f829da809638d0b140eeca5f2ecd873842f7bdaef96b5c9a858d5f6b40829fa84fe79a6d49f7b1677c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016814, "uuid": "b2cb8f3f-2c5d-4563-99d1-1321d5d14837", "value": "T1AAF68E43F7029D6AC9DDE73819B693C23335FD4A5B8747131419F2ACEEB2AE65B05280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016814, "uuid": "7311655e-499e-42de-bc18-1273dc3fd055", "value": "98304:9UDER3kg6q+7akTBZgVuz6WbQukgZBW6Di/5vKERSzEYmmmYu9dTMO/lIHRUoT4x:9UY3R6qOtcVhupvW6G/nRcNO/KHR5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016814, "uuid": "40292e4a-4fd1-41c8-95d3-3c6a2e14e35e", "value": 16562735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016814, "uuid": "c9ef16c3-ea06-48d8-9db7-ca1d6e8d7884", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016814, "uuid": "0c8f7092-7f2a-412e-aa73-f3a79bb2494b", "value": "chiken.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c09351-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033589, "uuid": "b5fe6ff4-4c95-456b-931f-5c0fa87cb3c5", "comment": "Malware payload", "value": "931c38d7da0121c65d4c5b6d16f42819", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033589, "uuid": "7f14fb17-e18a-4af2-b72a-be15539cd8ea", "comment": "Malware payload", "value": "9b263a5a34d255506fe51b8f57d8fe44fcfd387efd0e57263e95d5e7be92e40f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033589, "uuid": "d357efc9-19e6-4e7a-a1f0-46f227ee624d", "comment": "Malware payload", "value": "84705726e34389ebdfcc12a71de62da89cd5d8cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033589, "uuid": "0ffa46e7-8f86-4cee-a270-df8577a29e6d", "comment": "Malware payload", "value": "819b72118612c9c7f37c044cdc592247ab4611010edffb9d39db27b5265dedbf02f47df28d03bffdc04e8f5ef79f8720", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033589, "uuid": "86b5661d-39e6-4a8a-899b-cca964df0b0f", "value": "T126F096CE0150365589CDD94FBBB3C92C245687CD168F5BC978AD051AA6446EAF044B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033589, "uuid": "82f17e4f-730c-4af4-95f4-c5ce293b161c", "value": "12:KSs6wZUJQNyHe0uUJRsHUbVSYeJBOUbg5pB:KSKZ16vsQle7qpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033589, "uuid": "df168e33-3deb-40db-b4f5-8b22361a715d", "value": 528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033589, "uuid": "a0de5770-89fe-4530-9d0a-f61f12748d9f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033589, "uuid": "d3bd9b28-5a4b-4d47-ab38-150dac990995", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9400374a-75f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782983733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983733, "uuid": "784a907e-a888-4f5d-b726-dcc411ff253a", "comment": "Malware payload (WannaCry)", "value": "60420870d5b8f7c72103db372d4fc6bc", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983733, "uuid": "b857aa76-abe5-4560-b04f-5ea6dadf6519", "comment": "Malware payload (WannaCry)", "value": "9b90e3a119436b64ead0edfde7a8be2221fce6073f369c4065803320f9bfd655", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983733, "uuid": "7fd061b0-9ab0-41d1-b919-5bcf002cb4ba", "comment": "Malware payload (WannaCry)", "value": "2f079b8e278bbc6d75b7505252b32ced8f6cbf61", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782983733, "uuid": "2fdcb3c6-0743-49a7-8fe2-b5094db650ea", "comment": "Malware payload (WannaCry)", "value": "9e159983525d4fdaad5c07bf56737b3482d8ebf64874200ce9512940ece5785770ef0fd337a370f30ce080a551fba032", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983733, "uuid": "3e2e48fc-7869-49c8-bf20-d9d989764996", "value": "T14A363398727CD1BCE10609B484B38E26E7737C5667BE5B0F8790456B0E03B5BBB90B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983733, "uuid": "f2a5ad29-da0a-4b85-8e24-c4fb44708865", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983733, "uuid": "5412ea69-b30a-410b-9009-14ba926328bf", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yA:DyDqPe1Cxcxk3ZAEUadzR8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782983733, "uuid": "d9c80697-9e6b-413d-89f5-d7726a6de317", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782983733, "uuid": "1d795c44-8602-4b2f-8755-f2d28fe8ee71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782983733, "uuid": "ba612c68-b722-4fa9-9e06-52b82a3d91e9", "value": "9b90e3a119436b64ead0edfde7a8be2221fce6073f369c4065803320f9bfd655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033d4084-7669-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783032882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032882, "uuid": "6af47f30-96b8-4b4d-bf4e-3a86b54aaff0", "comment": "Malware payload (AgentTesla)", "value": "bee96dd6dd3f1b7452507dee0b0f6923", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032882, "uuid": "6f5cce63-a4c7-40b8-ae4d-d801b6b3f26c", "comment": "Malware payload (AgentTesla)", "value": "9c0eb19d1579fbc93030d42465b90e092889b930733ffda60b5acb137a346dac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032882, "uuid": "1fb5717e-e3c3-4446-86b7-0c9f9ba6e8c5", "comment": "Malware payload (AgentTesla)", "value": "071ec523c70a4654e66dbb257be1ac4071b330e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032882, "uuid": "2d05d63b-e68b-4012-93c5-754d5d904e88", "comment": "Malware payload (AgentTesla)", "value": "8d65aff8c772dd873da87435fbfff66e401114145921e31bcd067a687e71a38af5fae5c5206bdfbc3083303d0fe4d5dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032882, "uuid": "64df914f-f9cf-4165-a011-3775cb2a248a", "value": "T1D9752335443DB2003427EE76C3AD64DADBCD5AE9BFAF51494036174A9227D8BCCC226B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032882, "uuid": "6e6fee57-f29c-46c5-bc92-1a92b52f5658", "value": "12288:Ge8IEdPRUwn+VpabD+WeKlZUQHstoMMAsfo:gPRbCu+AAko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783032882, "uuid": "027d4743-550b-4002-b679-3546fa490c32", "value": 1662804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783032882, "uuid": "26094e02-a7cc-4461-9751-0cb317f87642", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032882, "uuid": "ade8cc7b-ff10-4cdb-80e2-222ca13318b1", "value": "Quote Ref #011599.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bdb083-7643-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783016859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016859, "uuid": "5153a430-ab68-48e7-b53f-07b1d807cbfd", "comment": "Malware payload", "value": "c51b68fc037544cb4fa77365a49b1d35", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016859, "uuid": "64854530-382b-448a-beb7-6718c38993a6", "comment": "Malware payload", "value": "9c23c73a7fa3b1b3df8a61866dc36d263aa0754a0bb194e0d164a4773f4537f2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016859, "uuid": "7c0e8027-c0e5-4ecb-8432-2a6e810b2198", "comment": "Malware payload", "value": "1e4595bc32750dd840c743cfbe53450ea615f10e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016859, "uuid": "64d90ccb-2d03-45fb-8088-89ff6202e568", "comment": "Malware payload", "value": "017d443dc727fea14b8e8c3a8afd1823cbd986766b051008a741c5fa90e7061bc9c062e4d19706ab967309a4f546283e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016859, "uuid": "4c065107-54be-4d72-a27e-d2e580ba3ef9", "value": "T160F68E43F7029D6AC9DDD7381AB693C23335FD4A5B8747131419F2ACEEB2AE65B05280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016859, "uuid": "6d108a71-b29b-41d1-a558-d74070a95a38", "value": "98304:nUDER3kg6q+7akTBZgVSz6WJQukgZBW6Di/5v4ERSzEYmmmYu9VTQuplQpp0CM41:nUY3R6qOtcVRupvW6G/tRctupepp7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016859, "uuid": "e83ae118-d684-429d-94b4-c075599879d0", "value": 16685837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016859, "uuid": "d0b7d8a6-b7b5-4eb5-bf40-47ddaec3a7be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016859, "uuid": "85e462fa-505a-4c71-8e0a-73892e6393b6", "value": "chiken(4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab58023e-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783004388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004388, "uuid": "ef623895-6110-466f-9154-f880f28b7613", "comment": "Malware payload (AgentTesla)", "value": "72b752ac811ea95fdaa1a79b46567330", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004388, "uuid": "2b40ee10-9d3b-4f70-8251-0f046fd796e0", "comment": "Malware payload (AgentTesla)", "value": "9d132e36a9bf5385e2392eaad7e0b9ccbd14242bbcca422b160b61a22c580682", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004388, "uuid": "93d21125-973b-4d25-9e15-f2b975f5a2af", "comment": "Malware payload (AgentTesla)", "value": "0153ac6718f9ccde6c69d97f4db7952d557209d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004388, "uuid": "8677d074-bff2-42e1-823c-3ee0dbf513c6", "comment": "Malware payload (AgentTesla)", "value": "d5a59df27f147de5651a203e3bfe010e0161a7ff6984cccaaaa75326805594590e19b07144a140a9330a068aac27e0c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004388, "uuid": "1fd760d9-f3be-4174-8d6a-f993d9d5075c", "value": "T10D85597CC508401BE1F6E438BE588D8EEC672267B17D2E4C24C75A4B4617C4BBF8A66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004388, "uuid": "07b49f99-07d6-4d7a-9e21-48f02d52012f", "value": "12288:q0hr4wxUjkinFIT42lWN5sCixRg5QCXt38PF4isB:ghiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004388, "uuid": "18789205-024a-4b9b-a686-2ec7bc473db6", "value": 1822562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004388, "uuid": "bfe28fe6-68d6-47fd-b83c-a0258976bbdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004388, "uuid": "2300a65c-705b-4296-b937-c9b0f265a1b5", "value": "output_g7ss7xmq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdaf26f-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009276, "uuid": "e0e21c01-a5a9-4f6e-b66a-3cab9450f324", "comment": "Malware payload", "value": "f3bdb4ce7991f2e8fb934be616c6b472", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009276, "uuid": "ff512595-e5f2-4ea0-bc51-c4b7393f848e", "comment": "Malware payload", "value": "9e4d3722e84c831187d9a8fef40145a97c1c23756bcf50bd708a8e03bb793576", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009276, "uuid": "25bbb230-3cf4-4a45-a011-23ec13fc3e72", "comment": "Malware payload", "value": "91c268ebde408f2c59d98e49f2dadd7c14359f17", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009276, "uuid": "94bcfbe4-98cc-490b-943c-c58df3205acb", "comment": "Malware payload", "value": "9b1aa58e0b0fc684595154955d44df105deed3b075b38297cd031b8604ec15adb3529ce0e43bf1c4714b3b19e3298858", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009276, "uuid": "3f17a913-2a2a-40e4-a1f4-f09ab6ca5714", "value": "T110A5DB285B99AEA445CAB8714CDA2DD1EDC583DAF0B2D4DE72F34EDC781007F90E06A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009276, "uuid": "5f8c7777-9149-4bfe-9ded-e16e6e154f1a", "value": "768:Y999999999999999999999999999999999999999999999999999999999999996:cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009276, "uuid": "1e028da2-6a75-4a28-b201-bcc6d041a6de", "value": 2106755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009276, "uuid": "e487663a-df98-4f65-a4bc-df0f30b4b834", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009276, "uuid": "5b81a637-62ce-45c5-8941-945360c1e2c6", "value": "9e4d3722e84c831187d9a8fef40145a97c1c23756bcf50bd708a8e03bb793576.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4c7238-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966597, "uuid": "bbdeb761-cadc-4041-8d13-fc748aa7ddac", "comment": "Malware payload (Mirai)", "value": "8a1a34c2d232097bc7e1d58e295c2279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966597, "uuid": "cff53359-2d86-4100-9dd7-a4b1086069e5", "comment": "Malware payload (Mirai)", "value": "9f04177030da8125b2a23b471e5027c4ad48bded9f7ff64733051a8ad7f2a6e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966597, "uuid": "d8a73435-295c-459f-8187-55aca8274139", "comment": "Malware payload (Mirai)", "value": "95c07efb6888d1a33c4e2019c181dcdf75452c28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966597, "uuid": "21bf1abf-76dc-4125-9d4d-d0d7b66e854c", "comment": "Malware payload (Mirai)", "value": "45e0bdb2386dbbfc97ff09ced3b66af7bc7a1aa0f8db87ea7d9ac399bcbbd1704a9de156c14c3480412c9bcef4f5efef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966597, "uuid": "2d914364-2324-4967-bd2f-161a82d29982", "value": "T183635BD5E4029E3CF94BE6BE90170B08B92163545A930F2BD6AAFCD77CB306C9E46D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966597, "uuid": "c95c7166-389e-4c8c-8f93-4fa345075e39", "value": "1536:JPoL/1vtkFW8s3ldF3GDrJ6VxsHZa2oUIM8ZG:OL/DgGVe4D4orq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966597, "uuid": "44bef711-8173-4f3e-a22e-513b024571ca", "value": 69584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966597, "uuid": "094f45b8-0123-457f-9403-c11c51f30918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966597, "uuid": "b75bf9e4-6249-422a-bd3d-8b615199c42e", "value": "vcimanagement.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9f92ba-7603-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782989359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989359, "uuid": "c85a89ce-c6b3-4706-8df2-54b89dcf7a47", "comment": "Malware payload (Mirai)", "value": "0e243a96947e26ef2e1c79c900ef5e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989359, "uuid": "d4b687dc-992a-4022-9611-a6cf1ed35ccf", "comment": "Malware payload (Mirai)", "value": "9f244c3ebe4efa5cc3477caa3b5e6bb72f098b6ff566016692d2b2cd30a5a5e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989359, "uuid": "8fb52d84-c314-4249-bbfa-a5d1eab8080d", "comment": "Malware payload (Mirai)", "value": "eceb896637b78eccf01f420ec733a2643605fec6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989359, "uuid": "cfeef189-9f25-4f45-901b-24d4af9f630d", "comment": "Malware payload (Mirai)", "value": "76b30ca41c71d8736eac4626d02fad2b3f7ce0a76aa5e406dce543cc102e7d9a293799addb66c389973ac2f16f0dfafa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "qewqewqewqtq-duckdns-org", "colour": "#B200BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989359, "uuid": "bd314495-302c-453c-ba2d-c2de91046d8d", "value": "T1FFC36C81FAC3C0F1F6934AB10027F76B9A30DD214125CA99DBA27A71EC71D52896F76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989359, "uuid": "8b0ee3e0-f136-4171-aed8-d0e2467d65b1", "value": "3072:RW1KdInaT1R2QobsuUvIzh7me6Pb88ahBqU:RWY2naj2QoYutYI1Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989359, "uuid": "b8a70c72-94bb-43e5-b4f1-5531934189f5", "value": 128092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989359, "uuid": "ac655a80-297d-499e-8efe-5d20a77a2cf1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989359, "uuid": "1e1212f0-a291-4170-bb4e-d6c4161f181d", "value": "9f244c3ebe4efa5cc3477caa3b5e6bb72f098b6ff566016692d2b2cd30a5a5e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f77476-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009336, "uuid": "1691d025-5d07-4865-869d-5f89d09faa9b", "comment": "Malware payload", "value": "7c0b1e3795c9f0d4fd8c8198d9513f82", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009336, "uuid": "bd28d705-3ae4-4d23-ac5b-debab5896fce", "comment": "Malware payload", "value": "a132be0544b4a625c21fc5afb238a4f2b4c0636e11c0193f6820cd4676db34f4", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009336, "uuid": "bb91e5cc-c0d0-4e26-b0e4-9f1874d89392", "comment": "Malware payload", "value": "e34360a3c9a5324c3d59c893216a4e96273231bb", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009336, "uuid": "3d5d6e6b-73ab-4ee7-b8ef-42f26039009d", "comment": "Malware payload", "value": "8cfe3fbc4fdee43d04cc7fda4f22857cb6c2f9d69b2913f50c8bb2567a7187851d0de609281d3bca16393dc9e14877ce", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "scuderia11-com", "colour": "#D06FE4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009336, "uuid": "02191130-4710-4c3d-996d-5fec8ccb2110", "value": "T14E455B70EA1105B7CF827BBCADA90221C679D315842620B0F6DF871D97099ECE77929B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009336, "uuid": "7c339d3a-f68c-4bfb-bc8d-e9d72e24379c", "value": "768:GUymACQPy6IB5UtIbeNHb21f6SAbyoUe4u1dfbvnDkWRAvsGCu0p2tt5MyRHH6ee:G0Q66qEVK7Ad3dRALd0ATRHHpOdbGrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009336, "uuid": "57fcf447-4fa9-4541-bf9e-04df2c5b1bfb", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009336, "uuid": "9db5ce92-e4ef-4486-b675-8a35d92bcfb9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009336, "uuid": "52dc609b-74a1-444b-95e0-551b0d235ca1", "value": "ORDINE.MTV000000000000000000000000.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0d37f3-75eb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782979179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979179, "uuid": "d66900dd-a0c5-422d-90e9-9b1cbf9738a7", "comment": "Malware payload (WannaCry)", "value": "ccd5c8a0773f505c25b754b8863b58f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979179, "uuid": "b6c22595-1956-44f2-bf47-643a3f083596", "comment": "Malware payload (WannaCry)", "value": "a32575ab0959baeec62fd4a7165667045ee10ba8e01b6ea883e4efc545dc65de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979179, "uuid": "7fea436f-ceae-4425-813b-f5f5d991592b", "comment": "Malware payload (WannaCry)", "value": "b2328a12714e7d26bf70a472a1d3a1b0361db9a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979179, "uuid": "57017219-295f-4ead-8266-2873f2830970", "comment": "Malware payload (WannaCry)", "value": "f3eb073b3238d7c108b86390d75a82d5148c93beb591ea6d09ac13f699eaf402e49bf20dde7bd80c8b6a510d3c8d826c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979179, "uuid": "ef7bbaf5-e8ef-4724-891e-4ff712096f4b", "value": "T14136239676AC41F8C1162230D0B74631F6B77CBE21BE9B0FDB908A612D13791BB64F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979179, "uuid": "b3fa1976-a5a6-4db5-a2c6-4ad0a58033cc", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979179, "uuid": "e46cb682-3390-497a-b2ee-e4f8d7e2e75c", "value": "12288:T1bLgmluCti62ybaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D+dSNs5SQe:RbLgurihdmMSirYbcMNgef0pASk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782979179, "uuid": "bbeea51a-b6b0-4636-b1a5-cd363daaa8a2", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782979179, "uuid": "6b7345fc-7734-4b53-b458-2d7f11a4904f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979179, "uuid": "448c4b05-0322-43f5-8694-ec313715de08", "value": "a32575ab0959baeec62fd4a7165667045ee10ba8e01b6ea883e4efc545dc65de.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80f5029-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783015227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015227, "uuid": "7b702fdf-62fa-4e1a-b6cc-2c6639a142b0", "comment": "Malware payload (ValleyRAT)", "value": "86dfa0a74c3f64dc75017ca3886372a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015227, "uuid": "bd2be00c-7949-4247-b46d-68f89e2a514f", "comment": "Malware payload (ValleyRAT)", "value": "a3450b5c06435c10d84d59f7615884aaf9cbac08384a1e244c6544086002a539", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015227, "uuid": "6bf33bd1-0a6a-401d-9d52-08f5c44cab61", "comment": "Malware payload (ValleyRAT)", "value": "b4bd9a1dea4ff5d93ba56745b03a42f0c8bdfbfb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015227, "uuid": "42f48202-fc5f-4182-91cc-4bb038cb2f36", "comment": "Malware payload (ValleyRAT)", "value": "604236d9ad525d9f25ec5496a1a2505ca022dc1665cf3375ee91be12ff73f43aa7e75851ef79ee52b365df827c1727e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015227, "uuid": "15b7a2b5-17a1-47e6-ba34-9a70dda06c32", "value": "T198347C217650C132E5DB0534C5BB8B760AADB8320755D4CFA7E44A7E1E723E2EA3538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015227, "uuid": "596216fe-e864-4a06-adc3-0236529a79b7", "value": "f0e23b81c79b122387dbb66564f1f15f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015227, "uuid": "b4106053-0feb-4fa5-aa80-7e815618c0ea", "value": "6144:In8K25SLDS5iAbT7uw3YjXdUdnpTxBYtwcuSDzxABRM:oR25D5iuuw3eUdnpTxBYacuSDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015227, "uuid": "1075aa33-92e3-4951-b9f9-10c4ba44b327", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015227, "uuid": "30df60ac-df55-404a-94a5-279b234f8645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015227, "uuid": "4f046970-acfc-483d-b6fc-1fa59573b944", "value": "86DFA0A74C3F64DC75017CA3886372A8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba8833f-7666-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783031930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031930, "uuid": "b0d35f14-eaa5-416f-96b4-7d1306c8ea92", "comment": "Malware payload", "value": "2be0da0c4135514667aa947eec3a04d8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031930, "uuid": "d33bc429-d82c-46c1-bd0b-efafc6c31464", "comment": "Malware payload", "value": "a3ade4b9e03e459a5955d68c52f8dbf893ce0c2bfb56c1c8b7415ecfb7ec9246", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031930, "uuid": "5c46fbb5-3f7e-44c3-bcc3-7140f1ab8589", "comment": "Malware payload", "value": "fc48f53b4ada8c3d31cc647562d7a54e28ea626e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031930, "uuid": "0108ed78-893a-4293-84fb-bcee39c2b5e3", "comment": "Malware payload", "value": "914d0a303c7e597fee19320846115d47d41d688b1f6661a4f4087e8a89357b70410505d42d9ff2b7cd9c913a53eff8cc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Mirax", "colour": "#EA30CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783031930, "uuid": "a7515ee0-fee5-4674-b879-7f8cae418286", "value": "T194B61206FB49E96BC0F767764D764122424B4C268B53D3936F58723C18BBAE04F4AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783031930, "uuid": "9355d09f-ece1-4082-a940-540dd990f831", "value": "196608:n3SIGw4+np11yqnmxzbrV1IGOpU+Htk5TLLJbZWO:nj7/11mxZ1I2J7WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783031930, "uuid": "08683182-e68e-49eb-bd81-ef4588a005df", "value": 10543555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783031930, "uuid": "cd388cf4-27ce-4566-bfd6-d9e314edabe3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783031930, "uuid": "edfdbfc4-a874-46d7-bca3-a1d9d1e4a66e", "value": "temp_1781774687144.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8895a459-75f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MustangPanda)", "timestamp": 1782985002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985002, "uuid": "e8f6248f-ebc9-45ac-922f-a7c8e87c15c8", "comment": "Malware payload (MustangPanda)", "value": "7e7b30071565773d480578537ee3b0e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985002, "uuid": "9f631964-bfff-40d8-9a0b-0f24869a41ef", "comment": "Malware payload (MustangPanda)", "value": "a43084f5af861f44c75c5273c779cb26d506cab6b51c33746626da504148a4ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985002, "uuid": "caf0a690-dd55-48e3-ba9b-8c90a3575cc4", "comment": "Malware payload (MustangPanda)", "value": "bca1e295acaacbb19c7e3a7868746f6b772b7b71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985002, "uuid": "60b2c1b4-74d9-432e-91f3-b93c5b683b50", "comment": "Malware payload (MustangPanda)", "value": "be7899f906c2ec1e6ee54094422dd4f027b5c2794dcf738586584149eaae92e5f1f60011b91fd4258f8e667bc93378ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985002, "uuid": "9cae651f-ca92-4250-80dd-56120b4beea9", "value": "T15AC53365A280D443CEC13AFFB31E3D78D90E8EB923DAD452C3B2F41504946D5929DFAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985002, "uuid": "c6c1767f-fc2b-4719-ae1c-4a94eaa967a9", "value": "abdf309354079c85470658074aab02a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985002, "uuid": "7b1edc67-e95c-4c0a-bda3-1ec35b6c38c0", "value": "49152:VQKfaknyDEOVbH6Ygzu0wJuZIPVnJ+II/VC+N3JWi98yDpyS:PfaknyDEgyzpwJqI7+ntC+N3JW9yN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782985002, "uuid": "9dc0447b-552b-4f3c-8eff-da8a8addf245", "value": 2520064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782985002, "uuid": "5985565e-ff1c-47ac-85d0-0f8fb3ee437e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985002, "uuid": "45fed887-013a-43c5-8e07-6f65e6693dc4", "value": "a43084f5af861f44c75c5273c779cb26d506cab6b51c33746626da504148a4ec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac8c456-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972201, "uuid": "98e1f5d0-1bc9-4db5-8cc9-831887730ff1", "comment": "Malware payload (Mirai)", "value": "9d185882b82655069025b1fc972c8b02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972201, "uuid": "067f4b7d-9a58-4298-87b2-996f181c5c33", "comment": "Malware payload (Mirai)", "value": "a50d9f8ba4b17f90e67c2adca074d223b5c8aaafe7661e9eecfa3685d96d1370", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972201, "uuid": "073ce6b1-8526-441e-b183-e695e70870f5", "comment": "Malware payload (Mirai)", "value": "a8f7556d03030ffd8a3bf6f7ae7543e9ae566cb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972201, "uuid": "a85f783d-7258-483c-b8e0-da1c2cf6459d", "comment": "Malware payload (Mirai)", "value": "2727d839a0ddf842581a5578572191530936f7cac62ab803d7d052f273a319f54a0d1eacd8c18b511b25c54f35d231b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972201, "uuid": "a6852f1a-1610-4a1d-a954-cefa39a55f1d", "value": "T1EC5173D922D500302CA1DD3E77B91655BAD059DBF8C59E8998EC7DF4908CE8AB4C1BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972201, "uuid": "f5a8363b-fcbf-48e6-9a0e-9f59100e5559", "value": "48:ih6+6Ch6E6eh6ei6eLh6sRd6sRTHh6X6Gh6l6ah6/K6gh6Q66h6J6Ch6M6f4h6ff:ih6+6Ch6E6eh656Ch6sRd6sRTHh6X6Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972201, "uuid": "df55aefb-a22c-4efd-8b3b-22bcc61133ba", "value": 2689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972201, "uuid": "6f8c50e9-d740-44b5-927a-4bc1137bd735", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972201, "uuid": "f771fd19-54c9-492c-a4cf-32251ccac08a", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75261564-7617-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782997854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997854, "uuid": "a04a3a3c-a438-48bc-a32a-7d99b8336717", "comment": "Malware payload", "value": "2e9154b52e5a2efed54601396d9fcbc9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997854, "uuid": "44ebe9fd-43f6-447f-b3a6-a106c80662e5", "comment": "Malware payload", "value": "a5d8960b42bef15260e3909e3acfe90ea220ac17b6a54c58e24276dc7acbe407", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997854, "uuid": "be02bc35-98e7-40d8-a92b-b65a97cac807", "comment": "Malware payload", "value": "309cafdace744339e9739ad35cde217b2f5f107d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997854, "uuid": "75ffce31-322b-4d78-8563-ca4e98082c96", "comment": "Malware payload", "value": "c0937dccdc5a7f14fff8254d9b24bcddae3ea906d0733b2ed1b2cfcc9b1251e9c70a6091de1d058cf03d31747b615fc5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997854, "uuid": "c5755a41-581d-48e4-862a-a8603bce8281", "value": "T1D6236C6516853C24AE99C4375C7F2F0CB9A983E6314491DD7FCA3CF28C4AAACE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997854, "uuid": "266e3ee3-fd19-4f18-b4ea-4a678eb0f6a0", "value": "768:9r9NyXsZztCK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:FHusZGcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782997854, "uuid": "0c997a49-213c-45a9-87c9-17da42637e47", "value": 48368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782997854, "uuid": "2cd466bf-84d0-44c1-b9c0-5b8014928247", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997854, "uuid": "7d88f39e-a615-42f4-837b-d2c2954cf116", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3561e3f8-7619-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782998606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998606, "uuid": "798b6927-b4a4-4023-8f13-429d69d99923", "comment": "Malware payload", "value": "011b230b55c6289054e28c639b135e3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998606, "uuid": "e009530d-c045-4d15-b2ec-88b321b2286e", "comment": "Malware payload", "value": "a61833673c20df4fdf93c39091fb162a14a21f629096e0e69e54ad97430a0d15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998606, "uuid": "3552ddd3-6370-4162-bc0b-ed86fc847630", "comment": "Malware payload", "value": "51a29da09f17b7c084b937b6a25d2be5fec1a427", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998606, "uuid": "38ac69f0-4c89-4bd2-8854-880d7ba3c46a", "comment": "Malware payload", "value": "6d8bd782474aec4f8e3573b18c0c66f8c53bf3410bc5d7070eefbb11590b4ce2cdeb01b4be87d538c5da8f93a3976e93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998606, "uuid": "d8df1dc5-7c18-4f7f-be50-717b5ee3e5a7", "value": "T146649E5737D84B20DB592AB6C0E7896403E2A5DB3B37D7493B454AD50C023B2FE4ABC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998606, "uuid": "9fbb448f-2509-43f5-aac8-da700388f426", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998606, "uuid": "2b47c621-bbaa-4ab2-b2ff-0d9b558d9dc1", "value": "6144:MJRVRKjUsdiF+VbzAUXpIgoN8egwJFF+vbwp38QvwsmceLBq:MJRrKjBdq+1SLSMFFgb63Rvwhcelq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782998606, "uuid": "1a0da315-9147-4c99-9065-3c1925da2e12", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782998606, "uuid": "48c922a2-fa54-49ae-b3d3-8fb2a864e17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998606, "uuid": "7ed62b9c-22b9-4a1a-ad2a-e896a6bdcbad", "value": "Gelonari.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8360176b-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988429, "uuid": "efa9b13e-455a-49f7-9306-79fcb700a48b", "comment": "Malware payload", "value": "1dcc7efe3f7e82e9b0e79f005386a3b7", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988429, "uuid": "4dd16f0e-2cf7-429c-ac7c-7c5cc2d8410c", "comment": "Malware payload", "value": "a64014a663082c0dcc8fc3360da018187aad18404329fd0293bc3fe1028c83cc", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988429, "uuid": "20059dd2-8c21-4da5-ad7a-30339a3d8ab5", "comment": "Malware payload", "value": "0bd66f383355b9268d5c2c511d7b7f674b3ed556", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988429, "uuid": "e53839b3-8655-4ffc-872a-bbbcc0cd5fb9", "comment": "Malware payload", "value": "c2ad048a827af87855aa796399a24b0241bcc9934a451f6187cf688f3e8d2535781d427393145fc6db7e58917fc7cf80", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988429, "uuid": "aa6919b2-c5be-4020-a2a5-8aeb3d0bdfd2", "value": "T1BA25E01AE9116579D4B3A0B1520FD376CC78AA34426388CBFF1E6D68A5362D09F3C35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988429, "uuid": "f7ae0f76-c75b-4b24-b445-30b61100b0fb", "value": "24576:h/cZLpHt+FUSzA69TaRQDf/xBe67RxSdib5YqEVj3XYVuywcI8Jk:h/cZLpN+FU569vDXe67RIkbOqEVLYV03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988429, "uuid": "ec685032-aa10-4eb6-a0c5-82632456a603", "value": 986055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988429, "uuid": "bb37913f-acc0-4773-b586-99a144a14288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988429, "uuid": "653c8803-4e5c-429a-8d08-e7f74dc7502f", "value": "a64014a663082c0dcc8fc3360da018187aad18404329fd0293bc3fe1028c83cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b50132-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010654, "uuid": "a1f77228-8dd1-4946-a3af-e423a335c932", "comment": "Malware payload", "value": "9e4329504365602cb6ca0c6d4c1dd66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010654, "uuid": "98976f46-0462-452e-ba66-94279c111a50", "comment": "Malware payload", "value": "a65205ca49ac9a4308981ef7de0d1e5f834741ecfb6f5f2196f2ede18fc0a1cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010654, "uuid": "7f2a7af9-8f0a-4f1c-98d6-912a4f7c1528", "comment": "Malware payload", "value": "bfee79725d2e6d9abc05d5832d401da8ca61b2dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010654, "uuid": "aadaf92e-923e-46e6-989f-5afff2b058db", "comment": "Malware payload", "value": "d39502bdab233d4618eb7d42302fa95868f83b4fb98ef2e43f342e3c2c32f1f737e5e747638fd20a1b0b44ac4015e553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010654, "uuid": "e5ac1f91-5662-442d-b577-6c30a3c0f19f", "value": "T1CEC73366635CE962B843E53C3429182B185B25E9CE5EA033EE117771CEF6E26CF9C503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010654, "uuid": "ff14c34f-2ff8-4078-8c97-3fafef0e4136", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010654, "uuid": "72d19ecf-6670-43f9-9c8a-d57f4a97db36", "value": "786432:7wCGktGZCRQpxq1nXz9V7jxbJUCKV+eXRtVz5RgRFJ+LzPdeh91siT/MglHy7ihp:7wCFMajTxdUC+Fz5RgXJqJeRjkglS5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010654, "uuid": "7d8dbe8e-b78c-4e55-8369-4a8f5b975370", "value": 52736544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010654, "uuid": "2e1c6ee8-8ac0-46ab-9aa4-4c466a5166d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010654, "uuid": "1fd19420-91cb-445f-9b9e-d41aebdce791", "value": "yuanbao_2.72.0.613_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159c3c6e-760b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782992540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992540, "uuid": "480ddd8d-6de8-4e64-b17d-04eaad31924a", "comment": "Malware payload", "value": "6cdc339c85fbde7c394c2c92ed8dc96b", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992540, "uuid": "7b0f5833-2d07-477e-b7f6-c9d0df807d41", "comment": "Malware payload", "value": "a7ed7621080874c1e226891baa8c5c43979dba24acb715c098f8e9d915591332", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992540, "uuid": "95c85f52-1a12-4ad8-aa37-c56363179252", "comment": "Malware payload", "value": "0f7a4a631f4579a51aa8e5a5243e4d09ee71c1a8", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992540, "uuid": "bbfdda1d-d65d-48d5-828e-a1a45b6e5288", "comment": "Malware payload", "value": "7b7a98ec7c7fe03632d4a3e11016b8fecac0e0ed137a7571655ce3cd3a8519d479b21dae96871dda76f96538b941faab", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992540, "uuid": "025c7932-f4e5-4559-acd5-1969904ddf94", "value": "T188D184E29E472E8E775165EA08EC6AC5297F17CF289100DD0D7BA786C32CED458C2D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992540, "uuid": "e185acc2-3164-481d-883f-3b1dbe65023c", "value": "96:/gTyjiZO4fDERmw0tN6rCWIxKLsVYIjp+K6EqLlFLplqvAgX9ZD8dM8:/OfZO4D3tN6rCZgLsVYck5plq1UO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782992540, "uuid": "d8712653-640f-40ad-83e2-f4f5e3c70930", "value": 6184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782992540, "uuid": "63da5d02-038c-491c-a580-aec1a05e6180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992540, "uuid": "0bea2995-8957-4d11-badc-2a15feca06b1", "value": "Beleg_1170887_208021.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc1509f-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987879, "uuid": "6d82b96c-00cd-484f-99e2-9cfafaae0641", "comment": "Malware payload (Mirai)", "value": "d4adf10de00ada0efab198f27a7f3195", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987879, "uuid": "033adbe0-eaec-43cd-b82f-ecd223a3fc77", "comment": "Malware payload (Mirai)", "value": "a8f5ba7316250813f9989e7aa176c945c1b6e849f0e9940121459daeea3510a5", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987879, "uuid": "b6ca61a9-98c0-4e1e-859b-85bff16e7441", "comment": "Malware payload (Mirai)", "value": "fbf110ac83843dd6a349c19c915895c438751dd3", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987879, "uuid": "ba85c1e5-4f31-4fb5-a50e-8d529c13f27a", "comment": "Malware payload (Mirai)", "value": "4a9ca90a453c3a49d2ed4374a50d914c3e3eb13c54164a9a1e2ccd45baf65790227c81159fc7c0683130f894b81add0a", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987879, "uuid": "83247d0a-bc00-4ff0-91f5-ba988f2f2802", "value": "T19A258C5AF2F330BEC067C030879BDB726936F47451222D7B21C4DA352EA6E641B19F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987879, "uuid": "6a66e69c-53da-4638-84e4-d623e217d220", "value": "12288:i6GrXy/w5WsYLbZ0v2mQYctmISGEzs9myut8tAae5kY3DlhqyF6:zGrXy/w5W3+v2mQZXSxzLutAaMTlhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987879, "uuid": "b09fa291-003c-4fbd-b943-ce6e4fe1f1dc", "value": 982760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987879, "uuid": "2615b676-4ce0-4633-99b4-f80feb4e8cb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987879, "uuid": "3de5f39a-87f1-4cde-a455-d7746ecd7574", "value": "a8f5ba7316250813f9989e7aa176c945c1b6e849f0e9940121459daeea3510a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98200b7-75b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782954160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954160, "uuid": "ba88584d-bdb5-4abd-a5e6-791e20bb99a7", "comment": "Malware payload", "value": "7673b3d39d0fa353cdf717120badf2b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954160, "uuid": "f855798f-abbd-4109-8224-b42e18bc7c0f", "comment": "Malware payload", "value": "a97f44445fd3a18c35cc268d6e4f89673d460714406a9776f7c39060b2827f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954160, "uuid": "8b80f6d4-8067-435f-bf54-0a6b8b603fa1", "comment": "Malware payload", "value": "f06813fdbdbaa2189c85d141dfe5f901dcd2e5cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954160, "uuid": "296fa7e8-376f-4927-a68d-bc6a70044991", "comment": "Malware payload", "value": "547b244a5f24da6cca4d5b30e9d37f28af561d7c6abb9abc7eced7f3bca4d14ee8e7d2fd8a7a799a5dc1feeed1b5b6c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954160, "uuid": "39e2cde2-f1c7-4892-93af-d4db3b00282b", "value": "T120D35D17B5C1D0FDC8D6C1B88BAAE126DA32B42D5234B15F27C46F262E5DE206F6DB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954160, "uuid": "bfaccf72-42a4-400b-80ec-1b3358a385ea", "value": "3072:MkFIef3bwwGil1P/Wpb1EAdqXxHMc/OH1P9SmJsscA88:yE2R7hxHGh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782954160, "uuid": "7372811f-d693-4866-9c9d-07f16148208b", "value": 141512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782954160, "uuid": "226f31a8-66e7-4987-9848-6b4cb9d5bc55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954160, "uuid": "4f231752-9257-4f4f-b19f-f5439a739454", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbe8799-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782988423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988423, "uuid": "bb457f1a-9068-4076-a433-599c31d05bfe", "comment": "Malware payload (Mirai)", "value": "f470d3c03ef7a4d62346173bf064961e", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988423, "uuid": "a87879a8-c33a-4d2b-8cfa-b099ca8322bf", "comment": "Malware payload (Mirai)", "value": "aac85b7ede24b51965c82652b327a01b45580bd34afadcb161e81ec9b8242cab", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988423, "uuid": "83b6b07c-9386-4d80-aec3-7f64119d82fe", "comment": "Malware payload (Mirai)", "value": "af6bfdbacfd41a93052e5e04af76b949cbc4d2af", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988423, "uuid": "86ee8dbb-f81e-4e20-9615-6304bd0949cf", "comment": "Malware payload (Mirai)", "value": "96ac4e1e7bfa6ec1ce86fde288c3d7d804c2855189cfd6fa97744bca2fc9a219038b10420d16e4117f83f59a79ba9fda", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988423, "uuid": "6b5c79e7-e874-4f5f-9f6e-c05218b4e911", "value": "T12D357C06EA109679D1B2B0F0564FE375C8202A345123485BFF5E2D68B63E7D1EF293A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988423, "uuid": "9aa5bbb2-3725-42c4-ad65-3b5131520d9b", "value": "24576:BZ6D9sx+tzraIG1hABz3FhZspGvTw8VRdwY+G4x2G:D6DWx+tzaXAx1A8GY+Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988423, "uuid": "b3d4a27b-bff0-4b4c-8ad1-4a2272dce616", "value": 1100360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988423, "uuid": "9d31a2b0-f077-45ca-a5ee-645dbb77f8b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988423, "uuid": "682a55f3-c53f-49b0-81f2-51424a19f578", "value": "aac85b7ede24b51965c82652b327a01b45580bd34afadcb161e81ec9b8242cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d0170d-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988411, "uuid": "7556cae8-1d33-4fa8-b427-6e85a3db02ec", "comment": "Malware payload", "value": "e9e35efddb2257f5693d1e25f0f5d401", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988411, "uuid": "ab3325fc-372d-4458-882e-d023d4bae82d", "comment": "Malware payload", "value": "aaf41779b2117a5fa8f2d23e10db0dce3a04600f53f1852e8b28a3b16557209b", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988411, "uuid": "3d819114-0b07-4da8-b3b6-f3eef7c86dbf", "comment": "Malware payload", "value": "0ad4d30c8c7a75c26c7c9615e0d6c4cdba88b471", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988411, "uuid": "c85979b7-8b31-4f4c-9e9d-dedc30c1de3b", "comment": "Malware payload", "value": "7daf5eecf67e259568ea93c4b30bc23f9626b695a42d258f468ff7d333e07b59db297fab3be9cd0ef8ad12aee5b01c15", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988411, "uuid": "18656648-320c-4fce-a71b-57a1001861f2", "value": "T1D6156C06EA0155B9D07271B1524FE336C8686B358527488FFF5A2D6CEA3A2D09F3C397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988411, "uuid": "2c00df36-3e2e-46a2-bbcd-a4014cfecb34", "value": "24576:901Vg3a65Bk1DT7HlU8de5V1pMcUxkUnjZOh:O1sX5Bkd7Fhde5jp0xkUn9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988411, "uuid": "9ae1df5e-0930-45df-82b8-000beb0d8f3a", "value": 883248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988411, "uuid": "94dd0e80-6e26-4ee1-8c5e-5140094fe14f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988411, "uuid": "cbbff2d1-ef0a-42ac-a772-7846bc21f265", "value": "aaf41779b2117a5fa8f2d23e10db0dce3a04600f53f1852e8b28a3b16557209b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5739b22b-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033452, "uuid": "c3763adc-49a7-4368-a9f0-faa79f29dfdc", "comment": "Malware payload", "value": "1340cbe4d918a9c81f264b4c311b585c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033452, "uuid": "a173b748-1367-4c6d-90b6-d6aeb16c1bd4", "comment": "Malware payload", "value": "ab53eda5b03e2e4420963e35ccf3e165380be9aabb86f2bbf423e135733157fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033452, "uuid": "ff7b66f5-b11c-4b88-824d-931379cb1aaf", "comment": "Malware payload", "value": "2143123dfc46d38976e73c15b98938ff02abae84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033452, "uuid": "e4b47d90-e84d-4950-826c-93962cfa6dc0", "comment": "Malware payload", "value": "75a0bca246a0212accf9993eab2eda1cd82b617d0b009da0ff47078b3c17f5c4ce13dd2dfad6b21f9be5bf51eef25d86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033452, "uuid": "6b524256-2448-4c6a-87e0-50a662a34aae", "value": "T140C3F185BB6369D1C1A242BDA4C00AC387916E318FE313080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033452, "uuid": "e9854f3a-e290-4e8b-856c-18e9aab17585", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnK:0OCDjXG9qTWywxlxTnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033452, "uuid": "e2d5bfcc-83a9-44cb-99fe-3e883aa2a050", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033452, "uuid": "48a1dfcb-9ecf-49dd-ad98-f2c7c2c940b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033452, "uuid": "1c354c5c-95a3-4e9b-9470-9e71331f22ae", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3788af-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783004525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004525, "uuid": "b1667c69-bb66-427b-841a-77a995c139e5", "comment": "Malware payload (PhantomStealer)", "value": "ca465e8a45332df121ce3b670bb3d414", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004525, "uuid": "e15803a6-089b-4339-bc40-f564ffe50dd0", "comment": "Malware payload (PhantomStealer)", "value": "abb70070bbd18b038206ee8ab999a87f532dfed7030a1114454fda01bcaf1749", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004525, "uuid": "8d03cb74-20dc-4f82-b4a5-e5e25228bda7", "comment": "Malware payload (PhantomStealer)", "value": "e0485c03d3570701b3449d487450b8b117d13ecb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004525, "uuid": "c041fbcc-5b0c-484f-9416-fed3d21c6010", "comment": "Malware payload (PhantomStealer)", "value": "e2a0b77806ccfbae8fe22c0584e727915acada3b8dd069cdece8ba0314fcb99c16ca9e3553bfe143ecc5dfd2eeab0898", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004525, "uuid": "9f2cc140-c6e9-4ac2-afdb-bb5357909baf", "value": "T1B313868D3EC3A0924352D07F3E2BF5D9F1AE0CC5765880C9F675B44AF8A8B18D936658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004525, "uuid": "c9abae0d-3fe3-492d-bd55-fbdf59672748", "value": "768:t/ibV9ATKPTkeZ0Aryg3dqwBUVKeaHKZpZ38wGd8p:librgKPTk+fr5lBUqHKZpZsJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004525, "uuid": "fd9a3852-1cdc-4ae2-a5ab-cf860688fed8", "value": 43767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004525, "uuid": "526c0853-6c60-41b6-baf6-f716098528db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004525, "uuid": "0bb4f216-7194-4ad8-87cf-891b8301acf8", "value": "NOTIS PERINGATAN BERKAITAN KEGAGALAN MEMBAYAR KESELURUHAN CUKAI TERMASUK PENALTI DI BAWAH AKTA CUKAI PERKHIDMATAN 2018.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ee3aac-7610-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782994869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994869, "uuid": "9b9b06c5-704c-4c49-b0fa-d63c0d092335", "comment": "Malware payload (RemcosRAT)", "value": "9a4aa9f4b963c65a19f8e12b95b30600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994869, "uuid": "640e5cc6-2598-482f-a076-a8dd9ed269bd", "comment": "Malware payload (RemcosRAT)", "value": "abb74c6d537b8787196ebc93b38672eccab4812b7bb27ac00be73377bb08e92e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994869, "uuid": "7c16cca4-831c-4dae-aeb8-fa8c218f859d", "comment": "Malware payload (RemcosRAT)", "value": "927b9593873e8e3dcfbfb14a78992b847b0dc0d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994869, "uuid": "e8ece239-2bc3-499b-ab28-43591f77c853", "comment": "Malware payload (RemcosRAT)", "value": "28007d3fa4ca1ef349e3ffa939a7c6a01108ebf95e17b32b54fdf27494c7be71f4e6ddd86f6935881f217152e4d7d4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994869, "uuid": "887609dc-cbbc-4776-a55e-14d0a5e3021a", "value": "T15402AC98EED68BE56F5C471B8579C260F9AE53214861773F710C3384AB222CC8F8F158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994869, "uuid": "c7d7bbe6-2421-41e7-8599-0c7c01a60ffc", "value": "192:FpcbHyScdZ8E7nWHQ+v3tm3fndv39nn/GKyLE3+KJ3zY0RbugIwrJr2lGBpuQHrL:FSbHyScdZ8E7nWQ+v3tm3fndv3Vn/GKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994869, "uuid": "7472037f-358f-4601-99b5-67d6266b0896", "value": 8987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994869, "uuid": "b4329dee-aa2c-4f86-8331-2115122de1c3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994869, "uuid": "75be64c0-54a0-4d58-b016-0f6db9fc7d36", "value": "wegivenebestthingsforbetterperformanceinthislove.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7565a126-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782988406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988406, "uuid": "7843800e-9a91-4eb1-8fa7-c7d053474107", "comment": "Malware payload (Mirai)", "value": "8bf92e6f3589bdbc64ce0cddce4c4932", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988406, "uuid": "e2ecb3fe-7007-4321-a74f-68a093d0a006", "comment": "Malware payload (Mirai)", "value": "abbfc70efb3bb24261417379e80367e31d7e1194144008177217b71cadc9520a", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988406, "uuid": "88fd7247-c89d-4a8b-bddf-ab0e9e01d3f2", "comment": "Malware payload (Mirai)", "value": "5d9f020c0da91d4e6b9147806bfa82328e73272b", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988406, "uuid": "be3bd1a5-781e-4258-ac26-bbc0a1c2e601", "comment": "Malware payload (Mirai)", "value": "4213c1c6dc9eb2f13761e32cea7589ff09e8ce4c95f977d992ec7d32559574c113b9b1f83c66349677bc1717a674b72f", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988406, "uuid": "bb5153bf-8b7b-4a76-8574-eca9450751b4", "value": "T195357C06EA109679D172B0F0964FE375C8202A345523485BFF5E2D68B63E7C1EF293A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988406, "uuid": "7d9c2cb3-6d71-4716-8c48-8b9e8d1d7619", "value": "24576:YoCeMCqJBR+dOD66ZV/1rBzmyxpxG14TQmUv4yAPm+FVefw:mZCqJBR+dODZp1rxhEmGAPmyeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988406, "uuid": "5c1ad4ac-713f-4c03-b794-e31b783e4158", "value": 1100360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988406, "uuid": "faa693a2-3717-43c8-91ea-b94d4cbd0013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988406, "uuid": "0e675de2-032e-4f77-bffc-53be3320ad90", "value": "abbfc70efb3bb24261417379e80367e31d7e1194144008177217b71cadc9520a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a7e182-7615-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782996813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996813, "uuid": "dea1e0a1-db3a-4e77-91a0-a081de2a771b", "comment": "Malware payload (SilentNet)", "value": "4d3325ba25230498a160dc6c27f20451", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996813, "uuid": "719d2d77-bd90-4a8f-91fd-5756175e811d", "comment": "Malware payload (SilentNet)", "value": "ac5c2116cb986c659d5bcedec4504564240b1ceb8573154860b62ab86b8f9cfc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996813, "uuid": "36fd861b-8075-4eda-a4dd-74a978716286", "comment": "Malware payload (SilentNet)", "value": "cf5b9d3a4fae23edfcdc76734697f6186ea706c8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996813, "uuid": "098f0ae6-931d-4afa-8248-ffa777ba7730", "comment": "Malware payload (SilentNet)", "value": "baf484ed3d18b27ec026b582f266476daa5bc788784d5e93dbfac0e303c04ccbf767fbd774af50c7f4d3104c604c9b42", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996813, "uuid": "0e52e402-95b0-453d-acf9-5bc1389d0c10", "value": "T19AD533EA76EDC53AC0EC1FEA6C07DFF5270AD91B994882C6851F57044718CB826217EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996813, "uuid": "9df0d949-ccbe-41d6-8a5e-0d35ca33fe13", "value": "49152:gkRod9b9UbwA3NVhmQlNB+kp1OuQ20KLN/PC/QXLUfSPkQgv4ZZLrWeHsqFMxN:7KWbPNikNYkp1bQ4I//bHcHWeNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996813, "uuid": "152085ed-87a9-43a6-a5a5-6baa37f31d94", "value": 2906601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996813, "uuid": "3dd0e496-3e02-40f8-9fcc-f54173d1f7c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996813, "uuid": "985c5ead-ef1e-4c0d-b24b-2e6462e50b9e", "value": "Prestige-1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171711af-7632-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009293, "uuid": "24489314-6673-4593-b7d2-d4ed5d51aad2", "comment": "Malware payload", "value": "4510268acb6e52e4cf036ae90caf9066", "object_relation": "md5", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009293, "uuid": "12ba2a81-cfaf-4ab0-a43b-f97c76a50e7b", "comment": "Malware payload", "value": "acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1", "object_relation": "sha256", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009293, "uuid": "182ec696-ec62-4cec-8e88-7a0ce1f8d655", "comment": "Malware payload", "value": "06ec04ecba5a4b3826c05bf68dfc086b5267d7ff", "object_relation": "sha1", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009293, "uuid": "d13ae2f2-17aa-4d59-87b1-e165a8641a87", "comment": "Malware payload", "value": "2dc959bacaec7ac29525566f5984f2ee1110eec98b8a6299e756b4d1c89a9f00cd3f52048b5f3c9d73877b849b20c0ec", "object_relation": "sha3-384", "Tag": [ { "name": "38-224-110-3", "colour": "#B6438E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009293, "uuid": "4a2e0ddf-ac9a-48e9-9024-ced8394c76ae", "value": "T15CC508BF9E518968D4704669DCD50FD99691D835048AF89E3F7F81F0BA30A662C38CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009293, "uuid": "a7c7732c-821c-401b-bc8d-b95c276b6b76", "value": "384:SnmFu3Sc4B/n8YogfT+6n3nXn2sta0nXCn9nTnWnwQ/haJXnXnWLnxSSnBXNW4Jl:eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009293, "uuid": "50ae7df8-5b3c-497e-8def-f6d1d88a58e9", "value": 2628131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009293, "uuid": "994c6929-5d73-4dda-a4ac-3bee50cd3c20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009293, "uuid": "020066fd-ce16-41fc-a8bf-e4391325cda8", "value": "acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bc2e73-75ad-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782952186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952186, "uuid": "5c6459a1-1c07-4c88-bf48-015a7d83562e", "comment": "Malware payload", "value": "c9ed874a9fc5510a22348d0e10d1eae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952186, "uuid": "29592b51-8031-43b4-9f1a-39a64106a441", "comment": "Malware payload", "value": "ad0a8700ca705ec2d71c7951a3e4cad8b84b0a03b361d8f05dfed7b77ffce8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952186, "uuid": "e1bc3722-80ba-4b30-9a43-cc877bf26605", "comment": "Malware payload", "value": "407ff2d45d86ad42071c49619774815c00c0dba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952186, "uuid": "100d4d17-9d3a-4fac-8deb-a78b31de1606", "comment": "Malware payload", "value": "2f569ea19056e4784d9a4588a348bdfb6ef1c947386507de7e86c4f3504342bd4a6c865500ec0f2618b5083ae62beafe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952186, "uuid": "973b7cd6-70ee-428b-9f74-b2d1eadcc75a", "value": "T15904C71A9F920FFBDC6FDD3702A90B0635CC555722A43B363674D928F54AA0B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952186, "uuid": "5902dcc8-8375-4d66-a91e-95621b3d4b74", "value": "3072:JaRhGQd6fzirBrwkQk4jNWYy1oma49zCQZpF:JEhB6fXkQk9Y9xszd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782952186, "uuid": "e2e4c1c5-65fe-4578-8f6f-c21534f2e659", "value": 185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782952186, "uuid": "e50f327a-ae47-482f-b239-fd1b4520f8f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952186, "uuid": "7b36ff08-097b-40fb-b28d-12ad689f576c", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab459969-7637-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783011689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011689, "uuid": "715cef12-72ee-4007-b230-4675188b0568", "comment": "Malware payload", "value": "f8d0e619198830bd06a4c26fd837ea85", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011689, "uuid": "5e812df1-1eef-465d-80eb-048e2fa80a20", "comment": "Malware payload", "value": "ad30ddcd3cada3e386b52ecdc5b01668c0b1164dbe8f0aad9dc0e2bca51bc497", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011689, "uuid": "079072ba-222f-4404-a19b-5b341ec1ee88", "comment": "Malware payload", "value": "d347a470ec477944bed575f14a602f3cf0fe882d", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783011689, "uuid": "6aa06706-972c-4dfc-a72c-f7496b8ef8de", "comment": "Malware payload", "value": "a0f0b9d87159937af3d4d3ce0d106f4d7435f7fc76017cd04366ce78cea34a4fcedb2c9131e8722e742acd80ffcb2f61", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011689, "uuid": "b0c7a848-c46f-4056-9510-3e1e90922856", "value": "T1F9C47C5BB7A007F6C8EBC270CA4B9723FAB2F54925246B0716A0D9661F23B315B3D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011689, "uuid": "b223e968-4a10-41a5-a334-a20107610fc0", "value": "6f1cb7c2f5223366d046d9d5b75129b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011689, "uuid": "4355d771-cdb8-4e96-95c5-0a6402349394", "value": "12288:unS5yScL4A+q/0uzwRko6xpAHVwAzXZIicubBetF9T/VIl9s:bcL4A+q/0ucWo6/A1wricCY1T/+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783011689, "uuid": "0a11246f-25f4-4768-96fb-d0f7bae7a153", "value": 589608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783011689, "uuid": "2e576dea-2708-4d58-b8b6-fb04c37bf6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783011689, "uuid": "4e28e8c4-1202-4822-a2bc-772237cd90ed", "value": "SCNPST64.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0104d2da-7651-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783022570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022570, "uuid": "76700046-4c25-4048-854b-0a951c792cdd", "comment": "Malware payload", "value": "2237e6707dbda4bba0b1943f2334efcf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022570, "uuid": "ad913120-b885-48b9-9776-56b9232a5854", "comment": "Malware payload", "value": "add9ff4b6e73395939d91d9956fb79aae3ccf42522e8b5954d20a59f7f70ca5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022570, "uuid": "28fd7c73-b1e2-4cfe-989b-bc3d37ff2e96", "comment": "Malware payload", "value": "4efa26973a90c236a064db737909bbc97ad5b3ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783022570, "uuid": "b66d51b0-e629-4e46-83a4-3074f527949a", "comment": "Malware payload", "value": "d69e8c3412ba0fd5234050f0ccba30d0bff3d4d069bbde9e0818ce5f35ddf7756ece0c2c77790971c4391bbe7c3463a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783022570, "uuid": "5558b4a1-3469-4b22-bf38-6c3e21c73ac4", "value": "T1A8D097B2C3B301B010E10454F0C76480BA19C7BF8C86C22CB93B30710F21B4AF4C2360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783022570, "uuid": "1f01cef4-c289-457f-b8fc-717f15ba41e9", "value": "6:hTwawF6aFasUFxvAulNXYq9DG+NjVsNXYrkJ:Vw7FXc9Piq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783022570, "uuid": "c163787e-aa6f-420c-ae5f-f411bf4043c2", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783022570, "uuid": "94f00402-117a-49a1-929e-295dc520494f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783022570, "uuid": "277824e2-afe0-49e4-be73-1e0d3951a9d6", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4116e84b-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987888, "uuid": "401cbbdb-c2ac-46f4-90fc-a07485f57339", "comment": "Malware payload", "value": "87680e46475a7c68a05f3550824b0ab3", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987888, "uuid": "c02478be-7109-432e-9d90-3743b6660000", "comment": "Malware payload", "value": "b0c671fbd0aee71fe1bca46e5c2515aad12e0a2a9739d8741815b8ec7cc8c84c", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987888, "uuid": "50b675dd-aa99-4e30-9e0f-917ac03e961b", "comment": "Malware payload", "value": "12cca0762764f6894239fffbe79658c98f156188", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987888, "uuid": "a94d9628-e1aa-4415-baf7-d930aa45178b", "comment": "Malware payload", "value": "f2f32e5b937d2247c0afaa8fe9a9e5887da5b073099594d4b7593a0b551f14393a962c863860f36271e9ddc5e9f67ab4", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987888, "uuid": "3606c756-dd68-4965-8a05-eb8861c85363", "value": "T178A5121AE9126479E07360B2534FE37BC8346A34551789CBFF6A2D68A53A3C09F2C357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987888, "uuid": "4baaa8ad-93c8-4fc5-bd8b-90b79b3f423d", "value": "49152:mh0g+/CA6dmRGsyhTT2arZOrbOz8vOIVDlmtjHdibPcJj0n:mh0RqXmPyhG4OHfGIVDo9dzJj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987888, "uuid": "a654182e-0ad6-462d-a81c-4ae03bbb472a", "value": 2214902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987888, "uuid": "cc624414-850c-4f0f-8551-66aa8a552f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987888, "uuid": "37c5935e-93c0-48d0-aacc-66283bb5ab61", "value": "b0c671fbd0aee71fe1bca46e5c2515aad12e0a2a9739d8741815b8ec7cc8c84c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee16826-7625-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783003749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003749, "uuid": "9749e455-a62a-4a84-9270-c76ba4580c93", "comment": "Malware payload (XWorm)", "value": "43ccdf2bfa88da60a3d1749de3b3e96b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003749, "uuid": "6cfdf48b-b4ac-4dc3-96c4-81a09f45adcf", "comment": "Malware payload (XWorm)", "value": "b0e2c4681aec46f67080b3793f3dfda2b694d418037ab5a1e4503f5e89e67401", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003749, "uuid": "b05395fd-4a29-4e32-9a53-0408c7a675d6", "comment": "Malware payload (XWorm)", "value": "9267242154538d402b36db6b36bc2571727df7a5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003749, "uuid": "f3d37a01-c1d1-40e3-a11d-34cf808f5f05", "comment": "Malware payload (XWorm)", "value": "6b414ba441aef6bec9b05e9d8ec92222661ca970481c60030080c6821b8ee3b2e1f170fa36d3f5af32ed17e2b9091a35", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003749, "uuid": "387526b8-068d-448b-b9ed-73e6ce135f41", "value": "T145D2E8C3CEE2ACFE4CA45980FDD9E36A383011959CDC4FF5F5A4541A9698CD903ABE06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003749, "uuid": "2e4ee347-20e0-4ad2-96ee-3fe0cfcffc9b", "value": "384:F3gZEtqworcTHw4Z7xLJ4w0qsHuH+GkzR4oS91Y83npqPpPfqB6qGi4QM5r:F3khzTzRuRBGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003749, "uuid": "58b1359a-5eed-423c-a4ec-bc36a76cc026", "value": 31110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003749, "uuid": "5ccb4c8e-cf54-46ab-aa0e-69b4cae778ec", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003749, "uuid": "a0d17d57-80a6-4e7f-acdf-ebf0500625e2", "value": "RATE QUOTATION - ALL PORTS - EXPORT - OCEAN FREIGHT .docx (1).hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc5fc7a-760b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782992901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992901, "uuid": "6dd98840-d94c-4b90-bb91-351152a7425b", "comment": "Malware payload (SalatStealer)", "value": "d8249352b400ff101c4598cd08d2d9e6", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992901, "uuid": "661be050-2d2d-4746-a147-3f7a0c61e1cd", "comment": "Malware payload (SalatStealer)", "value": "b177b510a76386fddb69800592dbb85ccf5d1aada1059b721a061189c92300e0", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992901, "uuid": "af77914b-3704-44e2-956e-51c256b69df0", "comment": "Malware payload (SalatStealer)", "value": "501efd44aeb1f6827dbc83c2d84eb6be1171a41e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782992901, "uuid": "39e43d9a-befa-45bd-8265-3f6968787a63", "comment": "Malware payload (SalatStealer)", "value": "f673e291a3370fc82645f5a1e03300ba73054a8be3b74bebc7105a01fb763b316e21d36d1f6e8c8917f54471b910bc13", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992901, "uuid": "db576b22-7955-4a18-8ca1-812079c6cb6c", "value": "T1CF578C7FC13B0827AE9B67C58C591ACADC4CE7512710646976AD188EC728EBFC0E1637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992901, "uuid": "b96e37e4-068c-4313-82ac-7756032c5fa3", "value": "ee29a029938ef70319a6cb9069f6d61e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992901, "uuid": "101a2bde-b3f9-4b12-bcdb-82a76f22cbf1", "value": "49152:eiKcxucczKoKYelA4b4iSWapQLESyviz/qM4v2UXT1Vwj0HFrGyyIfn0j43Y7cHO:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782992901, "uuid": "0edcd676-5369-44cf-9e0a-8d00d7bcb9e8", "value": 27312048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782992901, "uuid": "0d3a8bd6-2d1d-4e4b-9ba9-8d5117cc8f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782992901, "uuid": "21a0155d-19dd-4e34-bd5c-d541bc8fa0ac", "value": "Loader 7.1 BETA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95a2648-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972199, "uuid": "ba22c9d5-e0ac-4e03-8de2-53a5bbb5e651", "comment": "Malware payload (Mirai)", "value": "4692fec67296cacff1a936024bdb6e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972199, "uuid": "30c59a5b-5e32-451b-805e-f2b7a923fd9f", "comment": "Malware payload (Mirai)", "value": "b26fe37dac6d5d5ba5dd4cd7f30a45b211307debb833db99532e6f3377b7e811", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972199, "uuid": "0c4a23b6-09d4-4c2e-a0d9-5047fefb8be1", "comment": "Malware payload (Mirai)", "value": "5c153d8ef6107a1795ed815c0c6bba983d14653a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972199, "uuid": "3e8c9cf8-eda9-49dc-8f2e-bbfd2bd234d0", "comment": "Malware payload (Mirai)", "value": "421666bf12923048275c1a122703c22172966d875043b7ad1c259db3e84ade2833e1140afbc492461a54f047c87f3758", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972199, "uuid": "bec6ef19-dc39-4249-84e7-5fa6942a64bd", "value": "T117832A95D9B2D8B8F81108F0307BEB17C271F8A5866FB543E7A27C65DCA6901BA05F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972199, "uuid": "fe8e5947-3ca6-4fd0-91ea-961a9cf93ac6", "value": "1536:k6dopMhn5SvciBCBqunTK5e4Gc1kNCvAL7muTg:k62KhwUZguTKQRc17aTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972199, "uuid": "9882c7d5-2f7e-4c01-be06-93360132f33e", "value": 87244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972199, "uuid": "25fa80b6-4f6c-4bc4-82b1-fe0e3e8651f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972199, "uuid": "e78f458f-7e80-4992-8f44-a72b3b37b920", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf13eca-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004498, "uuid": "187636ba-42a3-4b84-9084-63aa0af54a3a", "comment": "Malware payload", "value": "9ebefe839b6ddf232731e486fece14e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004498, "uuid": "baa233a4-1c78-453c-849e-c078ea990c23", "comment": "Malware payload", "value": "b315ab0f756c20b0dd0d48afc389ef2af6d0435c5bba23b703aceb12a27f4521", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004498, "uuid": "61d6305e-e3e9-417b-ab7b-526835579d52", "comment": "Malware payload", "value": "c69fa9bd42084357e8d148f61f8723a6c000a4c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004498, "uuid": "873a4b41-3260-404e-8656-1ea85115b407", "comment": "Malware payload", "value": "d8d1bc44235dde37161b0b71ca9439f7c63c4061510610e2cb627ed007f6bd3af480a626fa669b207c7dc45c00b88337", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004498, "uuid": "b46671a9-ea53-46ee-b727-dcdc2f4bb28e", "value": "T12AA512B2B7C124F09D98B105163BCBCE5DC951292937901EF3B9D682F1E8F9B8863635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004498, "uuid": "e849102d-2d0e-438e-a213-56528c938ccd", "value": "1536:E99999999999999999999999999999999999999999999999999999999999999K:iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004498, "uuid": "6b6c5a4c-37ba-4101-9c35-ebb752d72e80", "value": 2226569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004498, "uuid": "98dac873-d61d-45e5-a6b9-9ee7308f57bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004498, "uuid": "31940a80-c8d9-4db8-84ad-22549f12c879", "value": "Pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342cd6c4-75ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782980136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980136, "uuid": "0644792e-4359-4d8d-9b8a-6cc85324225e", "comment": "Malware payload (WannaCry)", "value": "2c1947ccf319ca0137282c5c87c61fc2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980136, "uuid": "88cdedbc-a125-4cb4-b621-301c992b0c65", "comment": "Malware payload (WannaCry)", "value": "b3cbe2897f850313c9051016f1ef6bcc37a61c9cf86ef9a3f1ba61581ad38014", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980136, "uuid": "6bd01d1b-ae3d-4048-ad5a-b70d9eb74102", "comment": "Malware payload (WannaCry)", "value": "e8d8908e1676e97657dfa335a4ceffb53255206a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980136, "uuid": "c7332bba-582c-4516-9c76-0a010397fc03", "comment": "Malware payload (WannaCry)", "value": "29aed47a023ec38ab6eb8da47414693e5e0c2ed9d35e32341fff0e033f36a2e8d55ba1cba00cf76acdcefa0034aaccbd", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980136, "uuid": "64ee5f1d-c9be-428e-aeba-7d47f4c362a1", "value": "T1F4F4129932EC80F8C5166134D4B34E25F7B3BCAE2279970F5B948A691E13781BB74B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980136, "uuid": "822af058-ab92-4c6f-839b-a9169a2c938b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980136, "uuid": "caa92137-db00-4fad-b08a-15ec50930873", "value": "12288:jbLgD1bLgmluCti62ChsbaIMu7L5NVErCA4z2g6rTcbckPU82900Vel:jbLgBbLgurieh/dmMSirYbcMNgel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782980136, "uuid": "2b10dbde-447c-40fc-827d-d20a44795649", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782980136, "uuid": "79899592-f1e6-47c1-bddb-11f035abc0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980136, "uuid": "e4e346b2-4165-4b35-bf75-200e3dac15b0", "value": "b3cbe2897f850313c9051016f1ef6bcc37a61c9cf86ef9a3f1ba61581ad38014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e38a3c8-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036551, "uuid": "0d2384a0-89f1-489a-b1cc-6ea73b8f90bf", "comment": "Malware payload (Mirai)", "value": "470ab50934d8f58200d4bed01c2472e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036551, "uuid": "741c2a66-34e4-41de-a70d-21d2dfa02eb7", "comment": "Malware payload (Mirai)", "value": "b41cf0e4ce86234ca0055c4c1b55ddbb336eeed04a53745c78b5e372252dc96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036551, "uuid": "8bab71bb-f42e-4042-8455-1c662eb316f9", "comment": "Malware payload (Mirai)", "value": "f8a4a1dc31f7a1adc8beb2b0cbf536145ae9dbcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036551, "uuid": "7c054cc1-418a-4ea4-98df-a65ed623566d", "comment": "Malware payload (Mirai)", "value": "9c2025f40e39d06c7ffc044b51a3610d46891379a308f41e978e486e8478d712bdd6f354d3a8cd943d562fe7a1cf55a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036551, "uuid": "ffb1950f-e3d9-4277-9370-da6692e41fa0", "value": "T1CAA3E792BCC2562BC5E523BEA67E568D336073E4C2DA7117D8A34B107B8251F0E63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036551, "uuid": "9635f4d2-34d5-4a01-89e1-960ecd483a16", "value": "1536:onACdChqI8Ub0Bp6/CNfJzVPo41Xe/BLG/vXb/9tJJMVI5FUqZrYlq:onACQhqIMBpjVXeSX72I5FPZcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036551, "uuid": "462e03de-df44-448f-ab69-5fb301fde8eb", "value": 100956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036551, "uuid": "47d8395d-b0d3-41bc-b355-b4ddb5083448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036551, "uuid": "208da456-f6d7-4f86-8787-76113025a385", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c19579-75e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782976973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976973, "uuid": "30af4162-4bbb-4b80-94e9-fd4a9d1277ee", "comment": "Malware payload", "value": "4e90cc212b68d5f1e3afe4e6c3a96090", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976973, "uuid": "94148349-98dc-4d05-af87-9439e75b17aa", "comment": "Malware payload", "value": "b4c56effba0516161bf59022f137837ccf852825e5fa09d15b9a8bf8295fbde2", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976973, "uuid": "2e58f1c9-3235-4f40-b2d6-a7ebb589afb5", "comment": "Malware payload", "value": "eb801408c86faf594a6aab2ad651a22ef1374988", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976973, "uuid": "6fcda425-93a0-4311-ab86-8a3f5ab0f995", "comment": "Malware payload", "value": "0766b7750c9b8ae4caae31946de9f08a942f4a8cdc2b39316a2542038f8ccee4f7927e77639f4a98524d3ff78d63ec3e", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976973, "uuid": "7ba68679-c7d6-4238-bc8d-7ef24017f350", "value": "T1E152CF3071F9211CE5F3FF71ACA466C6DEABF9B3BA7112694542160A0A01E40ED25B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976973, "uuid": "2f5fe6c4-91ce-4105-a570-a2c607c340d0", "value": "48:M7PqcanNnty7KEu+njtzCM7PqHan6JHHmtu9lcBXuz/B7o/007DX:M7icyNr+njpX7iHy6JHqa7c7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782976973, "uuid": "7ef5ae67-81d3-4204-bb4d-0c982575ddb8", "value": 13209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782976973, "uuid": "2d9fb84d-daba-46e3-90ea-a7eb45766283", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976973, "uuid": "07c72005-a2d2-4521-84a3-475740506681", "value": "NAKAZ_MO_perevirka_mayna.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71da9bb8-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988400, "uuid": "5ad6363a-b68b-4ea7-860f-1c685080854c", "comment": "Malware payload", "value": "7e7be893c59aad134971d631d1860dd8", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988400, "uuid": "9f9f1d6a-2ee5-4597-acde-9db18c49851a", "comment": "Malware payload", "value": "b56b726c259ef93f630c4760286905f8d334dc05836e6458dad75463a7f04ad5", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988400, "uuid": "a07ef5f1-a0b9-447e-b58d-0549aa2fc4d2", "comment": "Malware payload", "value": "e9dc1882d59b7bc175c0d81a87ad2b54630ace9e", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988400, "uuid": "b4be5840-6398-41c7-9ce5-8f31f3ba168d", "comment": "Malware payload", "value": "71b6f6e9aea1e2c7a646df46e398ce13deafe41edda27cb5414daa47c153edf2ffb275e9b6e9590b9b82d5b725d72bbf", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988400, "uuid": "e9e3a659-62c2-4918-a190-6d276815ce1d", "value": "T1F6358C06EE109679D172B4B0564FE375C8202A344523489BFF5E2D68B63E7C1EF293A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988400, "uuid": "4820815d-e187-40f6-8e9c-5675bb2d34c6", "value": "24576:1gbeR+ZVKyeyCPt2mxpoaC0TzvxZFTzHVOHLr:CbeR+ZVKECP0mxpomvtzHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988400, "uuid": "fb493035-25d3-434f-b548-35c94a378032", "value": 1092168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988400, "uuid": "945ef784-f3da-4c9c-9232-895c24c90079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988400, "uuid": "7f713536-4623-46bb-a9fd-d59677459b4d", "value": "b56b726c259ef93f630c4760286905f8d334dc05836e6458dad75463a7f04ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7370f636-7652-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783023192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023192, "uuid": "0da6cb17-0cb7-48f0-8a61-d8f6fca475c4", "comment": "Malware payload", "value": "a3f9313c8d623b2e244a389e94f9ce69", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023192, "uuid": "881ab1a7-1855-4458-9d8c-89bc8bc06fd1", "comment": "Malware payload", "value": "b634c8c0ec3a4d682630eed6ac1cc8d5e2b0481110121990edcb4e0df9867698", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023192, "uuid": "cb02f505-77bc-4640-b234-9baaaf8f1b4d", "comment": "Malware payload", "value": "2cd571d5adbac1ba150782d2afa0be3b095569e8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023192, "uuid": "597cd03f-9b7d-4233-bc4a-c51b33d36b7f", "comment": "Malware payload", "value": "6b3d6c734160dc44a18c8db7b19978a2640df252723a34d809721448084e6a3528aeccf65bc02bf382a43f390cd6e174", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023192, "uuid": "03846451-84a0-4ff5-ab23-019055e8d784", "value": "T183A46C06DE904D33C8AE227D45A21390373AE689A703834B260DD6B57F933EB5F876D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023192, "uuid": "74be1947-9a52-44a9-8865-7be6932d1741", "value": "6144:modf9exi7x2lV5RMFs53cogD53Mpd39RCjBcMpcq34l:moT7xsvMs5Mzmp+cMpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783023192, "uuid": "8ea6cc2c-c0ea-4842-a31b-3ac08895401f", "value": 450550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783023192, "uuid": "836b1b74-8f68-4397-afc8-9280a7a6984c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023192, "uuid": "2c23c9a6-4ba9-4345-bace-f7f8eb3ef3f6", "value": "dogandcat(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db966fcd-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783015206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015206, "uuid": "ce5d4596-563b-47a8-a6b0-5b8c8c27393b", "comment": "Malware payload (NanoCore)", "value": "4f8d6901a24803c4f90aa766de0005d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015206, "uuid": "84f791ed-44fa-4c75-bd95-c99b3e29a5c3", "comment": "Malware payload (NanoCore)", "value": "b66119ad548007e383d58987d81a200a42a89f021d0fc3b57022b91ea267bd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015206, "uuid": "26806d58-e6ff-42d5-8039-f7a32a45d4a9", "comment": "Malware payload (NanoCore)", "value": "3b1d7de6e3706bff6ace385a4d7f528133092431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015206, "uuid": "86b592a2-8f70-4cb3-b1da-dc4a40222e39", "comment": "Malware payload (NanoCore)", "value": "8be180811c00617a22495a7302bb234f25601b055468c5a42ec4798f8d0394513aa8cc93e08e3a337486cfb678827cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015206, "uuid": "2a8ad19a-c286-4406-82b7-c888ed7f2b27", "value": "T1C714CF5637A84A2FE2DE8AB9601251428379C2E7E9C3F3DE28D465B78F137E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015206, "uuid": "eb139186-7a35-4031-b0a5-00e27144fec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015206, "uuid": "3f867213-8734-4a8d-881e-2ec3030efd4c", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItqmgcZH9Kz2fCdfeCpIT6/Jcp:wLV6Bta6dtJmakIM5BYHk6adGl2w0ssS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015206, "uuid": "46918872-66cf-4242-9342-cd25945ec3ea", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015206, "uuid": "8c266b0d-cb4c-454e-bc8c-e7caed1f4985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015206, "uuid": "eb39e394-05d5-4221-bd1f-5e153d854ac6", "value": "pk68.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c839ff-7643-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783016907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016907, "uuid": "460818d0-837b-4815-87cb-55f5796dbefb", "comment": "Malware payload", "value": "5f51cbb987e6fdb5c5ccb5a1a7ad3bde", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016907, "uuid": "46b53441-170c-498c-aaa9-ff5b5f9199b0", "comment": "Malware payload", "value": "b7f8c6b76b8b1a0f99fbec5eb467983e8fd18f3ef496957bd8fb9c5bfca5e50b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016907, "uuid": "dace55f2-ecf4-4eb8-81cc-98cc342c0364", "comment": "Malware payload", "value": "4b9bfc8662a7539b25c0dc628560b0fb39e2c4e4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016907, "uuid": "4ac19216-d8e6-4152-a952-96e5aafe0eaf", "comment": "Malware payload", "value": "148b853d902dba5d2714249da351f0de98226daab2ae2618a445391934e6df4b69d8dbbe7e2897da072af0c93fb621cf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016907, "uuid": "3a47a3f4-94c8-4cf3-98b0-98d26ce0a3d9", "value": "T141F68E43F7029D6AC9DDE7381AB693C23335FD4A5B8747131419F26CEEB2AE65B05280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016907, "uuid": "9d61211d-375f-4c48-916c-0878f9c11196", "value": "98304:GUDER3kg6q+7akTBZgV5z6WJQukgZBW6Di/5v4ERSzEYmmmYu9FTEwtluzX6w34p:GUY3R6qOtcVoupvW6G/VRclwtEzX7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016907, "uuid": "c713426d-7e42-4cb1-af41-b203eb541b29", "value": 16562735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016907, "uuid": "5c3b7db3-d3ab-458d-9751-03da7a66c406", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016907, "uuid": "f0628200-d076-4e83-8c84-709b9393754d", "value": "chiken(7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb7cf63-7643-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783016875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016875, "uuid": "bcd4876b-e023-4f3e-bdeb-c0ce35f81b5d", "comment": "Malware payload", "value": "f2315a59f0a2a6de98643775d5b0cae3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016875, "uuid": "eb6f5e65-ecf9-4062-95fb-de21027aa0c9", "comment": "Malware payload", "value": "b7ffef61c60d80eee806f36f30f80ff9cf3f73d522bd05e192fa34dcf2e87224", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016875, "uuid": "8d905a91-094b-4120-b97e-78cf9be1024b", "comment": "Malware payload", "value": "8c9f65f947c41d4df94f575c5b6953bed5bd94a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016875, "uuid": "452ab163-b534-416c-90cf-42acd4cd08b0", "comment": "Malware payload", "value": "04f40187944f2e5046f0b7abe1598af78fe342a2cc67755426dde26b685fa47d5e45c24662623244359a0e92136625a7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016875, "uuid": "1ea84af7-1dea-4f92-adaf-3f67c4ccee86", "value": "T1FAF68E43F7029D6AC9DDE73819B693C23335FD4A5B8747131419F2ACEEB2AE65B05280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016875, "uuid": "29b97abf-158f-4455-8c7d-58d0cc59a642", "value": "98304:EUDER3kg6q+7akTBZgVLz6WbQukgZBW6Di/5vKERSzEYmmmYu9dTMO/lIHRUoy4m:EUY3R6qOtcVYupvW6G/nRcNO/KHR5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016875, "uuid": "793921e5-a8d4-4b00-8ae7-eed6bc166da5", "value": 16562735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016875, "uuid": "e83a668b-9b59-4261-902f-6ede5bace3d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016875, "uuid": "17d9b9ed-707d-4810-9fc3-142f8d5f2980", "value": "chiken(5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a885190e-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010825, "uuid": "d446eb69-2ded-423e-af91-699fb46861e3", "comment": "Malware payload", "value": "0d5ccfb7c3ee0c049eee5315c7146da3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010825, "uuid": "092c4f15-32d4-4eb8-9d93-b1f9bbe60e16", "comment": "Malware payload", "value": "b8c2fd05afcfdb5f4950651117fb789dda897a29483269325f21e1dcfba5bebd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010825, "uuid": "9cf655a0-1f17-41f8-8da9-279d8bdf0797", "comment": "Malware payload", "value": "4d3eedba521b91be81cd756e4024df9a1a6a4688", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010825, "uuid": "141d5922-8927-49c5-a6d8-d8237c0eb885", "comment": "Malware payload", "value": "ee08614b5fd98ef09b4c4aab05e89a0f6a34b927edfb16bbc30ca25e2ead4968de979537967d9695866b7befa2418f23", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010825, "uuid": "01f48b28-b224-4546-9f0d-18aed43d96a7", "value": "T1F1A633D3788A25B2D01ADBB451436ABD70197FC28E258D1777CFBB2C0E7342469B9392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010825, "uuid": "6b59606e-ad41-4bb7-a66c-950685fbc72f", "value": "196608:9QBu2bq+cWv4B5iAaXvt3iyyRil3iePpRvoPVCR0oGYAVoiWFBdOVIKhiI6:9QBDc/W0vRi5ieRmk6zloiWFTOZiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010825, "uuid": "7f4774f5-313c-4ef3-88cc-d26893397eee", "value": 9744384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010825, "uuid": "a1972acc-a92b-4008-bdba-ddcdbfecf98a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010825, "uuid": "d07c9806-7b20-4ee2-a88b-027007792d82", "value": "zintall.6638250004.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f746e3-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036557, "uuid": "8eae29fd-7ac3-4db1-8a26-d9dac86d8cc2", "comment": "Malware payload (Mirai)", "value": "1718312cb29c5d7c62a482c44ffd9cb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036557, "uuid": "24a66f78-fd3f-4e75-b330-575204ae43f7", "comment": "Malware payload (Mirai)", "value": "b9ab18bab7c7f2c596d99816b284c1f107a2702f648d0d480c242305f3b57d10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036557, "uuid": "ee162885-c465-45c9-8c28-6426819df3f3", "comment": "Malware payload (Mirai)", "value": "bddbcd3f6b3a5b90a4ac99e58a28a24dfe147a70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036557, "uuid": "df044ee8-6a00-426a-b6c1-8cae21bfc50e", "comment": "Malware payload (Mirai)", "value": "df931d186823bd1e7be9a0b233d50fd82608427f35d5f1eaed58301f11101e1e5426542f299a2e0ea918e65ab02ad325", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036557, "uuid": "2322a428-2d58-4e0c-8b3e-80cc60ffa4e9", "value": "T1EED34C07722C0F07D5A20AB1263E5BE093FE95D111F4BB89691E6B5A5732E3B1482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036557, "uuid": "c1226e42-856c-4c5e-ad6c-bc1d17633482", "value": "3072:eiipkAST2h+SJ0I8b/FKJAhUZAs5yPZVfv3:6kDT2UE+/FyAhUZAs5yPzfv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036557, "uuid": "e6f0e51b-1d31-4225-ab64-fdac528f4495", "value": 141176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036557, "uuid": "1f16a2be-d68f-4a8e-82db-0ad9c561c01b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036557, "uuid": "1a344595-8834-4db5-a4a1-9abe3336c66e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12b1c5b-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966602, "uuid": "06622d89-8ead-4443-b4fd-db4216ce4622", "comment": "Malware payload (Mirai)", "value": "cef226ab6a74dd714abc2e79a5db2d5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966602, "uuid": "e8af1191-0b6f-4ec1-aa7d-9bd382244f21", "comment": "Malware payload (Mirai)", "value": "ba1b8d49b09ae2635326a9995e5dbaf10cef2dfed2c53de0ecc271c5a1089581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966602, "uuid": "ca4b41b7-ce39-4c6d-baaa-bcbb460698ed", "comment": "Malware payload (Mirai)", "value": "aa3f7e9f8edd771d77068b6a0c9eac8130a6905a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966602, "uuid": "ef7906d1-c53f-4cae-9b09-82e38f951d08", "comment": "Malware payload (Mirai)", "value": "5fda8be1e73c2879f996cb1385aa29069b744f8fa7c31404a4d3bb5a446fe4ac99951e6370a0ddeefb154da2588ede96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966602, "uuid": "3532cb17-f0a5-4279-8b72-2c754b93325d", "value": "T14093B30ABF740FF7E86FDD3749A92709158C550A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966602, "uuid": "c0202e98-649e-4973-9db9-64d4653b5139", "value": "1536:zahaNVXM/WLJR1jzYvXI2I3Lk/0B/BXsZiaBLTe:zahGVEWj1/Mp2TXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966602, "uuid": "204a981f-02ad-448d-a61e-a5e923dd446d", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966602, "uuid": "4236fae0-17af-4d32-99c2-5eba158f4ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966602, "uuid": "a90ae835-592d-4161-bdb2-7809df8b808e", "value": "vcimanagement.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8f4df9-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782988394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988394, "uuid": "480fe51b-01dd-4602-afd3-94bd74114b7c", "comment": "Malware payload (Mirai)", "value": "f94f856d6b5621f9d6ed7168c64ead14", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988394, "uuid": "008193de-d466-4294-8396-cf6988999500", "comment": "Malware payload (Mirai)", "value": "bb36dea9eac5af3ac5de503407aa3d7c3d290c46704fc93c19fb56b3261282e4", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988394, "uuid": "40921adc-0f1b-4309-a69c-7a2adb642598", "comment": "Malware payload (Mirai)", "value": "d0f811b62dce75ef6aceee4a00ba62b241f483eb", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988394, "uuid": "6d68fa7e-5134-409c-ab09-df3f5e99581b", "comment": "Malware payload (Mirai)", "value": "14934fcb8127e341bf3da2adba7bd007c0a88ed962680f708ba3e6ac5ac905f334f7137c5a008b0cecf1eb4452dae6e6", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988394, "uuid": "aa34a124-0157-4dac-aecf-db7752a9626b", "value": "T1E9156B16EA1155B9D07271B0524FE336C8686B358527088FFF5A2D6CEA3A2D09F3C397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988394, "uuid": "41557f1c-baf0-44d0-8880-6271c1051db7", "value": "24576:+jvjk/dTAXT4TSBeo6MHtjATJWfN+xcK5rKwsJX:YvKTqTLBGMHtETtxcK5tsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988394, "uuid": "59ac3c6c-52b2-496e-a59f-ad75df6c2fff", "value": 891440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988394, "uuid": "f20a0f6e-ac01-4b48-83cb-91c5d95a4a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988394, "uuid": "26aa8897-666b-4bda-92c0-33b01829cf2e", "value": "bb36dea9eac5af3ac5de503407aa3d7c3d290c46704fc93c19fb56b3261282e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a937d31d-7643-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783016839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016839, "uuid": "47762525-7d4b-4059-99f8-ea39789b49cc", "comment": "Malware payload", "value": "722388f59feaf8ad1cb5173abf3a240d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016839, "uuid": "b83b60be-4d61-4dd5-ad81-e0141088be4f", "comment": "Malware payload", "value": "bb990fe92faff97b2e3e606ca0eeac34253c471d9e84da98111e1c81cfd0a960", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016839, "uuid": "6696b48a-86f1-40c2-ad11-a47e89c47eec", "comment": "Malware payload", "value": "a69e8cf7036f94bca6d450646c165fa99e729d2a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783016839, "uuid": "f954838a-bd43-4ceb-acb5-49bf7a120b17", "comment": "Malware payload", "value": "0cc913f4e9a4ca504f103d1988f2edc91fe723f72d2be87e1f5d45c89a97b3764a1e92b49539bc4336421d780baced73", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FantasyHub", "colour": "#E74F65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016839, "uuid": "bccfd8c8-4c6f-4b9c-8c60-76685d4b9d50", "value": "T106F68E43F7029D6AC9DDE7381AB693C23335FD4A5B8747131419F26CEEB2AE65B05280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016839, "uuid": "06a422c9-fdc4-4306-b21f-34b4d5aadce1", "value": "98304:nUDER3kg6q+7akTBZgV0z6WJQukgZBW6Di/5v4ERSzEYmmmYu9FTEwtluzX6wG4+:nUY3R6qOtcVJupvW6G/VRclwtEzX7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783016839, "uuid": "a84d667e-0173-42a1-8f9f-f33d5857de67", "value": 16562735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783016839, "uuid": "3ced9d54-1ac4-4d54-a21c-0223f2e376a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783016839, "uuid": "88c5322c-ce73-4736-8dab-3d51b8c35d2d", "value": "chiken(2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b4fc61-75ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782979929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979929, "uuid": "1ad7d84b-3241-439f-8bb2-386f72023a9c", "comment": "Malware payload (XWorm)", "value": "ed8e74e0eb69487ed7a105ac6c05a82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979929, "uuid": "5c394d52-a0a8-48ca-bf6d-483201c61689", "comment": "Malware payload (XWorm)", "value": "bbd9b8056f45e78c75028f31179a89b92e5d75e179ee2fcde1e3d57ee2264538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979929, "uuid": "f354270a-7cb6-4c40-ab34-6fe1dd05f1b2", "comment": "Malware payload (XWorm)", "value": "8890ac0a077910c82ae14fac2b36eb3007f43338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782979929, "uuid": "7a7310b5-f014-4689-ac3d-8f715ef9fc58", "comment": "Malware payload (XWorm)", "value": "613ace2be09a746775689b7b80679d0471e0aca5f047d64a1f78d46a3c76b433f8f3b9c841ec86e615930bfb5b9907bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979929, "uuid": "6acf4c45-67fe-4e25-b9a0-d1028df5185d", "value": "T14616BF06385014E6E07592724AA651A47724BC961F72AFCF3EE07B763FB17E2B931B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979929, "uuid": "1f362a38-54f2-4d0d-8f41-f0ac0bbd6789", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979929, "uuid": "1076cb09-3218-43b3-9e26-55a7b0ca2807", "value": "49152:Dyw/o0iAtWeTkKQzdM6Xutvp3KwoQuj5IvXBlnX+oEELo:Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782979929, "uuid": "f9334e69-7275-4252-b4b2-3c390b9bad80", "value": 4164608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782979929, "uuid": "56e83cc9-880f-4f53-b9a5-1731b9471a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782979929, "uuid": "c4a320af-137d-41e4-a019-52546bdbab74", "value": "xbbd9b8056f45e78c75028f31179a89b92e5d75e179ee2fcde1e3d57ee2264538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b644380-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782988389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988389, "uuid": "f1d0b248-35e8-4070-bc5b-a3d5ed9600b7", "comment": "Malware payload (Mirai)", "value": "4f44eeb574cb6630cffd62b0636af26e", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988389, "uuid": "d231b2dc-7afc-4b44-9a98-4c82f1f357d0", "comment": "Malware payload (Mirai)", "value": "bbf4826a750446f4924413bb919f96eaf543a1c80759e9838a993ef475f68adf", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988389, "uuid": "bd000ef1-421b-435b-8acd-780011fdf72f", "comment": "Malware payload (Mirai)", "value": "dacc1fabba434a689c5041b4ec46414b4ee21d3f", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988389, "uuid": "458750a2-47d7-4f66-933e-7958b0d81b0e", "comment": "Malware payload (Mirai)", "value": "04e2c3a27f1864ca1db90283630c4d352add26b1ef22910792c975d3f578c4f40598a3ba859402cc2a82d0d4d10178d6", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988389, "uuid": "d42c1e0f-8b01-401e-bfb6-f30fdeb57052", "value": "T152155B16EA019479D4B270B1524FE336C8686B358527084FFF5A2D6CEA3A6D09F3C397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988389, "uuid": "83524528-e7b5-4db4-8541-169837c34737", "value": "24576:N3YCdGdKrqew9D/pmCca14h1cwWsI7U9S54:N3YCdBrqN9zECN4hiws7U9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988389, "uuid": "3a1c6856-d643-4824-ad44-b2a81c871449", "value": 891440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988389, "uuid": "468dbaca-6f69-476b-a27f-615706bfb8bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988389, "uuid": "fd4ea0b3-16bb-4712-8665-138808d384ce", "value": "bbf4826a750446f4924413bb919f96eaf543a1c80759e9838a993ef475f68adf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98d32b3-761f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783001512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001512, "uuid": "5071dd68-52d9-4dc8-87df-29145d523a80", "comment": "Malware payload", "value": "63407025215894cbbf9a6a09c69672b9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001512, "uuid": "a9866cb0-3941-4067-a5da-fafb7933709d", "comment": "Malware payload", "value": "bccabc4c81f9fba1e816e1e2dc52dcf4c226c19716c28bf4a2efc73d04bd8a71", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001512, "uuid": "4a4a54e2-bace-4e1d-8fa6-bd54277e1c9f", "comment": "Malware payload", "value": "0238f2f3d7650ce1b1e052cb8415d5ca5afa6f6c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001512, "uuid": "50929c77-1017-487b-84ac-ecfc9c8f94cc", "comment": "Malware payload", "value": "736cf3d8650049509cfc10b65cb500b1d21b8d94927062881ed79cd405c94c1f419dcb1259ed9bc92f545aa0603556a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001512, "uuid": "e575c2db-9056-4e88-8ec2-1926b20bd7c6", "value": "T1FDD02E926223067020222840F0E76800B540576F8C58C11CBAC320200F0164AF98229C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001512, "uuid": "8bddb3de-a8d4-46b5-bcdb-ca92670c9f29", "value": "6:hTWqKe7xdvGbxvjnk5AulNXYq9DG+NjVsNXYrkJ:VzKeTGBw5Piq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783001512, "uuid": "449baf7b-b895-4cfb-b4f4-66b79ead2ccd", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783001512, "uuid": "b1fb8118-33b8-4748-9a5f-9aafaf64c68e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001512, "uuid": "3e949abe-0f44-4f7c-89e2-c24c4f21c0e6", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682d4c4f-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988384, "uuid": "1365cb18-0b9d-4363-8caf-75771045cd01", "comment": "Malware payload", "value": "b21427e7f2f91ee5c12febeb378b0ffc", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988384, "uuid": "6c55a1b9-b03e-48ec-8083-8365731cb541", "comment": "Malware payload", "value": "bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988384, "uuid": "f4297ef8-091a-4123-b6ce-a93414185906", "comment": "Malware payload", "value": "2415990fc613cafe49ba9266c9ccd950c5dcacec", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988384, "uuid": "69f656ba-5af8-4abb-bb76-445692bba139", "comment": "Malware payload", "value": "8d75cb6a524e88c445224faf69a21e91b87e34b1d294193934803d39dfec9fcd456519afaa24754e4cfbc8a77a0b8371", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988384, "uuid": "974c1214-6797-4600-b787-b6f4792e599c", "value": "T15C156C06EA0155B9D07271B1524FE336C8686B358527488FFF5A2D6CEA3A2D09F3C397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988384, "uuid": "9461ab28-af1f-4dbf-9da8-8e0d6c75b845", "value": "24576:uDmwgzFO5mkE3TgHlU8w0kV1pQ0dxkL1jZOm:YmpE5mk0gFhw0kjplxkL19/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988384, "uuid": "274bf218-095c-40ad-bf25-033d6650011c", "value": 883248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988384, "uuid": "10d905c8-6a32-4212-b2ba-2d57bbe10bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988384, "uuid": "eca387b1-42da-489c-9770-aebc6d723ae2", "value": "bdb905d3cfa018cfca5af08db06df76c94dab0b6295d57672150b25f59010c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb1f282-765d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783028094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028094, "uuid": "6a356873-338b-4225-8523-1fea89a1b3ae", "comment": "Malware payload (Prometei)", "value": "507059336c27d5ee05cfb0f5141204c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028094, "uuid": "491b7d1f-78c8-4a12-a1bb-4b5842ee25b2", "comment": "Malware payload (Prometei)", "value": "be1d961b96fb27bd1410dbab08ac25086ee9f65782e9bab45f6fab3120bd672f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028094, "uuid": "961ce78f-5307-4d67-891c-5c1efbdd7c97", "comment": "Malware payload (Prometei)", "value": "c813d032a962650b0bd01e8d2feace85a29c0438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028094, "uuid": "a7b0be94-0176-47f8-8d01-0559c0674649", "comment": "Malware payload (Prometei)", "value": "bce3936cea2736197e8bf457396d4747e614e69f251daa7740c3f00801e73212f38d6e645f25dec06464f3e4e07af843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028094, "uuid": "16b862e5-116f-4cac-aca7-b7c703027196", "value": "T1E9A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028094, "uuid": "84eedd2b-4b0e-4a08-aab5-3293e6a07e37", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdd:Fs6pyCC/Ya2hpi6T6N4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783028094, "uuid": "8341f888-fa0a-411a-b61f-d7efb53f2cb1", "value": 449088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783028094, "uuid": "c8a67719-2ac1-4fb8-b049-4c7b376afad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028094, "uuid": "b4091ebb-ef93-410a-bad3-7201a9b62575", "value": "be1d961b96fb27bd1410dbab08ac25086ee9f65782e9bab45f6fab3120bd672f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249e8e11-765b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783026925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026925, "uuid": "ac2e86ac-0699-4b6c-b5b8-9c3dfda69263", "comment": "Malware payload", "value": "8e9ee52f13377dc3ec36394508727e34", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026925, "uuid": "ceb81395-7f71-4d0c-b717-930d5e0d11f7", "comment": "Malware payload", "value": "bf586ec8ce8528d26ec491fa5864dc590cefae88da176246296bb849e226a0c8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026925, "uuid": "4586dae7-c398-4b36-8af2-e337196aac85", "comment": "Malware payload", "value": "d3fcc0617f887f9d1a57b54712831bc1acc70cc4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783026925, "uuid": "1180e9c8-5e29-45af-b31d-48f1fed11148", "comment": "Malware payload", "value": "54ce78d6fc78dbb8da16526b12e68a90cf6eea4bd07cb35a0de449e9db4da72195e184a69e7d7907983689b1c9393701", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026925, "uuid": "a0dec2df-afda-4608-b30c-71f4151bf2ac", "value": "T1D0C70157FFC655BAFCF643360E3553692202AC358B67B28BA814327CA4B75D02E42DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026925, "uuid": "8ccfc2b4-cd7f-4087-bdcd-0ec09b51c8bb", "value": "98304:1q6eL7ACQ9GPjpZyp5eWR/XmU+2bDiUOBC7:QLcCQ6pZyplXmebD+47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783026925, "uuid": "d003955f-c840-409d-b1cf-06bfb11197d4", "value": 56141483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783026925, "uuid": "803b6d7c-2feb-4a8b-8f2c-7dd4c725d704", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783026925, "uuid": "24e78782-4c50-4dfe-9f83-e7a19ef7c943", "value": "entry_added_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301e4c8b-75cf-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782966815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966815, "uuid": "3995e771-3f55-4a8d-aef8-2341e1535e49", "comment": "Malware payload", "value": "ccb55de575bef37521816444fbf59169", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966815, "uuid": "46ebf635-f03a-40e2-8e13-0017e9727567", "comment": "Malware payload", "value": "c03877c24f26d2f98f5ce3f198422b4554c828739cf138bc4dd354287399db8e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966815, "uuid": "0e81ddb1-8556-4fbf-9aa2-8782439e53d4", "comment": "Malware payload", "value": "f3dc17dd14b74a44da255886f749dd204a998984", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966815, "uuid": "18e0e6bc-0007-4605-a82c-e16f75e99efa", "comment": "Malware payload", "value": "2c029a3f2a842ad86619c21c353168f3c56bc4e6ac7ca12a7224b5fadefbe948ba6605f19d2c0e60008f2e913b29cc82", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966815, "uuid": "ee4c21a7-4fde-4f3d-a82e-47546bdbff95", "value": "T15765CF4FFAAA03F4D479C079D0117212FAB078124720AEEB76962D674E67EE45E3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966815, "uuid": "9644a456-12c1-4644-8860-e98756af3cea", "value": "8b909a9e264d9786e8875ab149f4e403", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966815, "uuid": "0eab8613-bff3-4335-acf6-5cbe8eb017df", "value": "24576:smnLG+qW3YBc39lWG3PvSB1YhBuv4yg9yg8yglyg0yg1yg8N3C8lAAIpnugejRgG:u1Y7yg9yg8yglyg0yg1yg8xZilFugkx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966815, "uuid": "47f23589-ee96-4732-a740-c4e08e760497", "value": 1509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966815, "uuid": "5d2e9c17-da77-4148-944f-6f6bd774dbfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966815, "uuid": "81f884ee-a32e-4e50-b9c1-493d1d553eb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e69ff6-75da-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782971515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971515, "uuid": "5fb52247-95e2-4a0b-a689-3e56d54de5a5", "comment": "Malware payload (Gafgyt)", "value": "6056c707e0352be9c7c032fdf41d839b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971515, "uuid": "35222f46-d889-4de8-a573-e0aba4dc752d", "comment": "Malware payload (Gafgyt)", "value": "c0d4973d559f9b18e8ef8be169fc9451ca40569625b58e96bb2900defb1d8151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971515, "uuid": "73ef182e-bcc1-4eb9-b3c9-6da75a29943c", "comment": "Malware payload (Gafgyt)", "value": "94614f3f5d94f7b1a3c794bba2ad8206432b7c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782971515, "uuid": "b25f8c18-a8ee-4fc2-85dc-ba4e90db0884", "comment": "Malware payload (Gafgyt)", "value": "5c22a142d7e4a673289305d0af51e2489c1a1abd7466fbe1c1636f72628ee3e622886e1d9fee73f2807f8a040cdd33e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782971515, "uuid": "c001d38c-ac46-49cf-8d34-70dd9ff4af76", "value": "T1E6143B567B10AF62C228C53049F3C35667F636D227E29549B22DDB187E213496C2FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782971515, "uuid": "f8ccfe43-d00c-4d4f-8123-b3e55ff568b3", "value": "3072:z1anVFJQOheuaOCyWf+0eymi32L3H4HVIbdQjg1QlUd6ZVRUCtbTgEi:z1atQVuJA+1SAYHamGUZptngEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782971515, "uuid": "77da9479-56cd-4e2b-b41f-570a053acf15", "value": 191648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782971515, "uuid": "2ba83a82-1150-4af6-9396-51a052547632", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782971515, "uuid": "bcada5aa-d72a-4a66-8acf-ca217f8c3c71", "value": "c0d4973d559f9b18e8ef8be169fc9451ca40569625b58e96bb2900defb1d8151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df485e6e-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972262, "uuid": "364bb48f-b3fd-4b59-99cb-52af3a012e27", "comment": "Malware payload (Mirai)", "value": "28d2be7432bc31f14674e23670d350c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972262, "uuid": "4967bd04-f15f-423d-b691-10576bf3853e", "comment": "Malware payload (Mirai)", "value": "c1e10c9e81d99c76a98c73ce66b12a223f8d1ba32839b024cd319a275a087784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972262, "uuid": "36700bca-620f-45e9-8206-0cf6754b5958", "comment": "Malware payload (Mirai)", "value": "9d9786db0411184c7f5c8c121f40728ba4aa0cd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972262, "uuid": "4169d7e0-ee2b-4681-96d9-afede776c2d9", "comment": "Malware payload (Mirai)", "value": "aedcc40b84852af18d60f2c72f8d9d70220287c39750300bc41b6230f2548e289fc4284106244e87630e21bf3661f1c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972262, "uuid": "d00d5361-80f5-4a7d-ae03-d012bf9f9d43", "value": "T1A3B3941E6F21AFBCF6658E3107B34F21D3A972D323929686D26CE0195E7514E280FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972262, "uuid": "297f4c52-0fa4-42b9-8ea6-706cc816cf44", "value": "3072:bceguB7kUrXDgoOEQ8N8oiBQlUNPU5Q+J7YU07K8EINiT+38:Aegu6UrXDgoOEQ8N8oiBUUNPU5Q+J7YQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972262, "uuid": "fe78f350-60e9-4f47-9e1b-5c63ff1d595d", "value": 117892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972262, "uuid": "e7800b55-f94a-40d2-8bed-5ab85b4cf8a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972262, "uuid": "ff2162e0-1e9d-4f98-bea5-45a9c295023c", "value": "rtk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca74c5aa-763e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783014748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014748, "uuid": "8026a04b-d829-4058-887e-d13ab8a9de0b", "comment": "Malware payload (ConnectWise)", "value": "abf8d0319a5e41db8f7843fdaba5368e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wzrldplainstge-info", "colour": "#60F10B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014748, "uuid": "33d50117-6fd1-4235-b043-4b74fbabd517", "comment": "Malware payload (ConnectWise)", "value": "c20c5f34f17b762774984d5d5e647e9946a6c6d7fa20e1c2ac06e67588de4916", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wzrldplainstge-info", "colour": "#60F10B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014748, "uuid": "2bbe9a73-d016-47f5-be45-d595a1e267bc", "comment": "Malware payload (ConnectWise)", "value": "ab6d6e4ddc28fcbdac0b356e3289ccce2d7d1405", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wzrldplainstge-info", "colour": "#60F10B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014748, "uuid": "d2f62195-b67e-453d-b63b-17a82ac0f103", "comment": "Malware payload (ConnectWise)", "value": "065fd919ca5beee4187aa8caae18fc7a139da56d1956a24c9fee54006ecdcda5ff8c0d7acc914ecffd4bc2fda18d9f77", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wzrldplainstge-info", "colour": "#60F10B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783014748, "uuid": "18f30fcc-5cb8-4b3f-be7f-945e9221fdfe", "value": "T16AA6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783014748, "uuid": "b19a8fbf-52f8-4d94-8851-3764e30e0352", "value": "196608:XoHQjDSOgtvPjDoHQjDSOgtSDoHQjDSOgt6DoHQjDSOgt:XowXSJfowXSUowXSQowXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783014748, "uuid": "72c52b24-c033-4947-9916-06ca4db3d39c", "value": 10223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783014748, "uuid": "eff74943-de61-42e1-b132-2cbebf804b59", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783014748, "uuid": "9474c3f5-e3f5-472d-9988-206bc0f75428", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd92bf6a-75ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782952127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952127, "uuid": "0568aaad-05ce-4d52-bf39-8120bdd67b5e", "comment": "Malware payload (Mirai)", "value": "37ecb93c583c5ce391005e9cff09180c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952127, "uuid": "ada1105d-0bd0-4e2a-8d28-eb5359b67282", "comment": "Malware payload (Mirai)", "value": "c359082d3c646c95de08998999807e3d21cf9f8b8d5a67f871836b45845232b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952127, "uuid": "0e0bea82-d973-4dd3-b68d-80ee61334194", "comment": "Malware payload (Mirai)", "value": "3440bbfef3e1a724a2175c28a9955ed39a665a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952127, "uuid": "b2d6fd6a-7117-4916-a02d-f394bd0be2f9", "comment": "Malware payload (Mirai)", "value": "416142e5b437fac8e9f158399a01f24335aa8662bfd5a83da75e6b2b4420574f73612771c18bdf53789033fcc8effacb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952127, "uuid": "2c328711-78d8-439f-9d6f-c7663c0144ab", "value": "T139145AA9BA0F6C41F2C2D3F8DE8C83E13E1735E3C7768971791212EDDAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952127, "uuid": "261dd574-8141-4ec0-be21-991405f7320a", "value": "3072:G+yfyYlw8+NyNX47JhGr7qMW7v2AIZaJ+eMLsnoq:G+yfyYe8yyNXoJAXqB7vth+ehnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782952127, "uuid": "7109cdba-6b64-4f88-bc21-9a30b7ab8c52", "value": 190448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782952127, "uuid": "861dd580-1628-469d-817f-f0b3c239f677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952127, "uuid": "d3d9c841-6e35-4ceb-9f7a-f81ecc8f5d48", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd93928-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783004417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004417, "uuid": "46e8e6f1-94d5-4c13-bbe5-e596eb8dfc88", "comment": "Malware payload (AgentTesla)", "value": "b1224e6d8a13e3454eae6187b9123ed3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004417, "uuid": "f789bec7-a7e7-4e35-89c5-e8bb13107041", "comment": "Malware payload (AgentTesla)", "value": "c3fde2b6073956d263c5120f6ba761e936c776c372c7601d667671416eafa6e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004417, "uuid": "b2b4d421-52d9-475d-813b-f63b0b2a9bb3", "comment": "Malware payload (AgentTesla)", "value": "550742ad26ba0753f7376dd781a5defc16456161", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004417, "uuid": "fe4b2cc2-ab1d-475e-b643-ff617ca30072", "comment": "Malware payload (AgentTesla)", "value": "b0edc5bb0da41873e55265b1675a132bb23673157a6dfdbb455740484f50c8b5a32475671fa6fc36b74d1b9d9aef6f82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004417, "uuid": "c1c6b761-e02a-43a9-9759-3690505ad1f4", "value": "T12155F2015AC42FB8CBAC952B50BE1119E3B18E8A5145E98EF733FC85FFE7A04551B2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004417, "uuid": "eb44db91-c0d1-4024-8efe-5cbb5293993b", "value": "24576:/+5ru7nexKjZqXLsr0UM/M/B8iPEJRwzMXgl/IjhHgHTrjgrJ:giLemhim8ipMMbH3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004417, "uuid": "76594dd4-681b-423a-b03e-1b250066ad01", "value": 1377851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004417, "uuid": "3d61b8dd-b7ee-4137-b3ef-0a49f54956b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004417, "uuid": "cb7523c3-907a-4276-9ba2-612fb3af4732", "value": "Order Inquiry #070126.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157db964-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010579, "uuid": "2414b8da-7220-4ddd-bcc1-e7a9db85c4c4", "comment": "Malware payload", "value": "d29a13698beb49c8a8ac505407eb4de7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010579, "uuid": "d3191f74-eb60-4c8f-a5ba-a758bd7ed4e2", "comment": "Malware payload", "value": "c43163e838544477e8e0f94f0a985fe6fd627bf3ba79d0fef31d488bd530818d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010579, "uuid": "99f6cea4-0cf4-432e-961c-5c2b5664b057", "comment": "Malware payload", "value": "787830e5c775df649001646ff99701d61374ba7f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010579, "uuid": "20dc50b3-de1f-4a42-aa3a-b878336996bc", "comment": "Malware payload", "value": "90cb293bc937a11192403a91d02be7685c2a6210b549352ab06423c8a777414a031c287de851d46b419bffdef306c458", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010579, "uuid": "fed79182-df1d-482d-9268-6e8259604b46", "value": "T1D5C6335E1FCB80D9D9C115B0971B6BE723F3A5D67A828C3A99C530C821B3F7B6067942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010579, "uuid": "b5c1f7d9-8496-459e-999b-f2abb5c4d90c", "value": "7b57f45398dbfea90afa5fe593aac7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010579, "uuid": "1d782ebc-f209-4fdf-914e-c95410960b65", "value": "196608:2kfowI42+mwO0mw5LfEbkjBEZGeGVNJ5/svRPqV6EzuNLvTfVJMb06siFXalaQ9:2E55D8kFEUeGv7WPe64siFX4Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010579, "uuid": "8e01c1b8-be0c-43f3-805e-90f5c6eb685b", "value": 11935232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010579, "uuid": "cb42acde-7257-4dd4-ad08-5202ef6f7584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010579, "uuid": "da56527d-ca26-4e87-8c0c-737319c44ab7", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523da0d0-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783003379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003379, "uuid": "469a735e-1172-4ba7-bfbd-9d9ff66eb26a", "comment": "Malware payload", "value": "a4ca861f3e2fb457616860421f2a2bcd", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003379, "uuid": "886882cc-1f4f-40f6-a166-d804efd49f81", "comment": "Malware payload", "value": "c496a2ce8df541881683b207d8528f05642e5660be48e24fd16c2850e2d4ecbc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003379, "uuid": "f819ff5d-09b0-40bd-ad95-6bb4ead7b428", "comment": "Malware payload", "value": "5d1379db492b82a7dd087d945096aea8eb8b46ef", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003379, "uuid": "f8c0ae09-34e7-4b92-b63e-5e71a395ee28", "comment": "Malware payload", "value": "ae450bf9310bd3afd4eea6fa4869456c6f0f1207100b525a1b42474e2f70a56486bf93f61fd4ca7f36a49ef878714466", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003379, "uuid": "a8fb5ba1-228b-46ac-aea4-2d47d18c5b8e", "value": "T1D4D2F9C076322530E59FD876CA0C312549D1E243ED502F9BBA34A7362BAFA951ED273C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003379, "uuid": "ca729872-2b64-4c30-861f-3a487799c937", "value": "192:FpyGBZd6Wz/ju9qn9BZox+ob6ApR5zKzIqnI:FEGBWWzru9YBAFD5zKzIqnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003379, "uuid": "b16fca83-1c24-4342-9ad6-842e00a57058", "value": 30833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003379, "uuid": "39b92486-7694-41cb-9506-bb27e439d400", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003379, "uuid": "548f0060-2b71-4ae2-bd4c-118f3cce10b1", "value": "SAS -120607.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a39dd9-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987196, "uuid": "e76be736-eeb7-4c1a-8407-fa54d398428d", "comment": "Malware payload (Mirai)", "value": "8cf31172caa9f0edab258675b79a9839", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987196, "uuid": "a0eee6a5-4910-4487-a3bc-0704ceeaa87a", "comment": "Malware payload (Mirai)", "value": "c54c745ad9585403c933319125694c4cfbd3d991867b738f30719c502bea9c37", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987196, "uuid": "98c2f174-f676-41ec-adea-cdfe437d2de4", "comment": "Malware payload (Mirai)", "value": "c9a947d080b484bc5bbc5c48467f553d39474a7b", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987196, "uuid": "1dfb2ea2-f9ec-4509-b7ac-9884b2c77597", "comment": "Malware payload (Mirai)", "value": "a1a6055f1a6bd15d44cabbd96fab6a5ad738050421a84166e73daa788c8deb0ec214c0a6a51f0d44259074a5c3298950", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987196, "uuid": "7505ec41-92de-435d-919d-91cc3ae08bd2", "value": "T1E5F49E03AAD040BEC4D6C0744B8F9217E677F88962387B6F22D65F912E26F61675E780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987196, "uuid": "c74abd50-2457-436f-9c06-eedbaed34f90", "value": "12288:MZffGOv0mbu895JKg1yCyqZscs1qFgNOSPv3x3+EKs2SauY8Rjs0as2apNkUaUHG:MZfOiu8FLPZgMSPv3x3+Hs8uvRjr3NJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987196, "uuid": "4743054b-1d42-4947-a95e-5b858e59912c", "value": 739040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987196, "uuid": "c3e04ae5-ec54-47ec-b5e8-129e6824aa2f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987196, "uuid": "41781238-9df8-4984-8c5b-a6f33cf86bad", "value": "c54c745ad9585403c933319125694c4cfbd3d991867b738f30719c502bea9c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92d3e65-7624-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783003659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003659, "uuid": "d5cc2d31-6591-4123-bd26-29b91f69b8e9", "comment": "Malware payload (Formbook)", "value": "f455803cf736015a73d4f03f165963df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003659, "uuid": "c0759c0a-bb1c-413d-af38-08450d460831", "comment": "Malware payload (Formbook)", "value": "c60cbde6033fe5a3bd5f127248959e1742e48aeae539ece6e137dd5179df34e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003659, "uuid": "7a9c25c8-a32e-4e09-b267-95b28d7a7c53", "comment": "Malware payload (Formbook)", "value": "65495e2dc520a54bd2970ef7fb4323e40860ad73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003659, "uuid": "1ac5aa77-ca60-436e-bfeb-259912586e79", "comment": "Malware payload (Formbook)", "value": "d2cd3322ba67d11f5ca6de64a9a2352a13d2df7d4724d58fbac9de4496232822fdc8d5556f94c3560089e60d59729fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003659, "uuid": "41072dde-a526-4c0a-a3bc-be69763199eb", "value": "T13B351224236EDB06C4BA4BF41970D3305BB86EC6B922D20B6FD97DDFB86A7905510783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003659, "uuid": "126a7222-c231-449e-9f14-547a61b71730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003659, "uuid": "4847e0ec-f9bc-4a7d-b478-f6437ffd7c02", "value": "24576:AslbyI7p+lMceqn8HSSzywJ3RGbn8sa6Uw:ACslMcTn8HqwGbnxa69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003659, "uuid": "d08a0fe3-b5b9-4051-9cff-5370ca0e3874", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003659, "uuid": "a4fd6ef4-3ae4-48ae-a22f-2da0ab65f442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003659, "uuid": "39f50856-b415-4be7-a783-67fa7b70cd9e", "value": "PO_1400083954_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc0be0d-75ea-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782978486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782978486, "uuid": "215e0762-9877-420a-8fd6-7a72f264b78f", "comment": "Malware payload (Mirai)", "value": "7f6dfd384ff023bd5b8d621265b63b3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782978486, "uuid": "78b66e51-fc1d-4626-a3d4-dcd9c60afacc", "comment": "Malware payload (Mirai)", "value": "c686f456585ede3f7f91a0737455d30fb9d801d3b17a2b2518dd09b4cfa6be96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782978486, "uuid": "241041b4-a888-4a84-af76-693be406439b", "comment": "Malware payload (Mirai)", "value": "0919f4e41c28fbd07e3ee6aa2770b329212a0eeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782978486, "uuid": "b2c6ba3b-8ac5-4cf1-866c-5d680f736e54", "comment": "Malware payload (Mirai)", "value": "e2cb89aca4e01d9d32c947105c987058d8fdbf877d809cec96d5a9efe3b78a75c21b0e19687b8e89da2b9ab49ada2fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782978486, "uuid": "88f7319a-b396-4357-91f7-03ef2b7277ae", "value": "T191633B89F783E5F0ED5F0A71016BA77E8634DE120024DD6DEF947D71EE32A12A51A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782978486, "uuid": "5713a3be-5277-42f4-a3ee-1b64911cd97d", "value": "1536:sDyjzqd+9KFVmRNjFGC7qobJ2U231gxry7beFVi6r:s5VgNxGIkKIeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782978486, "uuid": "0deca42f-0fb3-4ebd-9000-7fa977e48ba7", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782978486, "uuid": "4e9b8930-014f-4972-9245-9bf91dbf8fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782978486, "uuid": "35f621c5-de33-4eca-8303-0bce797bc46a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e46ad-763d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783014159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014159, "uuid": "0b93a96b-e4aa-4aff-ade2-d592ea80c715", "comment": "Malware payload", "value": "8d5aab8aa7984f40aaf77eebdd8e10f9", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014159, "uuid": "f62dd56e-fe94-42ad-bb7b-3c5aefe160dc", "comment": "Malware payload", "value": "c753488426339c67753f544673bb51ced93586620cbeecf8f7a703133fd9c0bd", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014159, "uuid": "2b5b3f43-bf25-4c2f-8b96-1f78443df8f5", "comment": "Malware payload", "value": "ea76a777cc055ef596f7df88fbf9d38e233040f4", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783014159, "uuid": "b7258e0d-b9f5-45b3-b16d-c64bd0d43bf5", "comment": "Malware payload", "value": "2c33a23fe9bba66b76f034268c0ffd6bb4c2a03476722eada9903a27840e90f1243475c5f772d8aac2c52f3afc77e52b", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783014159, "uuid": "258b1e55-3132-4409-990a-b232035c630e", "value": "T19041192017A0BB8CF6E155B184BEE33221EC5A600AB364849C8AFC3D471560BA60B8D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783014159, "uuid": "8a7d5829-22b6-4ee2-a16e-d5a9a9b748d9", "value": "48:9XIb0CCgPYry6I+OqnOIKy12vG9cZ66rMZkuco5Zwlcg8p7HRjZlN:WogPgQvFDYNXwlgFHRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783014159, "uuid": "28550d54-f33e-4e43-b71a-0573a9b59428", "value": 2324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783014159, "uuid": "b799e071-9406-49fe-a7ab-3cf47ca1f5b7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783014159, "uuid": "0db23c7f-ccac-4076-9a40-4f142bd82e60", "value": "02072026_1731_02072026_E-dekon_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c946fc38-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010880, "uuid": "517d13f0-abef-40eb-b50c-1dba13bad89a", "comment": "Malware payload", "value": "7d4ddfae9553acb0216fa70375ad8cec", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010880, "uuid": "c3379dad-3956-45d1-87b4-cb520cc64dc3", "comment": "Malware payload", "value": "c7b2e8e7b78d1b2b24082e89ce40468be748853526f95e8b9285c03adc959230", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010880, "uuid": "b78b4a2f-cdd3-4b64-ac1d-dcf1f14249ed", "comment": "Malware payload", "value": "51a7d85c228582807b1a80efbdaf7b8d33aff4bb", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010880, "uuid": "172701f6-ae13-4f6b-a835-c0c87d5460d7", "comment": "Malware payload", "value": "99c93a9e2c5b0f4e26118b16f385126b98d895e74ffd31929079b80e12e09ae9e65281497f0072b23c48c3b065959bca", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010880, "uuid": "d7ff0f73-dcc7-448c-8a64-e9d707a19767", "value": "T1A2E44B1AA7E801A5D1FAE1B98DA74517E773BC154B22D7CF02E0825E1F237D0DA3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010880, "uuid": "9e616bab-0129-475d-8a90-5cd90cf5c277", "value": "28b432c6181851d59a36d814b5037606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010880, "uuid": "8d3c3439-13bd-44e4-880e-4bc0ceceafd7", "value": "12288:ARJP79SbbC+7qjJx8UbvbvW0qRROBu1ryxOO0y:yJP79SbO+7qfTqRcBu1ryxOO0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010880, "uuid": "47dd5632-e655-41c2-9ffe-354fce32ed46", "value": 703848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010880, "uuid": "213e3a62-35d1-46e9-b587-05e7c58a6a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010880, "uuid": "d0d97db2-130f-40ac-b5d8-37077b15b4cc", "value": "UpdateRingSettings.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83c4de4-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966667, "uuid": "4568a3b9-5572-433c-888a-c5d1943ac597", "comment": "Malware payload (Mirai)", "value": "eedb4d4ffbfeb95cf5644074038e3262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966667, "uuid": "6a4f4b90-13bb-44bb-884b-147cad4c60b1", "comment": "Malware payload (Mirai)", "value": "c80a916d945db5fc67e2b566eeb1910c1be2ececd0434cd6dedcf1da9a17f921", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966667, "uuid": "4f8bf1ac-4595-473e-a42a-9824d69e34fd", "comment": "Malware payload (Mirai)", "value": "17d732acb7f37cee6bc81ee7336dbd321dfb79ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966667, "uuid": "a24c16e4-9fa7-40d6-91f4-529386308f10", "comment": "Malware payload (Mirai)", "value": "ab69fcfe241f32078d829467ea93fb786ff6bbc48cc351a0e40fde3e1192cacf6901e60f2ee51212a51c6b62b2dd4feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966667, "uuid": "139f3c22-eb52-439e-ab18-ca75702332f7", "value": "T143E34C46EA818F13C4D5177ABAAF01893332A75493DB730699186FB43FC6B6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966667, "uuid": "de4ae7c6-230f-4409-bc2e-ba16a6984628", "value": "3072:qJs9NARj5/Icu+NGtKfS6XH9gM33kigvNO6bl7XgwxQK3MSLOfM/9JJLxh:qJs9NARj5/IctGtK66Xh0O6bl7XNQLSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966667, "uuid": "447d78ad-84e4-42aa-82c1-efe51ff58765", "value": 146283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966667, "uuid": "a830cdab-e3b1-478a-a31c-c22b3532cd58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966667, "uuid": "27127526-70d5-4623-b43a-29d1252cdfa5", "value": "vcimanagement.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c791236-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987908, "uuid": "6b85cb09-8d33-4a5b-a8e8-bf3b1e72c653", "comment": "Malware payload (Mirai)", "value": "809a91524e11df4602cd879c69dbdfde", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987908, "uuid": "e10c40d4-7ec4-4b17-a1c9-976187327b97", "comment": "Malware payload (Mirai)", "value": "c8f8d5cbe04acf9c6647c665b0d4e20cb4584e242c305256035fdef60455cd07", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987908, "uuid": "d2643e33-deed-41d4-b968-300411ebb0b7", "comment": "Malware payload (Mirai)", "value": "c694e79a01d647fc521e0091cfd482f214c0b082", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987908, "uuid": "ad87bdea-b88e-4874-9825-75ccb7cc5258", "comment": "Malware payload (Mirai)", "value": "d69b252f2bfc9d13bffdbc9d26167ab8f8ee90fecad1a53595ee807b0aac9ff6df90fa1f00cbdd447c2a713ff63d5a0a", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987908, "uuid": "4e233c8e-b377-40d6-b958-87f54226fbd2", "value": "T158C57D15FD21A875E171A170428FD7B2C8246635062B8447FF5B1E2CB67A2E0AF2D3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987908, "uuid": "652c078a-7145-4f15-b9a5-ecdab23f440c", "value": "49152:hQ4DJfk2RLjDqmL6KsLtexRjux+WlJJeq61Hf7USmNt3kp:dk2Bf3mHQxRjOvJJeBHf7Ro3kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987908, "uuid": "f3c8604f-b5ab-4344-b06e-e43e3cb3786a", "value": 2650096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987908, "uuid": "6ae59937-1d11-44d5-a658-dc39bf5f88d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987908, "uuid": "87b81033-a4c1-4417-8c67-e695c9d25ebd", "value": "c8f8d5cbe04acf9c6647c665b0d4e20cb4584e242c305256035fdef60455cd07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834895b1-75b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782955787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955787, "uuid": "31c02fcd-9058-4d6c-8f1f-522c53e1ffd6", "comment": "Malware payload", "value": "dd3716ee99f08c2b3082cc59c0288f7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955787, "uuid": "843aad3c-5e8c-4382-a760-03a26ba15ba5", "comment": "Malware payload", "value": "c99b5c82486be6bf6e9e018e5f2bdcbdfd922c075c1fac3923bbcdf8e4bec9c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955787, "uuid": "609ddbb4-ff1c-40ba-af6d-7d04df161e66", "comment": "Malware payload", "value": "3286e17fd8fe0250f3766f3e7ef11c8a441a11b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955787, "uuid": "9c0e0899-4e80-4bef-84d4-ce4c693e4ff0", "comment": "Malware payload", "value": "ffcac14052f939869ca083f1729d4278b2e4bdc2b98cec98b3a241cc80b1b1a14284b50ea50e227d1f2f89806ee1f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955787, "uuid": "7890c517-07d6-4461-bfd5-4b7f898737de", "value": "T12FC35BA3CD2A6F5CC624D9B4F0709F791BA3992181471FBA457BC2748093D8DFA463B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955787, "uuid": "195d5c24-53d2-4afa-ab8f-02858126f1eb", "value": "1536:6flhkIxi4ImruzLCHKjtMv7GZ8obpVKsdWcWZFXPtVyNWER/FYR:6daIx59QLPjkAbpVrAcW/XSNHR/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782955787, "uuid": "3e300865-653e-410a-8d37-b80294c2b498", "value": 120312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782955787, "uuid": "19da822e-61cc-471a-a671-bf9b8c33c3ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955787, "uuid": "da6f195b-2f83-4a88-a3c5-fae31ca351e4", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4335a7e-75ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782980351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980351, "uuid": "28435883-6266-44bd-a8e6-0373d6bb13a0", "comment": "Malware payload", "value": "d3cb15855839c18d1d01ee3013754af6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980351, "uuid": "6e92bd25-b3e8-40c3-b3f3-f3a47a1bf9ed", "comment": "Malware payload", "value": "c9b29956b3aaaf4216865e173b8d581523bfa447eeddf3578d1c158c6ffee527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980351, "uuid": "fabe98fd-c823-4511-8e50-1b0dc76e313d", "comment": "Malware payload", "value": "c885377991c6e7cc76d2f5da553bb46631889224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782980351, "uuid": "93284278-b862-4b96-b594-69d3233b3f31", "comment": "Malware payload", "value": "f7e58de292c0c15b3dfd5cfdb55dbfc75866e25c624f401bfe242702c787c745aace4d13db42c66fab37964c75a0e957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980351, "uuid": "cdb469a7-f95f-4ec6-abb6-6932c01ae9f0", "value": "T182F3895A6E328F7DF678873047B74A25976823DA23E1D684D2ECC1141F2035E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980351, "uuid": "8f620d35-7c00-4c50-828e-b37391a1f05f", "value": "1536:G97fbwXBiyEoQJLkVg8k7DIPRpG4eDbebha8lS6mBTxxv7kKSLCRlZD:GZqiusoVZk7GRpGmbha8kFv7kKSslB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782980351, "uuid": "69059545-696d-4a28-a1ae-36e5d88df5be", "value": 160888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782980351, "uuid": "aea69304-3592-425b-94be-6424b8d1843a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782980351, "uuid": "65325f12-07da-4f82-baad-a46c358a1a74", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde205b0-7614-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782996795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996795, "uuid": "1ab6422e-8c44-4e3e-bac6-925266b29a1c", "comment": "Malware payload (ValleyRAT)", "value": "1cf8d51ca815ee4fac497e15c6a5d9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996795, "uuid": "42765fc8-cc61-495c-a7aa-b165af24503f", "comment": "Malware payload (ValleyRAT)", "value": "ca66840e7c8c30a572c0489618a57d25474039bc0b44b0955ca4edc9c5d81706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996795, "uuid": "11c425e9-a5ea-462c-947b-71cace7945c9", "comment": "Malware payload (ValleyRAT)", "value": "8359d76b9578d5861822218077e167c31da9eb83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996795, "uuid": "e4cf1668-745c-429b-8110-60887dfb001d", "comment": "Malware payload (ValleyRAT)", "value": "7b3561ba526c94a20feddcdbbe9cd04d2c6b0afd15f867804e6901b1a9cae789c746a9cb261eeb6bb9017541385ac999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996795, "uuid": "0722ea47-f4a9-4830-8397-f917ccc20600", "value": "T122963323FE2D9FBDC99C8234303F9E7529A06F5B8454A0D637C1E98E262F6841D1E4D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996795, "uuid": "cffd49ba-746f-449d-812d-4bce31983ac7", "value": "a29ddeeb229d3bd359724ee90d516160", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996795, "uuid": "2bdaad63-7f31-4eff-afb7-99afa7a4491c", "value": "49152:w0cvRztsLfZnpXPxY5FxvZAEyZ5AXX41ElrOPRu/KrkrKrJulwUhSu5lJHexGksn:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996795, "uuid": "e07d4343-9f03-40c4-8b89-0c9ee10386a2", "value": 9163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996795, "uuid": "972c267a-473b-4aba-82fc-2333864257d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996795, "uuid": "55c60042-a95f-42a1-973e-089577a1d416", "value": "\u5173\u4e8e\u8f6c\u53d1\u96c6\u56e2\u516c\u53f8\u7eaa\u59d4\u4e0b\u53d1\u7684\u5173\u4e8e\u8fd1\u671f\u67e5\u5904\u7684\u5185\u90e8\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355\u53ca\u76f8\u5173\u5904\u7406\u60c5\u51b5\u7684\u901a\u62a5.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a647753-7615-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782996977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996977, "uuid": "ac37be67-787d-4604-aee9-994c1f4f01c9", "comment": "Malware payload", "value": "8eb447990b5df97ad3daed4d5fabe7e9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996977, "uuid": "6d125387-79c6-4999-8cad-1f88370a0b68", "comment": "Malware payload", "value": "cb0a4a758877e3f18a85fe307c6d4a7baf9924aab93bcbcb41f81eb13d9ac0f6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996977, "uuid": "d0e9bcf4-c68d-4cd6-8264-35315ca2e14f", "comment": "Malware payload", "value": "bda9d9e172b5362c444ab9cf42274b1e8171338b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996977, "uuid": "527eb017-3ab3-4140-b6a7-7caca0fb9d12", "comment": "Malware payload", "value": "df9308a52169fbf6e9e1ec7cab022874464c4f5233fddb0dab829b237108cdcb3e307967917e4a72bae85948dee9fbe5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996977, "uuid": "3a032db5-4948-4374-a7cd-5d04856fe49d", "value": "T149562385FF06D82EC87781370AA3073622569D2EC697934349EC762C68B36E44FD9ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996977, "uuid": "85f18eff-d808-4050-ac1b-848f1823856d", "value": "98304:Vo97xTwpEtoV+Alqo703bEilwh6rEmP6G7Ng7+9VYADUTLiSr+UOP5ZWFrkruT7S:CwYI+iqowshsEmzy+zQ6UOxZW6ruH6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996977, "uuid": "47570643-a6d6-4e7e-a111-c985d3fd71ac", "value": 6405045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996977, "uuid": "f6605b8b-fde2-4c80-8f69-adc155eef60a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996977, "uuid": "bbcbc004-4550-4d30-bbcb-76d04c39637d", "value": "T\u0438k\u04220\u043a20.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d05e16e-7652-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783023181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023181, "uuid": "9fbbfabe-922e-4d88-9bbf-64f719deaa67", "comment": "Malware payload", "value": "d6249c7d715a47215fdccffca8ec7d96", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023181, "uuid": "1dcf2487-08e3-42e4-b88d-45974781bb5d", "comment": "Malware payload", "value": "cbc71b0bd3f94cb163a8ab106242aa7638aced10e7b8c4d6179bc7fc5ba649f2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023181, "uuid": "062129e4-52df-46a1-b461-5c51872481ab", "comment": "Malware payload", "value": "a709906be7f7763b5aad0a236393fabd28463c08", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023181, "uuid": "d39d3bef-31c7-45a7-ad0c-6ca93df0fc48", "comment": "Malware payload", "value": "f54d06557695401b3182cfbdbf6af89e7da0c4cf602c91d3f5360883f6624b2a9bf6759a424488a615054f8b3253704a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023181, "uuid": "93e2f5d2-4e48-4062-85be-e7173cbee636", "value": "T10AA45D06EA904E33C4AF127D45A31780373AA949AB43834B320DEA787FB33D65B975D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023181, "uuid": "9b0c4817-995a-44d4-83fb-7ff6e85b0fd5", "value": "6144:1odf9exi7x2lV5RMFs53cogD53Mpd39RCjBXJW9H:1oT7xsvMs5Mzmp+XJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783023181, "uuid": "c5d69448-1648-49ce-9982-d090b4c275a5", "value": 482236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783023181, "uuid": "81f41121-b874-408c-bffe-4df62cd9ff4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023181, "uuid": "a6cd7010-26c7-4050-97fb-540484354220", "value": "dogandcat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577dc28a-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782988356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988356, "uuid": "f4a9dad9-ea05-448b-98c3-0843b097f22b", "comment": "Malware payload (Mirai)", "value": "f34267a640a4d0eceefc3482a13f5eac", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988356, "uuid": "85320e3e-d7e5-4bc2-9c98-31934093d08e", "comment": "Malware payload (Mirai)", "value": "cc9d10175aca22149c44989c970ff36dbc38d80adf795d08a87c3e2e03e19b71", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988356, "uuid": "0eff71fc-2cd2-4144-b0eb-30831017c383", "comment": "Malware payload (Mirai)", "value": "74d4e5cec6aea0aa5cd71e7738696ff70585cdef", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988356, "uuid": "5f202f13-47b1-4e3d-8aa9-d247fe8cd67f", "comment": "Malware payload (Mirai)", "value": "90f76c281ccf6935bbf6bd2be0184b99ae1912990a8268e467090dc91831fc791e6f2f0766d60f03c3b17d3304ad8816", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988356, "uuid": "f260cfed-a0b5-464d-8bb3-d063ad789d3e", "value": "T10E156B16EA1155B9D07271B0524FE336C8686B358527088FFF5A2D6CEA3A2D09F3C397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988356, "uuid": "d276d633-49dc-4352-b65a-2afc6e34bc63", "value": "24576:+jvRk/dTtXT4TSBeo6MHtjATJWfN+xcKJNKwsJF:YvQTpTLBGMHtETtxcKJjsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988356, "uuid": "79609bbf-0ad3-4972-b145-0e6b4cf12fa3", "value": 891440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988356, "uuid": "b16f3003-50a4-423e-8ef4-354f7310e6f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988356, "uuid": "7909c316-ea1f-46e8-9a96-9db5a8cca22a", "value": "cc9d10175aca22149c44989c970ff36dbc38d80adf795d08a87c3e2e03e19b71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc426c27-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004443, "uuid": "f8a3b039-c2b7-4a8f-b12e-7f008c71330d", "comment": "Malware payload", "value": "7bb5974a1986932aa1acfa34dc6e4a3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004443, "uuid": "542b0caf-56b1-43a6-bf51-341ee1ee9fcb", "comment": "Malware payload", "value": "cda7c99f57f39db1f39a058abb880e1229856c143f6b144f48e250a92d89b38f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004443, "uuid": "55d83123-7fea-47d1-bec0-a1d164353ceb", "comment": "Malware payload", "value": "447f3753bd8c830c4dade48b505d628b9f1c9ae8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004443, "uuid": "9cac399c-67a5-44dc-97ce-e5160358007a", "comment": "Malware payload", "value": "eba077c24e3d98e545288de9f02425b657b0a81a5c5b233f20481599424735084325c78a8de00726744e1a62c63a19b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004443, "uuid": "853e9b28-fde2-43c5-ba2a-05acc78b00be", "value": "T199A512F62BBBCDFD153D459E0A22ABEA5B5E14DB5F37085F362DCAD6002501B8683870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004443, "uuid": "2219a9fa-bbee-4ce1-9579-75113d8533ec", "value": "3072:2eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee5:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004443, "uuid": "dfc123ff-7f81-4ddd-90b6-9eb90e47bbf4", "value": 2153547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004443, "uuid": "cc38c2ab-629c-4efa-b199-0873b10540e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004443, "uuid": "6f399d1e-5964-4295-9b8f-ccbb9911966f", "value": "FACTURA (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924d8897-7610-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782994897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994897, "uuid": "b48da938-71c2-4fc8-af3f-89e7bbc1264d", "comment": "Malware payload", "value": "dce79af1ebfbf744185e73f1ac7206e1", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994897, "uuid": "e0fedc6c-7f56-4589-8eec-a738e9a74059", "comment": "Malware payload", "value": "ce1c3fa67f4bf52e9987dbc10abe0f109199dca35db4ea83cf56f01c85b7d123", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994897, "uuid": "f4bd2fee-e5f8-4a1b-971d-fac5c94a1a3b", "comment": "Malware payload", "value": "a17c39d0898a4a7586b3ff94006db8cbacef4bb0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994897, "uuid": "6dab60fa-4d62-4bc0-9d6e-00777348ef1f", "comment": "Malware payload", "value": "456ba9e9d1ef6be980736cd5fd72d7d8c61a4a893ba5385ca3e95e9d0e06f684274be0ba1e68972bc5f899b66856dc3f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994897, "uuid": "892b9fe4-e931-4f9f-ac29-f9da30d4811d", "value": "T171022BF84ACF1B7E9A750E51151E6307D431E68FBCC202A254B9DFCA6971FD02482F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994897, "uuid": "10bc3b9a-e95e-44c7-b202-7abbb9a028ac", "value": "192:0VSglfIE/yQumkRrE3MUx+2MUMHfP+1scYRxL3X1MDQc2ctqxB3+LcYhDD1MH0b:0VhlXVkNEB+NP+1IX14Eb+XD1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994897, "uuid": "43d69fd5-ad0c-4fbb-8b2f-eab4aa83e824", "value": 8509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994897, "uuid": "88560e5a-de76-42d9-8e41-b50a1dd9b52a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994897, "uuid": "5596554e-96aa-470c-9ef9-0349f19359c3", "value": "GER26GEC0003746.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddecaf64-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1783015210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015210, "uuid": "bf8eaee0-0fda-4d82-8168-466cd1c89cb6", "comment": "Malware payload (RemoteManipulator)", "value": "3eed6feda84d42e38d4c0c9406460af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015210, "uuid": "25b8ac53-7b03-4597-a73f-57acdacb6874", "comment": "Malware payload (RemoteManipulator)", "value": "d365700f7b92b99111394dc199b782a237e5aeaf9f0544875b5071a9b3cb9a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015210, "uuid": "dba1fb2e-136e-4ffd-8650-f6bdda87e25e", "comment": "Malware payload (RemoteManipulator)", "value": "430f0dd17036586215830f08b5cdbb2b23b1e1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015210, "uuid": "e9711ca3-b704-4b66-a379-0dbe635dc2be", "comment": "Malware payload (RemoteManipulator)", "value": "773c20a1bc3480480b5ce908ebb91fcc7e2c2f440362304fefbac0eb94d7a3b520a2046e2494c4a801fc87c322f29172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015210, "uuid": "2ede91c2-62de-4f03-846e-19ecb572fdff", "value": "T145764931769BC53BE56219B1692CCA9F5069BF650FB194C7A3D80EAE44B08C34632F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015210, "uuid": "f39e5f94-3a08-4aaa-ae2c-0fdf2ec14064", "value": "d25b29054fccfd62c3ed5a8a3d014883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015210, "uuid": "f94d51d0-5190-4f25-87ae-14dd7095480f", "value": "49152:wR5CbBq56hIF1XrwzMtmEMQh2Uc0Ro6lxSDfsWBxTh28h/kY:yEThIF1XrwzMtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015210, "uuid": "a44a4d6e-4fba-4942-ba47-5c22e67cb3de", "value": 7511152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015210, "uuid": "2697e9b7-26bb-4705-b50d-7944308198ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015210, "uuid": "62f29881-8d22-4f37-ae0d-7a3dff0e213d", "value": "d365700f7b92b99111394dc199b782a237e5aeaf9f054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d905f768-75ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782952066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952066, "uuid": "eee5e003-2a36-42c3-8a55-8985d1f8ba62", "comment": "Malware payload", "value": "bad6f964d8446321883f2530b2e3624f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952066, "uuid": "0180cb08-2930-46f5-b20c-cfa0a55d9428", "comment": "Malware payload", "value": "d463b63b43f0e7ee43373c74490c11877a925084bac04240e2ae4305b16cfe3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952066, "uuid": "9c9b6587-bcab-4d62-aae1-fd1f61bc1bb1", "comment": "Malware payload", "value": "ab2395040c7c2b9dea8e20ff3c45e9b5ca5df2df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952066, "uuid": "c8d5c899-9e78-43ed-9aff-4d7a0a694e0c", "comment": "Malware payload", "value": "634c111520574f2d8de83b400f61e871814d1ccd364b65dd13e92a3419fa7eb3a99a6358c5ef1bae4d356072a79aec75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952066, "uuid": "091aa34c-86c5-49da-8682-17d5ae2c9731", "value": "T144F308C7F900DAF6F809E3374853080AB130B7A144926A777257357EED3E199197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952066, "uuid": "174749a7-2b1e-435a-a4a4-fc23745a7eae", "value": "3072:7rxau8y+M564bybl5J6dwOI5fb+ny0ypfV8jbibLTMfOusiOc:7rAK57ybvJ6dwV5+1ypfLQTOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782952066, "uuid": "cfe73db1-2a60-43ba-ab4b-fd4bbad1014b", "value": 163320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782952066, "uuid": "d2ee6254-2a7b-418e-9e03-8d33dc02689e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952066, "uuid": "1f8d5bf4-2711-4455-be86-2bdacea95d9d", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb49f0d3-7666-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783031902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031902, "uuid": "7847ff60-b7de-4df7-9b13-63572cf0b883", "comment": "Malware payload", "value": "d38d3c4c6cf760ab22b11db3449dd547", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031902, "uuid": "e9034b7e-f34b-4c8c-9e2c-abb016d80a4e", "comment": "Malware payload", "value": "d472e114361dd2c6ebafb60daa72ba2db09752de5b243538f0fee18410ad6a25", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031902, "uuid": "b3320dfd-821f-4a08-adae-2605ca3e2b9d", "comment": "Malware payload", "value": "7724f6e036fd314615392d2c0963c5210747edcb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783031902, "uuid": "08527083-8325-4605-bbf1-9b07b8000d08", "comment": "Malware payload", "value": "cfb754540be21ab200d35cef33f9e0e6c582abfbe905bd9d548fdeba09ea98f2ee19171286b24ba519e48ffe6a83fdc6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783031902, "uuid": "a0dd37c0-7487-4f82-9bd8-20247ad0b0c3", "value": "T10ED61287F798A92BC8F79332567A562251474C068F43D7C76948B37C28BB9D01F89BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783031902, "uuid": "5930c0d7-12d4-4f12-99b0-186e9a53280b", "value": "196608:r2IASeU636XGM4BkAf2pWi28YJjJzfq9VBs3H9dZxP0Wfes/xl8xCGG5+tklsFyF:r2pUdGiN2rtEUHZtpesZOxGpsF8KII6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783031902, "uuid": "37b6736d-24b9-48f5-9435-43dd83bb0527", "value": 13438312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783031902, "uuid": "2f82eae9-5350-49dc-9d67-c0189f9791ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783031902, "uuid": "ecfc0feb-205e-4595-836e-618d9c59dee5", "value": "data.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e7ca78-7625-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004063, "uuid": "52665424-ff22-4d44-b3a7-d6cdd5731fd0", "comment": "Malware payload", "value": "9d6252413b138517c2ce406d99d53c64", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004063, "uuid": "cd4f8869-8a31-4403-a3b2-704fce4aabfc", "comment": "Malware payload", "value": "d49e7583369c71089fd6fafd4eb63e4b0e3af1f34ea08236ed425d4a09f0450d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004063, "uuid": "51b30fd1-362d-43cb-87b1-168314023681", "comment": "Malware payload", "value": "0b747a13c087cee84b819177aac5c8fe0c9322e2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004063, "uuid": "8bbec7e1-c0ef-4569-8f21-549e5806b4d9", "comment": "Malware payload", "value": "7ee2d23f43ddc36754f197cf96a0adcb420983d406b2de10ed5c136b70a9a7eb9bbecc2bf4c6bbe1743b009f2708f1f8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004063, "uuid": "85473b21-0581-4397-8cf9-3ea57e9bbd34", "value": "T1745402552B4979C7FE71DA31CE37D2F2281161459B2129E63F987A0F09FE0C2DB17258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004063, "uuid": "b4ce0f28-d12b-4fcc-93cd-5c6b37d35b52", "value": "6144:EVRlr/JbEqFeSv7fATHeboq5L3e+PinJdYu:ERDTv7iHetLOdD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004063, "uuid": "6f02bace-cd56-4914-a487-b90f01d84b44", "value": 293119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004063, "uuid": "b0d6266e-983b-427b-b725-5db29f2829af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004063, "uuid": "b93dd0fe-4c23-40fb-92f4-0fad5f2bbfd0", "value": "Nomina_01_07_2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7285613b-75b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782955330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955330, "uuid": "d0c46f4e-12fb-429c-91e1-9ad27fb89fcc", "comment": "Malware payload", "value": "fe6cb411f86018613413b7b2f6753983", "object_relation": "md5", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955330, "uuid": "05cf9cf4-effd-4dde-84c6-6aeced1733e5", "comment": "Malware payload", "value": "d53dd27e40da9a3c793da32c0bdde83c54e5da81dc9c6cf2d4f1886b93a25560", "object_relation": "sha256", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955330, "uuid": "9eb3eb2c-6b24-4b21-8894-e58ac20ff6f7", "comment": "Malware payload", "value": "38a253fcba67a4badcd06036e70ea2eac4684cfb", "object_relation": "sha1", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782955330, "uuid": "4ddc5b32-247e-4b27-a60c-029c6a89e111", "comment": "Malware payload", "value": "d4f00f230f4d34321370bf447de9b5d3fe88fe7a0a9680e6743252c9b6fa24b4da82f143cfa0584752587f30450738e8", "object_relation": "sha3-384", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955330, "uuid": "44310ed8-5abf-438a-846d-2bcfd7e19dfb", "value": "T152672326BDF6C82BD96780B311C3C35360291AD9A807D07F47A08D859DB1DAA2356FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955330, "uuid": "bf020f40-3e13-4cc4-a4c1-c96ada04d0e1", "value": "786432:wWvTUDadwK+pNzN3a9pcDpe7v0eZIsXNYGxZ:B4mGBpNzw9zv0eXy8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782955330, "uuid": "e3857773-f023-4541-827b-1ddf8b79f31b", "value": 30074493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782955330, "uuid": "74209a14-8903-4506-9037-3aa9055761bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782955330, "uuid": "9411f22a-fe9f-4a56-bd50-94322fe4d850", "value": "smp.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc5f151-7608-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782991346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991346, "uuid": "a57a2a34-c92b-40d7-8190-727123634889", "comment": "Malware payload", "value": "2de25a654e90aad829631782f5058036", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991346, "uuid": "8cda06d9-ee7c-4d92-82b8-5da4d615e904", "comment": "Malware payload", "value": "d5ca70ca3f6c99546703e8b2699d19b3160720d618a16996b6c8997f30966284", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991346, "uuid": "72f8af67-88a4-4cf8-bbc0-f6b9eb378f6c", "comment": "Malware payload", "value": "888d8493c3851c92f55545a05962d0acf07dc87f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782991346, "uuid": "397575fd-0529-48a6-b5a2-4f58cf023c0e", "comment": "Malware payload", "value": "18c55dc69cc283939ab7516b1433c6053e44fb5ae27d63c303b5e291c87758bb6c5a0588362f65c702cb651beb8b352d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991346, "uuid": "aecf1dc6-4d59-49d5-b6b9-a582bb551825", "value": "T16E431B92BD432DCF53B166E398DC28D11A6DB7CB34D000F80E2BDE8593AD6C65CE1699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991346, "uuid": "11336db5-08f1-4fda-a2e1-7a963ca614e3", "value": "768:rQEshbZXTLFIej2OZneRuM3iSraP8M+6yXDaLYQ:wlvFIej2O1uD2PDyXO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782991346, "uuid": "df789714-a745-4efe-b2e1-836cd540cc33", "value": 57373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782991346, "uuid": "6ba0f2f4-8067-484b-8b0a-9f742de8a606", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782991346, "uuid": "bb63fc02-2285-4237-92b1-79b5593d1f3b", "value": "20260326_RE26521955.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03501ee-75b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782954118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954118, "uuid": "d558e9b6-81c7-4abc-8605-d9373e173de5", "comment": "Malware payload", "value": "6c00675d73f4978553a782b0d73a94eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954118, "uuid": "160cbc4e-25d7-4ada-87d3-455858e398b3", "comment": "Malware payload", "value": "d61cab6815d2c50228abc96e326158089f485b8a393994dbc97ca9040e1b2183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954118, "uuid": "a32d9c6f-8dfa-4e0b-a2cc-a14cb6b123ec", "comment": "Malware payload", "value": "ff0656576077e3c51cf1807c7e8b22c2695cf064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782954118, "uuid": "e9cb9b02-050b-471c-93af-04dbdbb1ff6e", "comment": "Malware payload", "value": "be2ed113447f171f7adc51850842a4cb63c1b108d624375cc0c688a181c7409b87293f3437f76469270d68668ceea5e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954118, "uuid": "a0103925-1787-45e0-a2a0-d0bfc0cd219e", "value": "T1D657CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC8B0E666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954118, "uuid": "0b92ad1b-8efb-42db-b60f-5300983148ce", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQI:cqYUQuVDt0TZEAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782954118, "uuid": "ecf4ba40-97a7-4e1b-9ac9-bed5af6682b2", "value": 29523968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782954118, "uuid": "dc8fafc5-1b1c-4e5e-a489-857d1c19f80c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782954118, "uuid": "6119ea38-09a6-412d-9d84-cf45b43a75e7", "value": "d61cab6815d2c50228abc96e326158089f485b8a393994dbc97ca9040e1b2183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c63a0-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782987208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987208, "uuid": "a0656db6-b55b-4de0-bf14-ea2d64a28a2d", "comment": "Malware payload (Mirai)", "value": "dba201a229a846e4d9044c75a6b88721", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987208, "uuid": "b5694707-0442-4e09-ab2e-e5a2a1868d01", "comment": "Malware payload (Mirai)", "value": "d9075ead0451eb72fc250933ef9d83312b362a6ff8c45d5b8c50995d42e8bb21", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987208, "uuid": "9d96c622-7e0a-4bc3-a221-09c564a4a7f7", "comment": "Malware payload (Mirai)", "value": "94d54e2a04028648acfaba6e0e1bfa4f49e3c8d7", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987208, "uuid": "6a287b74-923f-4658-a4d4-9bc53c612d80", "comment": "Malware payload (Mirai)", "value": "c83391c745f0c671b8f48652dac5d1f1504bf9ffba338f2372a4993bca51ebf3099d0a3cedf1b9168102143eddccc555", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "bigniggadick-ignorelist-com", "colour": "#4AE143", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gayporn-twilightparadox-com", "colour": "#6ACAB6", "exportable": true, "hide_tag": false }, { "name": "ilovefemboy-mooo-com", "colour": "#09D69F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987208, "uuid": "0413c14d-f97e-47c6-9582-b448614815ec", "value": "T12C659E03AAD040BEC4D6C0744B8F9217E677F88962387B6F22D65F913E26F61675E780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987208, "uuid": "4db90e60-49d7-45a0-9fc2-c5482b883d23", "value": "24576:MZfOiu8FLPZgMSPv3x3+Hs8uvRjI3NJHG4ZfOiu8FLPZgMSPv3x3+Hs8uvRjI3NI:XipLRghPvhOM8uvRjINYipLRghPvhOMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987208, "uuid": "92e705ab-497d-466a-b0a2-d3b4052e43e2", "value": 1478080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987208, "uuid": "e194f7f4-d0fa-4ab9-9e85-e44d6f6b41d1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987208, "uuid": "79a24821-6092-4e8e-a017-ecae3e5d05fa", "value": "d9075ead0451eb72fc250933ef9d83312b362a6ff8c45d5b8c50995d42e8bb21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505af4fe-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988344, "uuid": "88777649-92a7-4b16-9e3f-13cf1c7af31b", "comment": "Malware payload", "value": "cf76b9eeb3e82d3f625cb9e59f5ee12a", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988344, "uuid": "a7fd8ce4-36f6-4d0a-9f3d-6e80e86d07ab", "comment": "Malware payload", "value": "d9dabb4d9429adc399d0d6f993ca9689a19f8268d3ecdb7be3c5effaf832801c", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988344, "uuid": "de1f6356-228d-4f83-86c6-163a905b7d78", "comment": "Malware payload", "value": "b7b4c832ba2f29f3723049f4008ef4afbd03e74e", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988344, "uuid": "894a1e8f-867f-488d-b425-9f8e6deca3f5", "comment": "Malware payload", "value": "3bb819279fbb13a432a451edca3cfcbf781eb2e77361dcb0125c3824306bfb436f710fd7fd344dbde4ee8094c8e84f07", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988344, "uuid": "a4191469-417a-49f0-a88d-5ca20e0adb6a", "value": "T103156B06EA016579D47271B1524FE336C8686B358527488BFF5E2D6CEA3A2D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988344, "uuid": "2782c9b2-317c-49ca-a6f0-44f7da19b602", "value": "24576:he3XBsUAJbR0RZDIHCVJFY21VpGw6SmPWo47Q1h:he3XgJ1kKuFYCTG/PWo48h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988344, "uuid": "2887e141-4d0b-40b1-957f-adc2a329d2d0", "value": 883248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988344, "uuid": "5fb38530-6646-4fa8-9849-fafd0a7d8b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988344, "uuid": "805217b2-a88b-4f77-ad5a-29ba7199aea8", "value": "d9dabb4d9429adc399d0d6f993ca9689a19f8268d3ecdb7be3c5effaf832801c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bd13ad-7631-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783009054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009054, "uuid": "f86a4b5c-c70d-4710-8340-da1797f2638f", "comment": "Malware payload", "value": "a4eb9538eebde6f6c41416d42d11c431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009054, "uuid": "889af7d3-7f35-4682-8e26-6ad3ffe414ce", "comment": "Malware payload", "value": "d9fd46c30a13ca4348f5cd05f467e149b7cc07d5a61f2d9ac44acfc78c36c59c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009054, "uuid": "d7d720cd-0ed8-4b2c-8ca4-c5aefc4d555f", "comment": "Malware payload", "value": "e395be9514dc4b18c97af8954afbf13d2639027f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783009054, "uuid": "24701f6b-6d97-462e-aefa-9d84a675494d", "comment": "Malware payload", "value": "797f8d7befb6ac5d68e2905bc31016567c95285fa03885a467e9c2564b10184289302a20b5969f98c4b0192de0af27ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009054, "uuid": "39d2eff5-0e51-4d6a-97b7-cd62d3bd7449", "value": "T15BB423581A371BE184D03D8644782E32CA5DBB9BB16DF44CBDC2B41122FF2FE951D85A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009054, "uuid": "65e4328c-ffd2-4347-9813-d2408c5c4aac", "value": "12288:1bozECKFLZMX0fy7c3QMbU1LUC3cjtsyLaNBloQQewEZoIJ:1b2cZbK7GbUdUttsuaN7o+wEZog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783009054, "uuid": "86794271-7a41-48d8-9883-45519068d7d5", "value": 530924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783009054, "uuid": "cfa2cf00-0b4c-4b89-8328-53f36314a008", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783009054, "uuid": "94847f6f-123b-4456-b09e-8c1dbe0e07b0", "value": "file-suspicious-elf-header-amd64.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f6f12d-761f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1783001268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001268, "uuid": "4b678bcd-28e1-4faa-aa86-d700ce8d302d", "comment": "Malware payload (KongTuke)", "value": "461b178002c7b29a53d9180efd455692", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001268, "uuid": "b630b9ca-10fe-4eae-8d0b-51db476d7d2a", "comment": "Malware payload (KongTuke)", "value": "ddd7ff70971b9fe381d137218f80c998ca10100cd2a62d55daf962bf9f44c9f2", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001268, "uuid": "23499448-3c18-4925-9a30-0ad7dcc36fdc", "comment": "Malware payload (KongTuke)", "value": "9061c5a4cc0ce049da7cd094b58aac26b943d0aa", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001268, "uuid": "7b07dbb6-a893-44e9-9049-2ff7337fffad", "comment": "Malware payload (KongTuke)", "value": "2ca868863b43bec1f57a711698fc8cded3cb9189fc9a524af3c48d88d55123180d2c91a1cb291e4c621f2746a4da3603", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001268, "uuid": "6902eabd-4947-42d9-9737-0ec10dff3469", "value": "T1E6C17DF801B7FB7E21CBC5A618561AA9F33105A36041FE54B86D5CC15397D9BE2D82B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001268, "uuid": "d8b4f975-83b9-4e81-a15f-f336b4c94ff1", "value": "96:O9lokLnArBtYPB9ka7lMPgWzJx0nwO4A0BSijczOC4Scgl/xMRbLEb4LyPtaBSP:mouY0kaBMP9miPBSOcaC4tglObLEb4Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783001268, "uuid": "b9f530e0-df1a-4d58-a994-6d8597aae6b2", "value": 5706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783001268, "uuid": "90ab614e-7469-4a80-a83b-2ee8b8b344ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001268, "uuid": "b1296b66-5194-4df8-b61f-abf02d6891ab", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83173dda-761f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (BlankGrabber)", "timestamp": 1783001314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001314, "uuid": "05e04fb1-ee6f-40af-a3cf-3365cf640fa4", "comment": "Malware payload (BlankGrabber)", "value": "6b5dc025587cfb9fb6d155f466dd1507", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001314, "uuid": "b59e9f93-68d2-4469-83ba-f3f7a4556d97", "comment": "Malware payload (BlankGrabber)", "value": "de42b33110544bcc3b2251d6aae89643954eba9dd697c1fb4b2316b33081d0f7", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001314, "uuid": "830e93f8-ccdf-4aa6-8f52-ef4bb56df24d", "comment": "Malware payload (BlankGrabber)", "value": "641dd2937fe2a05ac0f3c9c5d1358a9963023359", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783001314, "uuid": "ecfbfa71-a098-4ccf-8abf-31e0610f77da", "comment": "Malware payload (BlankGrabber)", "value": "7c6e2ad39eeb162785fb5945e66ecc78e49901a7b49dfd0e3d7b61d78d18b0abe56405987db9358aceab602425c1bc4e", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001314, "uuid": "2fbbb9e9-9838-4416-9a71-d1efb2aa0718", "value": "T1D4B633247AC945A7EDE3613E4D62C61AFBE038515F60D6DF032857A43E3B9A0893E371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001314, "uuid": "6e9f0a3b-5c79-462b-a95e-2ececf0d2c67", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001314, "uuid": "8f3335f1-0a7a-4acd-9b2c-f34f2bd06834", "value": "196608:wAxxkm9c48OuHsntMNkIahjyRumm4KR0Dg43AtRgEvoK7LVFLpyLuHS:p2uGp5Qm4RBtRLvF7XLpzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783001314, "uuid": "f5ab7ac5-fcf4-4592-9ec3-084665c5f1cf", "value": 11452464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783001314, "uuid": "7e7653c9-2518-4a0c-a1d9-f58b1917c6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783001314, "uuid": "7763c229-90b7-4fc5-b2e6-a549267a58dc", "value": "External.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd748232-7663-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SpyNote)", "timestamp": 1783030644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030644, "uuid": "0e893ffb-fc00-4838-8e6a-1bb6cc0a6cc6", "comment": "Malware payload (SpyNote)", "value": "26acec1e131c452a6478bf39f91f908b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030644, "uuid": "a41c3a16-652f-484c-a966-6bc7ba3e7a98", "comment": "Malware payload (SpyNote)", "value": "dea110082d57d210d746c7d9fe791d8e297de82ccd5e48c2813c615a45913e8e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030644, "uuid": "dadd0439-ad1a-4767-93e5-149cf868d343", "comment": "Malware payload (SpyNote)", "value": "2d1ac4fc6fdbc0c3890c6dcc74d51f9feab64156", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030644, "uuid": "086ef059-a693-4c06-8e6d-d948cf8c852e", "comment": "Malware payload (SpyNote)", "value": "0d5477a7f82d86b5589260170fd3743dfb4676390df2b3511fc31b2679d6cb5810ec49249d7aca81a089f10c0b127384", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030644, "uuid": "9ff5fd24-99cf-4da4-9d89-ed15ab964276", "value": "T1B3967D1BBA029972DB3CC7B490B4CA64BF326D85E98747D325083A7CFD391CC6A85758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030644, "uuid": "6839e8c3-a589-4cf6-92b7-7354be5e6870", "value": "98304:GOPR+5YbNlt4PkbInf0ld3oKn6TNmzxzBb0tsJ5L:GOZ+mltIkbNniAzAsnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783030644, "uuid": "3f4365e6-9204-40bc-8071-816d5b82aed7", "value": 9200307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783030644, "uuid": "48a08254-ed78-4fb4-976f-e43144720e86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030644, "uuid": "d4b26deb-ec79-473a-ad4f-0d62db9d8fdc", "value": "decrypted_600520367292854360.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffad00a-7600-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987940, "uuid": "d08a423c-736b-43d2-9daa-a60fd518ca27", "comment": "Malware payload", "value": "a7374883c2628f7e6ecf71abf7d2f593", "object_relation": "md5", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987940, "uuid": "4ac23d78-4033-4789-96da-e17b9be3d919", "comment": "Malware payload", "value": "ded179f127ffc2cc8c7d720af6fd6a302033cefa430944ecae470248e004645f", "object_relation": "sha256", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987940, "uuid": "becbcb81-b71c-46f7-8327-b5854d7d9987", "comment": "Malware payload", "value": "b2c4f693b8c0aedd259972ec08a636c2d816c015", "object_relation": "sha1", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987940, "uuid": "0984e8f7-a244-4d89-9663-c99e6b168211", "comment": "Malware payload", "value": "6681c2b7bee76be84e7aaa14d5535f27c9d9a23af7eb826d6f5253fc4ab7012bc6b045954c06e9b99622c436c170575a", "object_relation": "sha3-384", "Tag": [ { "name": "disciplinenahidwin-st", "colour": "#4B6A13", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987940, "uuid": "5d37f44a-a331-4ae2-9306-a04f3187988f", "value": "T1C8A5121AE941A4B4E473A0B2530FD336DC246B31916788CBFF191D69E27A2D09F2D35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987940, "uuid": "73fe8feb-931a-4dce-89e1-6c3f5df01ffd", "value": "49152:mh0g+/CA6dm9csOsYiACa75UXgNNaRRY/ADf/QwUQ/hrkeo6kjcQ:mh0RqXmVOfiAr5C3R3DfQGrmPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987940, "uuid": "7ca8380a-fb87-4c9f-8412-a670aba15279", "value": 2214902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987940, "uuid": "a1dcf406-050c-44cd-8895-c1349befe596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987940, "uuid": "ff05de30-284a-42fc-980b-36ae3a874e5c", "value": "ded179f127ffc2cc8c7d720af6fd6a302033cefa430944ecae470248e004645f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b01e425-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033459, "uuid": "ddb74b6a-65da-46f6-ab15-286d104beab2", "comment": "Malware payload (Mirai)", "value": "7c9e2c3e0e594e5c2591542649a54e39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033459, "uuid": "2204996c-ff69-4889-bd03-17e00b3139dd", "comment": "Malware payload (Mirai)", "value": "ded73b48bfe87062892030bceb68815d779c51c736c3278ffb00f340bdc220dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033459, "uuid": "71f7673f-a9b4-49b4-9131-2fa96930d5bc", "comment": "Malware payload (Mirai)", "value": "c4fc096f8944cc2dc8335875891bc5172f2733a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033459, "uuid": "993b9eba-c6fd-4219-a0a9-56e6b64ed2f6", "comment": "Malware payload (Mirai)", "value": "164133a4a90913f20ab4d3146f234adc75f191cffa8972b1879e8bc2be1bf7a5026676fc638fd1b773596d38db5f3133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033459, "uuid": "22f4efc8-8976-404f-b9ae-f6601255cfb2", "value": "T10B146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033459, "uuid": "1dd17f01-e4af-4f83-a886-a74ef98332ca", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtj:BZAyFzQSdS7Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033459, "uuid": "27c815d9-79bd-469e-b3a0-bdf18b993112", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033459, "uuid": "aab1d612-d58c-4f51-b0ad-cc77087680a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033459, "uuid": "d7a62c07-7de1-42c3-aadd-18df0aabaef0", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f9cc51-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033448, "uuid": "f3b95a6e-3261-4a25-99f6-bbf3f3c01ca6", "comment": "Malware payload (Mirai)", "value": "17fa90a6680e6aee4c1e1f25701ea361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033448, "uuid": "b09a4d83-a5fd-4e78-9cc1-78afcb62f8e1", "comment": "Malware payload (Mirai)", "value": "df34ce9e3c17ce3fd73320189705b2ca2c00d54f306207ba2909fa56809243db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033448, "uuid": "632c92f8-633f-4ef8-ae4b-7353728cfe45", "comment": "Malware payload (Mirai)", "value": "77ac2e464ecf1454b8f390a29d3910cb965907a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033448, "uuid": "a0328581-6609-4ac1-88a1-efa2318a34c4", "comment": "Malware payload (Mirai)", "value": "ea946933d568b02778db497666085880730143a17875200f00afaf4687adb73aba79250135483311ce06383c2302c62e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033448, "uuid": "a3874f4c-c8f9-4293-9405-9a1ec8808497", "value": "T14E7302722177DEA1D2B2843323837D89BE278476037492BABC79676EF486E116C0C45E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033448, "uuid": "5920ec93-cd48-4106-8b6d-2756e436ade5", "value": "1536:i8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWm0BlmlorJ:5zRnwP0bMQ2RijvDZZ1rYGhG13qMSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033448, "uuid": "1480f7ce-d4c4-43d0-adf4-c4e2c4ce1f12", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033448, "uuid": "d8523507-5f43-4a86-bc00-bf15a50800f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033448, "uuid": "e4f30d88-5564-4a98-9410-8348dfe529b6", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58327add-7602-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988786, "uuid": "56cdeb87-a6cc-4393-be3d-04644141408c", "comment": "Malware payload", "value": "34cfb9d1a977bd4f509752007a87419d", "object_relation": "md5", "Tag": [ { "name": "dhdsjsdjxc-duckdns-org", "colour": "#603391", "exportable": true, "hide_tag": false }, { "name": "fcfrfxrfrsfs5f-duckdns-org", "colour": "#6B6C3F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988786, "uuid": "8be740cd-7e7f-4e97-84cc-e1fb4b0c37b7", "comment": "Malware payload", "value": "e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846", "object_relation": "sha256", "Tag": [ { "name": "dhdsjsdjxc-duckdns-org", "colour": "#603391", "exportable": true, "hide_tag": false }, { "name": "fcfrfxrfrsfs5f-duckdns-org", "colour": "#6B6C3F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988786, "uuid": "1f9813a7-26ec-49f9-be0c-96b979dbc94d", "comment": "Malware payload", "value": "b08f4dc352629e24078556670729a7e00f71ed38", "object_relation": "sha1", "Tag": [ { "name": "dhdsjsdjxc-duckdns-org", "colour": "#603391", "exportable": true, "hide_tag": false }, { "name": "fcfrfxrfrsfs5f-duckdns-org", "colour": "#6B6C3F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988786, "uuid": "396e06d5-e368-4092-ba0d-97d0010ea93a", "comment": "Malware payload", "value": "e2b9be6511a33112ba5ea503d4a4b24bb8a936956d1261f981ae5a6ab2273f24187470509e6e409aae770c651c02fe30", "object_relation": "sha3-384", "Tag": [ { "name": "dhdsjsdjxc-duckdns-org", "colour": "#603391", "exportable": true, "hide_tag": false }, { "name": "fcfrfxrfrsfs5f-duckdns-org", "colour": "#6B6C3F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988786, "uuid": "e9c0aae9-dd49-4366-b474-03472a49e999", "value": "T1CB41CE91FC63882275EB04A56FAA51853487846F8114FC6BBDCFB96C7F78869B02C324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988786, "uuid": "b6ec343b-9583-4e20-af5c-e22a252a27cb", "value": "48:Frv73MExhqVjCxyn+DmeS6HBoij4FtzL7IDr4tlmmqHrYfWb4TmT:FbxhqtM+sJJCG4QKdqLsyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988786, "uuid": "ae1de757-6e39-4950-a51f-9b5125a19e42", "value": 2407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988786, "uuid": "17f74b1a-3586-4ded-9e69-ca2f50fb7f12", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988786, "uuid": "0e24a354-2fbc-450b-9232-d7b65ebdcd97", "value": "e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5435bea8-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033447, "uuid": "d2422c3b-2baa-414b-9349-b9c12d477de2", "comment": "Malware payload", "value": "fa4c0201a8ef4f7b9cbe81260e2a45c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033447, "uuid": "7090a149-219b-4d62-a0b7-40f278089d85", "comment": "Malware payload", "value": "e0de7b97caf12794da7c39bd4e0f3024457acc46e933ef13861ec28d8b0c31a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033447, "uuid": "7c75d8be-6d01-4e71-a7aa-8d228abaa592", "comment": "Malware payload", "value": "974805f86326780c7882184d88f1fd55f6515993", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033447, "uuid": "f44da806-5825-4c84-ae8d-654a9c84430a", "comment": "Malware payload", "value": "2b306401b18824be23c7116e8d03a8fc856e1727a57cf2f19f18ee41c338f7d436a79f81b5a804b0c96338e53361f2a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033447, "uuid": "0bdb6bb9-12e8-4f2b-a2a0-800d16b684c6", "value": "T1F9F0A79801406A53E78D9D0FBFB3A46D1152A7D8200B7BC0B5960B1CA644B86B014777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033447, "uuid": "a20efe67-225e-4e0b-b7de-67ba850c17e5", "value": "12:KhI5W3CtI1/TbNFJQ1npLOhoNFJK2yNFb8liAErNFbgeqlHE:KOQyS1bbe1npLOzT8liAc9qlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033447, "uuid": "1cc8b7c0-1648-4e0e-a6f7-fc1d92fd26dd", "value": 440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033447, "uuid": "a4c309a6-f507-462e-8d0d-35cce59033f1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033447, "uuid": "71222215-2f3b-408d-90a2-0ba3308add3b", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8ebe78-7610-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782994862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994862, "uuid": "6a1d9255-0710-486d-9b88-308c6fded757", "comment": "Malware payload (AgentTesla)", "value": "d8ff995ca4b9a9a2018b852331c1d0f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994862, "uuid": "84b65a41-689f-4ba6-973f-42774adc859b", "comment": "Malware payload (AgentTesla)", "value": "e131a1db2de30ed970ca887afe7153f0611215f663019c9296ae1a075cfd3245", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994862, "uuid": "ad27ccc1-3950-4858-a9b6-bd37117a9638", "comment": "Malware payload (AgentTesla)", "value": "c9699aab5b60601b25da974dc06708b0c3b78b4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782994862, "uuid": "01939b75-127a-4695-b424-d8bc52f3225b", "comment": "Malware payload (AgentTesla)", "value": "71e6c5a28cf341b30da0fe6faa175fb2067bd7d44bba9739de60f26cb70f1d0289a782022acccd31182bb33dbdaa67ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994862, "uuid": "1609db4c-d75a-452e-9c15-7b8deca4567e", "value": "T1B635D0AC3610B5DEC857C97289A4ED74A6502CBB530BD20391E71EEBB90DA97CF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994862, "uuid": "354584b4-6dc3-4447-9404-1645fea7f09b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994862, "uuid": "951557f1-d447-4477-b909-f800840d077e", "value": "24576:HEkerrz1MNSq9fV9g5y7o1V21W0+To65IIgGDQ4K:HEXr+AIdK56o1YAtIIbQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782994862, "uuid": "bd32c73b-e586-4d01-9dce-96397946bc0e", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782994862, "uuid": "2f85c360-d15e-43a3-94aa-957748535292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782994862, "uuid": "12832c21-ed1d-4458-ae52-471fca23eaef", "value": "Copia de pago adjunta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62aa9f9e-75ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782952726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952726, "uuid": "f4571310-e7bd-451d-b0cf-bd8123bf161d", "comment": "Malware payload (Mirai)", "value": "d386e0d0b503aa88ef9d83069b7eb8bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952726, "uuid": "614f9dd6-ff77-4cae-840f-5cba756d827d", "comment": "Malware payload (Mirai)", "value": "e36fb6c05e5136959ba0a1feb19185da2b242f808d4d1fd26d9b6664a1eaf65f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952726, "uuid": "beb1e862-b247-4530-8337-d5c9ae494a58", "comment": "Malware payload (Mirai)", "value": "b1fdff935ae93c694400c48ff9d80ba4e44452ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782952726, "uuid": "f770d7ee-baa7-46a7-8952-36bc28605468", "comment": "Malware payload (Mirai)", "value": "49135fcf632ef65949cdbcbce647c07122b467636b4c90f2da1dff1ce88b9e199f9e9ff9ec80dc5719fcbc070cf0263b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952726, "uuid": "cc820ce1-2ca0-47ca-ba87-15357114a110", "value": "T180E31A46F8819F12D5D151BEFE0E128E73131B3CE2DE72129D246B747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952726, "uuid": "9fec71b1-50cd-42be-946b-a98b19193800", "value": "3072:DNYO7m3RQb+G6dtiazQjWp6Ka7XnDpeox6c6LF8hEC:DqO7AM+PtiazQy6KgpNx6ZF8GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782952726, "uuid": "df9909da-1906-40af-af9d-3898cefe08ac", "value": 147508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782952726, "uuid": "95ccd45c-4f93-40fc-8367-09e905026a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782952726, "uuid": "72ccad87-4a1e-46a2-8953-192e8a2ad381", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6324bc-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988339, "uuid": "4a304fe1-6b94-4a43-9c6e-b956909e5e88", "comment": "Malware payload", "value": "208e0f7339f04ac50a95f645f8a126a7", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988339, "uuid": "cece1178-4930-41c9-a2a6-d04a06255f63", "comment": "Malware payload", "value": "e38b1ed4fe28e3f0fc3660394b25e3106eefa57493921be89c911283d06198b9", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988339, "uuid": "347e82d2-0af8-4f8e-968f-1fa6e9f4086d", "comment": "Malware payload", "value": "d1bd6be28f101d4acf5b5c7654ff1034cfadaee8", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988339, "uuid": "e79a2633-7c78-4100-9d04-1586ac000799", "comment": "Malware payload", "value": "7802cedc7c74a574a7f00f85490692488b6983e625a3f8e6deb78d4407a1d8556128d01e4b7e8297c60479027cec373b", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988339, "uuid": "9aba63ec-9431-4f57-af7f-da766861c833", "value": "T130155C16EA0155B9D4B271B1524FE336C8686A358527088FFF5B2D6CE63A2D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988339, "uuid": "898bf887-1272-4e81-acde-2350a2e9aef0", "value": "24576:7KHu5X1Thj3CcPdvolSa7EZX+3ca7dg5vm:7KHu5xt3hPlwSw0XQ7dgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988339, "uuid": "0a20e6b1-ec8c-4d6e-b4d8-ca3e2bcb74a0", "value": 887344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988339, "uuid": "a0bb06e7-e9f7-43e6-a776-0f85254c628a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988339, "uuid": "4ba78725-a0df-4355-b73c-0ba51e6c455e", "value": "e38b1ed4fe28e3f0fc3660394b25e3106eefa57493921be89c911283d06198b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058aa4a6-7627-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004539, "uuid": "89483805-ebf1-4f78-9559-369d91f75a66", "comment": "Malware payload", "value": "3e89044c06350bb025c8f21503a857ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004539, "uuid": "14771654-69c5-4d86-885d-0c427e113660", "comment": "Malware payload", "value": "e5066afa332141eb230a2d6870e7903e86630e17b307cf30082f76b21c635e62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004539, "uuid": "2d680857-13ed-4c68-ab12-d5ea6f5f89ae", "comment": "Malware payload", "value": "5159f34d63a78406cd7c4f369c9a7b8a836145d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004539, "uuid": "2c1bb5e2-709d-41ea-8939-232bbef223ab", "comment": "Malware payload", "value": "9b87ddfba5a0b73f71a9ec0306ee44c2b5efc6b180894df2462b30129e40231b067a5456a50c9375ab8befdb663808ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004539, "uuid": "02a9574c-4aff-4592-9b08-16dc53b3c3d3", "value": "T153F0ABAF21B2B00FA545ACD7FA6763159203EA353C40E0E4C09D8AE314FA80DC607CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004539, "uuid": "f7051746-7fd3-4fe5-8bbc-3f98efbe6c04", "value": "12:TLeKK9L8b9Ke2h3o5nRDbx98AUNUVRiyx9t:+9NCvDndGyx9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004539, "uuid": "defa9c34-0fc9-4a3c-a8dc-3c795a1a6b57", "value": 456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004539, "uuid": "4da03f55-0df9-4274-9da6-dd8cb1e3d12b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004539, "uuid": "8eb929f9-8cc6-4971-9998-e372e3681ced", "value": "e5066afa332141eb230a2d6870e7903e86630e17b307cf30082f76b21c635e62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5b4ea6-75f1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1782981629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981629, "uuid": "69b9409c-9c56-45a8-b80b-990eb9155452", "comment": "Malware payload (MaskGramStealer)", "value": "61db3334c731b75837724412493ff09b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981629, "uuid": "7b73d8be-b324-4973-9eb5-f87c77e26e1d", "comment": "Malware payload (MaskGramStealer)", "value": "e5931f6d43f7f2081e9b09803b063cc56bddaaf36f8fcd15bbb987dc45e6be88", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981629, "uuid": "20dbdd10-14f9-4ce1-8f25-cb5e5096d97b", "comment": "Malware payload (MaskGramStealer)", "value": "7c114eaa499028580b8b59338da0bbfbc23f4d35", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782981629, "uuid": "b497dd7c-9115-417c-8e11-451293571ac0", "comment": "Malware payload (MaskGramStealer)", "value": "203b0e476eaa58d1220a5a81e6809c46c269ff7c520bc2c34c8054950d42e49514b3f41823fb8de59786fcef475852f8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981629, "uuid": "c7919a5b-9f31-4c15-a9b3-ba02d3e00e6d", "value": "T182044A5BD8D540E9EC1AC6348999E237E4B3F8561936BA4F6BA0DF051F90B30B71AF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981629, "uuid": "3cebdc58-b878-4d48-8634-127d7f441487", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981629, "uuid": "765e9a77-01ab-4270-98af-88d4136a43bc", "value": "3072:zYVIoPwWJnxZAzJn4ldBxEWh1ZoPBmG0QllO7ek0ght:ubzQzV4ldBxEW/MBCQllKeght", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782981629, "uuid": "52ca279b-9d19-41da-857a-3a9497ce75b5", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782981629, "uuid": "258362b6-b84d-4530-ba04-c2d0242ae005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782981629, "uuid": "a780b828-9a6a-4ab0-9b63-f5cbb8babd8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59802831-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033456, "uuid": "b36d68ad-f288-41da-a6e6-a75077f5d093", "comment": "Malware payload", "value": "292452452facc1e8a71e5429df0a1600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033456, "uuid": "4a5a04c2-ea44-4fd9-bede-bfb98f7d5d7a", "comment": "Malware payload", "value": "e5e16639ec6ec60c5a5ebe598254f926e93e5e9c2f453ebc3225e0650b57e66e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033456, "uuid": "d6721747-42cf-49fc-bf80-a81130556a24", "comment": "Malware payload", "value": "441fb1bf5279c44789bf297870b6f6931996d3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033456, "uuid": "19c3ab17-ffbe-4f09-8576-8f41f39fc637", "comment": "Malware payload", "value": "9a74c743526bbbfa1c64bf94d247606d18e36b4256b5f093c5806596521c4d2d29420c658365ea6387fea5a2420967a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033456, "uuid": "88e2ad5b-4231-4833-aca3-27506bccf1f1", "value": "T1D26302CF7EB02A1AD1DCA1B1713819D9DC3A9D8AD643865CD3E2E796473943264CCB0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033456, "uuid": "3e8f9e43-6a85-482f-9d93-96a7cecf312a", "value": "1536:saxZLmYKVDNSl2y08yumeJyGYVmIMGj8NO:saxZLmYKX+t08jmeJhYTj8NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033456, "uuid": "123bad4e-b16b-4542-8bca-6bef18d810fc", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033456, "uuid": "101e6960-a11b-4b3b-a0ff-4d52929e1fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033456, "uuid": "fb8f97ac-a8c1-4b9c-90c1-e190279a5ca4", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba15a80d-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972200, "uuid": "c950d504-f429-4aba-8fec-b2f2cf58654b", "comment": "Malware payload (Mirai)", "value": "26c0a1633f07a02df52d782f13ec5929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972200, "uuid": "36c18f57-7c54-4396-8a04-7b175bffc51d", "comment": "Malware payload (Mirai)", "value": "e636116e7b501d84a8d042cc31a45b0042d224a0caa4e12a56539d1fde12dd8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972200, "uuid": "21e36af9-885b-4939-9a5a-d7c01d99d39a", "comment": "Malware payload (Mirai)", "value": "448a184ca957c51d449fe5837d27da7ce58e7341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972200, "uuid": "9b1bf487-e91d-4e3e-aac3-6e24e623303c", "comment": "Malware payload (Mirai)", "value": "b53062610ec574671c4630c535215f79557d11ffe82c64bd57aac3c404dc21ba4efec0912737b86d7ed669740d4d00a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972200, "uuid": "97042fb7-8cd8-4e6e-b96f-39391dbf0c19", "value": "T158835B3289142F78E5101A7161F6CD3D47137EC047630D76E18E82285AA7EEEF226FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972200, "uuid": "af70fbf1-b2bb-4583-844f-e7e1b70f2833", "value": "1536:sgfKrW70i2weNN1obEoT34KYr1JWQIXC86tyS8STp:dKrBi2nS/YCQIXL5STp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972200, "uuid": "86d1ce7f-dcfa-4fc7-8747-b0c989d995f9", "value": 81240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972200, "uuid": "d95e19e1-dcaa-4f38-ad28-97bf442e5359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972200, "uuid": "684d01b6-f3a5-4264-b0f1-f6751d508bab", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b36028-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988319, "uuid": "d80db5b7-9f24-4bfa-a797-927243c1764e", "comment": "Malware payload", "value": "1736df7efef9037c47a9437275bb38ed", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988319, "uuid": "dff2aa3b-ad49-4c51-961e-99e668d3530a", "comment": "Malware payload", "value": "e652dc912c068619df40eada64e1fe30604db75868931bf3538e279816c8f01b", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988319, "uuid": "70d77190-54f9-464f-96c3-2922b210f4b5", "comment": "Malware payload", "value": "87242c951b6de07a832287d05bf5011a53e6b0c9", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988319, "uuid": "4be65e9b-d8b2-44e6-bfb4-426df3185826", "comment": "Malware payload", "value": "796630e4f4723e885a910cb2a8144137736f68274f7124246728ff6f3ab18f8744d77beaf2925513f0ae811a3a1e6e85", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988319, "uuid": "8fe7bb91-27ac-4be7-be22-e02f05a989bb", "value": "T15725E02AE91164B5D473A0B1430FD377C924AA345667888BFF5A1C29E6392D0DF3C39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988319, "uuid": "1d3b6802-d7c6-4a48-857b-0159da87fcdc", "value": "24576:h/cZLpHt+FUSznL/L9d/ovsnREXxg8TW254xrHNiUB:h/cZLpN+FUSL/suo54xjAUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988319, "uuid": "43063447-788c-4e29-ac0f-f21c125e1ffc", "value": 985971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988319, "uuid": "e797e1c0-b44b-4020-ab05-80ae58a13a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988319, "uuid": "46b0bba2-79d2-4456-849f-114d5220ebe4", "value": "e652dc912c068619df40eada64e1fe30604db75868931bf3538e279816c8f01b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c77c8d1-75cf-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782966782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966782, "uuid": "42eabb7c-fcc0-4cf8-b21e-7eff294d6ec9", "comment": "Malware payload", "value": "2a779910d43dd427d257c2ab12ea04f6", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966782, "uuid": "be567b7c-6524-4208-8354-d4a8fc83c2a0", "comment": "Malware payload", "value": "e6c5297e3631002646b7aca0aeaf880309e6d9213312ca63ac611554abe4f0bd", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966782, "uuid": "70556190-0b44-475a-8146-e9d3923a465f", "comment": "Malware payload", "value": "6330d2905e781c9f989f1ba71678e09c6906bdac", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966782, "uuid": "5ab73c08-1cea-406d-8c5a-8bf866ff52a2", "comment": "Malware payload", "value": "4ccc177be85aa678f53d1036be29dcce44880c40ded2a5e31651b8127eb8cc22133170045b19da958eec89cc50999ff6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966782, "uuid": "01a5f0d7-c71b-427b-8d18-f40efe7789cb", "value": "T1977733635138054AE5F4C97A8B7B7DB134F61E13D28378B9A9F97CC83A76492FB02112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966782, "uuid": "339d1641-b5c9-4620-9b22-137020900c5c", "value": "4252eb6498baaf4bc374204dcb6adbc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966782, "uuid": "9812c26e-93be-421f-b5c6-1eeeeec162f8", "value": "786432:AIsk773j4fCeTmdVVrAgrjMOnkuLg3YQmrQMxetnWpYqFGgT/x3:Psk773EfCeCdVVrAmgOZLg3YIMxmWpYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966782, "uuid": "2e655edb-d4f2-4235-8618-aeb2331500b3", "value": 35528192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966782, "uuid": "c984b1bb-b9c9-4a79-a91e-6c42eed55916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966782, "uuid": "7b360b32-5b45-4cf4-b7af-d5d208133780", "value": "libtcmalloc_minimal.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93587bb2-7618-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782998334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998334, "uuid": "42773aad-6961-4813-a8d8-6a7e9f1a4237", "comment": "Malware payload", "value": "e4d5d6a650a96e75df39b4ece65e7c91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998334, "uuid": "b0df590b-4516-47d3-b451-2efb35685bb1", "comment": "Malware payload", "value": "e7375b5f9b8f693b5ad0104f27669bc3b9aeff66c0bbfdc7b0df365cd95a5c04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998334, "uuid": "78c72a63-edd7-48f1-a567-2ce63e77d2fe", "comment": "Malware payload", "value": "53fdec81f9cfb34419ffd34b15bbf01c1dd3de5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998334, "uuid": "17c9c01b-f910-4cb5-aff5-c31df7236edf", "comment": "Malware payload", "value": "04ea2783e38a73b2f8ad2e7e62bfb4c5950678c65961cb315a0434eccbb6c0f15159fd4ad2e3fcbe7b9794505fe73a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998334, "uuid": "de4da475-710d-472d-a7d4-c9ab2afca265", "value": "T1FB731959F9816F15E5D625BAFF4F424933634B6CE3EE7202AE209B2523CA91B0F37405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998334, "uuid": "528cb844-340e-4b90-93bb-c91f18926f48", "value": "1536:ldngMnbYvGJgeYly5nOjIja42xn6gD9oaClgqziOnP4vOnDYvZlbIR6x:svGJHkjIja42xn6gDQ/nPGIDYvTy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782998334, "uuid": "2b2aa524-f324-4b2e-88e0-89b980ffbbd2", "value": 79200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782998334, "uuid": "6b199f35-ff73-4233-8850-61fe01d08fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998334, "uuid": "f3b234b1-a8bc-4335-8d14-7e0c38820b89", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90658fbf-75fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782987162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987162, "uuid": "e80e6e21-d35d-4872-9433-6e432123de3f", "comment": "Malware payload", "value": "bc78222a223a547d0fc2e42120563510", "object_relation": "md5", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987162, "uuid": "60d88786-22e4-4d16-b65f-7e8ed9418718", "comment": "Malware payload", "value": "e9477b40ffa44146db08486568d1cf5344a853918afb79eea87268fbcf8f80ad", "object_relation": "sha256", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987162, "uuid": "766d2cca-6693-409e-8ba3-af6b664de4e8", "comment": "Malware payload", "value": "0e115092f09afcadbe82ef0669748ddb5caecd93", "object_relation": "sha1", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782987162, "uuid": "fadfcb5e-85f0-4040-9d80-6f081c13d5fb", "comment": "Malware payload", "value": "51a02f29af89eda819d8dd46f38f1815a23dd726cd5ef19b79864bc57b405db97be38beb10c0aff4832e9fc82206cbcf", "object_relation": "sha3-384", "Tag": [ { "name": "103-217-253-16", "colour": "#48ED2D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987162, "uuid": "21d21130-132b-4e2b-ad5c-e94d0fa8b413", "value": "T1C63199B0F8216E2AF64811B49E4CE46B8E5FBCBF06002D172983ECF4702B809B522534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987162, "uuid": "100b3b14-faf0-4d26-847a-bd2f203f7417", "value": "48:JGn2EcNj+E86PC8+HQNQuIHGTQXeataMlV3Q/hHFB:sn2DjpA84mUXinB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782987162, "uuid": "5b2258f0-a5d5-4f5d-b75b-bbbe7252f748", "value": 1730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782987162, "uuid": "df199866-8021-4dd5-8816-f4c9be65732e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782987162, "uuid": "55005310-0905-4673-8374-ee65605fda01", "value": "e9477b40ffa44146db08486568d1cf5344a853918afb79eea87268fbcf8f80ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b527d0-7625-11f1-ac1e-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1783003945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003945, "uuid": "5ca0f515-e786-4611-88b2-6a3abd0904d3", "comment": "Malware payload (GuLoader)", "value": "0b400372039ffa4412f76ec1fa7a4486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003945, "uuid": "78395805-d259-4f0b-b8f6-1208096b81ce", "comment": "Malware payload (GuLoader)", "value": "eac05791af7cd178ae0c017b225dcefbbf860b4e927fe8045ba7f57636bb91b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003945, "uuid": "0f0250cc-8faf-4887-9e33-a5c10b704df0", "comment": "Malware payload (GuLoader)", "value": "3d3558bb8c02dee4f8447d7dbc560183b9dc4bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003945, "uuid": "79779c20-e244-43b5-9084-727638dc9c9a", "comment": "Malware payload (GuLoader)", "value": "2717b0b6b55f57a7d7776007346b2640bddeb29ec79a5bcd4b64c84fcdd8f520ecad89c75780b3a1f1c3490ec0053d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003945, "uuid": "302d684b-5b0e-4c63-869a-81709d8cefe0", "value": "T194841222FC31F927C6289A704E7A9EF50ABC8F6E46257A1B475435BCBD71342560F2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003945, "uuid": "c49197d6-4e7e-4439-8d6b-1f12a264b08b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003945, "uuid": "58734449-9ef6-48b1-8c27-31b34783ff9d", "value": "6144:aGMoidXz0d+jF8s7aiAzOjoK8QVR2NV7h7DbG+yXi9odFMGfNARkkrs2:aGsXZjF37aH9qR2NVd7Di+3o1AyZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003945, "uuid": "b3da0770-13bb-48b4-814e-2c134ab890fb", "value": 390112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003945, "uuid": "9476834b-da7b-479c-a391-61ff197a0b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003945, "uuid": "dd478ba1-41e2-459e-ac1f-1795f53fba39", "value": "Nuevo orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e659c1d8-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XenoRAT)", "timestamp": 1783015224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015224, "uuid": "b70874cd-3cc3-4791-9b2b-3e02db509b0b", "comment": "Malware payload (XenoRAT)", "value": "0697eae9deae7c2d4039d83539811f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015224, "uuid": "caddd83b-190e-4804-93e3-3bb3c046b92b", "comment": "Malware payload (XenoRAT)", "value": "eacea4983eb01cabe9f621d7b28ae37cbc3e801106575272795e025de1064a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015224, "uuid": "ac72f583-0e75-4bfe-8e37-62192ba544f7", "comment": "Malware payload (XenoRAT)", "value": "242191dbed6393d77c73d5f289512ffbaecc4521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015224, "uuid": "69878bcb-5839-493d-b63b-7629eb5bbb92", "comment": "Malware payload (XenoRAT)", "value": "dcc7b6f9e9014d0ee0d720ca47c1e235af6b285c412f8e8ed9f54091698009d4dd5c628e0914402795b9bc65c0aa1380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015224, "uuid": "c3e72c43-cf8c-42e2-add1-4d8e31467bc3", "value": "T1EF33094C5B9D8927F6AF5ABC9832426387B3E2269532E38F0CCCD4E9379338555053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015224, "uuid": "ce54aad8-9273-42cc-8fe5-3ea40219563d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015224, "uuid": "7f8f0e35-f6c1-46b3-a442-5a583781789f", "value": "768:fdhO/poiiUcjlJInCC2H9Xqk5nWEZ5SbTDaKuI7CPW5vIssxzCsLy:Vw+jjgnz2H9XqcnW85SbTPuIoTHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015224, "uuid": "4a27a4dd-1da0-47a3-a428-5e47eda13d1f", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015224, "uuid": "430c1798-03a5-4c86-8d2b-a49dec43be26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015224, "uuid": "9facdfdc-1187-4b71-b7eb-bd57c2ad2b01", "value": "0697eae9deae7c2d4039d83539811f17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3551341c-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006337, "uuid": "6460ecef-e02a-4a38-ad96-ee0e73426446", "comment": "Malware payload (Mirai)", "value": "e7b33d580cfc81d178910ec5765d4ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006337, "uuid": "af809fb2-f081-4bf5-a709-48b096e49baa", "comment": "Malware payload (Mirai)", "value": "eb7903b693d907663668ba89f8bff36be11cbcfd9a107565123f980ebe147585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006337, "uuid": "79a3b0af-7ce5-4727-b768-6b2b7e69ed0a", "comment": "Malware payload (Mirai)", "value": "4595199d9d904d1f7bed6032c2eecffb697985b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006337, "uuid": "09965c37-a426-4549-aae6-ab1dbbb70c96", "comment": "Malware payload (Mirai)", "value": "0728610744bacff0d4ccbf9a1183180298a70a7be541988cf95170e6ff5abf3c5fc0ace324495e49cac2e0b6c379aa9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006337, "uuid": "c1cda7eb-ec5a-41d6-96b8-8b59c461dea1", "value": "T1DDE30A46F8814B12D5C111BAFE1E528E37131BB8E2DF72029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006337, "uuid": "68c939b8-fbca-4cf5-b051-cd1a37059e43", "value": "3072:yneaYCrpUau4JQXkDjTzRayRo6dNV0/4DLq:KevCrpNBQXejT1adO0/4DLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006337, "uuid": "712856e6-8a33-474a-8c66-c9d717c7ff06", "value": 144124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006337, "uuid": "72339d89-d5e8-49ad-817b-c2cf3f6780f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006337, "uuid": "7305fbec-cadb-4cd4-a56c-f8df7de04a96", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6843b0e0-75f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MustangPanda)", "timestamp": 1782984948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782984948, "uuid": "9a934a09-7429-4661-a15f-d54cea1a275a", "comment": "Malware payload (MustangPanda)", "value": "028c8658580e8f41da4202a141527f2f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782984948, "uuid": "99abfc91-ed9d-471a-8033-6f1ebecefa2e", "comment": "Malware payload (MustangPanda)", "value": "ebd533de7ca16daa70093b0b1084fb6136b6ba091d6ee0e4199762581e1b2e5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782984948, "uuid": "025ec273-3367-4642-ae2f-b9836ede53d3", "comment": "Malware payload (MustangPanda)", "value": "747fa43be6508a256ad19b9cdc78215ffb5e355f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782984948, "uuid": "fa96d203-20f3-40db-9f0c-3cd1b03df5ca", "comment": "Malware payload (MustangPanda)", "value": "929ab067f9b04e6f0543af42561dbe14083ae5d96ff30ee4473314820d39bb5cdc134aabc13815487cf028401219f370", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ShardLoader", "colour": "#CF8EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782984948, "uuid": "e59456fc-94d8-4dc1-ab9f-30a654f0bf21", "value": "T1910439C171D0B0B5C5FA15390D6247FD0E5E78309B36D9ABEE8BB1659DB84E21A20B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782984948, "uuid": "c593b4dd-4d16-4f4c-bf27-ed7fb5fa68f1", "value": "67285adebb23a85ac78a8132748a8e02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782984948, "uuid": "480b21c4-d47b-48c1-b646-3f802faaa61b", "value": "3072:UEjI/dDYjeWeIM77tXePyuW+ox2uUqxmbPV4xp6U+TxnMi4n8HGMIro+gSxRk5ol:jKez/UrxlphYRxn/VAwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782984948, "uuid": "92174a9f-6c6d-4b95-b151-99b60fb63a56", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782984948, "uuid": "6fbba4df-ceb3-41c7-a126-64a22f9d1898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782984948, "uuid": "70096bc3-84a0-4206-a4ce-c1bcdad0ee76", "value": "ebd533de7ca16daa70093b0b1084fb6136b6ba091d6ee0e4199762581e1b2e5a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e12d37-75c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782960407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960407, "uuid": "45237f21-14eb-46f6-b7bf-96f61931880b", "comment": "Malware payload", "value": "8e0aea2832cf3aa3e160438902aee0bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960407, "uuid": "d245dce3-f952-4e5c-b58f-0eb2d676bebb", "comment": "Malware payload", "value": "ebe4bd445397393fb554db6554fb37afd31d0a30d309df8194901104027c52cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960407, "uuid": "3503d95d-6b6f-475d-b36c-1cdd1b029634", "comment": "Malware payload", "value": "2436bd33c86ce7827f8c540f36871fbff8767ec1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782960407, "uuid": "b3ba420a-61f1-48cc-bf92-ef233223b64f", "comment": "Malware payload", "value": "59f570db62d57fa5c443fe002bd627393366c09323ed805b450cd22ae064383dcedab3fc6c2d2263601f251d30af096d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960407, "uuid": "0b74b2bb-4e2f-4caa-b07b-6c8bb978f6f2", "value": "T1330341D345D6F84BC5984655E74E04F92ED383D1F920AFAE1E0568FD8858A3F42E88F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960407, "uuid": "8f1eb9d5-f04b-4287-8520-9be3bd9c2803", "value": "192:1HaDDrHRHgSfbCFhfxC6rEyoyzEOzs8wRyqOD+LC4ze7Upzttnwls6:1CH5GFFxCyiOusqs7+e8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782960407, "uuid": "2c07bca9-402e-48e9-b356-5b715a483db6", "value": 40652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782960407, "uuid": "17d28d17-6f84-439f-afea-ddfed06af454", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782960407, "uuid": "ba78a191-ecf2-40d4-a0ef-eaa7252fda77", "value": "Order_Specification.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae2b2cd-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010749, "uuid": "5c81d868-9f96-449b-b081-bd3050174384", "comment": "Malware payload", "value": "215703d309f57146dd09d8837f17f79c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010749, "uuid": "d8858384-b23a-4cd9-9509-d938e87e3dd4", "comment": "Malware payload", "value": "ecaeff0febfebc05c5ba5696c6dcfdea151b335ffe40179b078460db7ccae989", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010749, "uuid": "4d9d6a81-6bb3-4d52-b471-e10d65361c2f", "comment": "Malware payload", "value": "70fd864002f76da0a8e6fddca19deed03a93d693", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010749, "uuid": "67d984d5-18d9-4ff2-a9e7-7e7396fc61dc", "comment": "Malware payload", "value": "6acc44c780de7705921fd6cfc691faba320cc94f930298e1ceb5dd193145fbe3e5969f02745c4b41fecf6ed3a941f406", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010749, "uuid": "fc068c56-8d28-4b0e-aee0-d7309f658b46", "value": "T141367C30BE7C0279C5DF95B69E3E366F4D5EAD50072842C75168385AB870AD23633E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010749, "uuid": "71b449dc-496c-428c-b052-53857666c3cb", "value": "8ecc878d13a6caf5bd189bc362a5bc76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010749, "uuid": "552f4c3d-37fe-491f-9541-892f916c2f87", "value": "49152:P6X4Si1b8x7tHI/q5tJy1Y8e+9Jjvjnz89YmsOG805JJODHtgxDyQS01z9Cs4:PY4Si1AIy5HyO8e+nv/esn5C70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010749, "uuid": "a7d0216c-0a20-4278-a0c6-b0a7c4519c53", "value": 4883456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010749, "uuid": "3abbdc71-de40-4287-bba1-cc976e65a782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010749, "uuid": "5aa9a86b-afa2-47ad-993e-f9777cfd27dd", "value": "BCGCBPRO1100u100.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd385e0-7601-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782988311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988311, "uuid": "9ed7c6e1-c678-425b-94b1-f1f34806100e", "comment": "Malware payload", "value": "9c04b4363c5b437f4bf12c37f3f6308e", "object_relation": "md5", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988311, "uuid": "70a0a2f8-84a4-403b-a9ef-3cd97f5015e0", "comment": "Malware payload", "value": "ee823cd87f2ac02257a343a7ea1a70017c326caf3d011c29506b31011223671d", "object_relation": "sha256", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988311, "uuid": "d6a54087-bb28-48c7-b6dc-38d56b271300", "comment": "Malware payload", "value": "151d2dab1568c5b70aa7ae9bc651575bd20cb4b7", "object_relation": "sha1", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782988311, "uuid": "028c5d68-bb8f-4259-b93f-a9aeb87bc8df", "comment": "Malware payload", "value": "92f38af022e978299180e34e6f3c6b815ecac5f8c23fcb103bb4cfc2fca35fe8bb022cde5ae83cadf974d2a6e467ed5d", "object_relation": "sha3-384", "Tag": [ { "name": "criminalcloudflare-online", "colour": "#B9D76C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988311, "uuid": "fb1b62cc-0e12-4450-a5e0-f0b75635af35", "value": "T121155C16EA0155B9D4B271B1524FE336C8686A358527088FFF5B2D6CE63A2D09F3C387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988311, "uuid": "032ad254-431f-4db5-afd3-28c3b7ca3f22", "value": "24576:2KHV5X1Thj3CcPdvolSa7EZX+3ca7dgbvg:2KHV5xt3hPlwSw0XQ7dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782988311, "uuid": "21f96d28-115e-4d25-bc8d-230f7c61136b", "value": 887344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782988311, "uuid": "0ed33291-8a50-421e-ac28-f5715e4f79f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782988311, "uuid": "e3ecd686-9f59-4bc1-ad81-8793c4f245a9", "value": "ee823cd87f2ac02257a343a7ea1a70017c326caf3d011c29506b31011223671d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfeeb74-7663-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783030511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030511, "uuid": "48036ebe-9fc9-4dfe-8bf4-50ca3a66e642", "comment": "Malware payload (ValleyRAT)", "value": "27d3039a8ca9acbcbc985b88f27720a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030511, "uuid": "7e72b960-04b1-4322-bc32-43fe242ea3c6", "comment": "Malware payload (ValleyRAT)", "value": "eeb2d44d0f86670ac2ee5e0b7aa44ec41b7be9962359f59ac21f736d7b0e7889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030511, "uuid": "5d6ccaaf-b040-4ffe-96ab-0339f3a2727d", "comment": "Malware payload (ValleyRAT)", "value": "16930eeb661537d9c34578174dfa6a0f2f00cece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783030511, "uuid": "1e806391-ea39-4a7a-b530-bf5a66aa801c", "comment": "Malware payload (ValleyRAT)", "value": "ef26dc9158668504dd854c673449dc2105772ee516c275a781feb8ba0466acec45a3b3792b7179b8cdba8e35c628faab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030511, "uuid": "18f0f021-2183-4688-8944-551eb417ac92", "value": "T15FF5F123B2CBE03EE05D0B3B4572A25894FBA7617523AD57DBE4849CCF260601E3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030511, "uuid": "7cea77c5-29c4-448b-815c-55b54e331b07", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030511, "uuid": "6740fcbf-c496-4c15-9668-7ece184f4e8c", "value": "49152:4+MRvHGGpdT5RMSKx/l6IhcLKH6D+z6tUpnJhG6uLK67MZ2Z9ftchfudg87dqn76:4r+GT/MSKH+i6DjQJU6u2+MYchXqdnMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783030511, "uuid": "03d814d7-1bb4-42cb-a63e-de840a3f9d1c", "value": 3404305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783030511, "uuid": "fe53ce3e-3054-4588-a1d2-e11887abb912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783030511, "uuid": "55528b30-ae37-4d26-bfda-b72a310e8065", "value": "27d3039a8ca9acbcbc985b88f27720a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae86e85d-762c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783006970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006970, "uuid": "7ca175c3-3cc3-4c74-871f-652fcc00ff29", "comment": "Malware payload (SalatStealer)", "value": "9992290015ca21f58eab64953830a94d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006970, "uuid": "dad824bc-239f-42c3-8967-dc5dc33ecaa1", "comment": "Malware payload (SalatStealer)", "value": "eee97b264c2b0b6488dcf397800e16ac196ec495a6abd3c2623a020c36acdfd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006970, "uuid": "5990a0ae-0bd6-451b-9b60-dd257870ce62", "comment": "Malware payload (SalatStealer)", "value": "26dc16413bce56a9da5deae93a6fcf1e53dcec7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006970, "uuid": "62d9ad4e-2c53-486d-ace3-f96ba1ae8ec1", "comment": "Malware payload (SalatStealer)", "value": "2e6c6695f236cab89df441f0cda594ca4e2f9786f5cf5f2e396da500f45735afc004478528fea5d0626ecd1cb1e418a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006970, "uuid": "b435448f-5aac-4183-bfb4-be97e87c677c", "value": "T15BC66C11FACB54F6F9035831416BB27F23315D048B24DB9BEB583B2AF87B69118BA705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006970, "uuid": "e2da063d-b034-4564-b116-aa977cce7ed8", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006970, "uuid": "f2cd4da6-00eb-414b-b1fd-8c05b4a1832f", "value": "49152:0TKGTYgp5N+ogspZt9h46zDCjvJ+cwtO+diRKGt5dxvVO3U3uCl3CX/V15sajwuc:/GMg3ZtTVXCd+yZt1Mg+4l1EgO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006970, "uuid": "da1cd0d4-1abd-4b25-b0ba-da4507edebf8", "value": 12569088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006970, "uuid": "7cd48870-19de-4bb6-8569-84f1c9256784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006970, "uuid": "10fee39b-5112-4f09-af1c-384ca108830b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d543665-7619-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782998727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998727, "uuid": "a0c7bd68-2c0f-4208-916c-d72b9a33bf69", "comment": "Malware payload (Prometei)", "value": "6e5112cdded01445a69c1cf7342537e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998727, "uuid": "8b623ac1-dd1c-453f-bb26-2abe24725d73", "comment": "Malware payload (Prometei)", "value": "ef00389e3fb080dc811a7b0793ca481294191eac1d57fcc2eacf1af544c28a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998727, "uuid": "a486198d-b968-47bc-bba3-6be70562d4b6", "comment": "Malware payload (Prometei)", "value": "2e063f00196cefaf71300ba952adb77a500f3cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998727, "uuid": "c0da0538-135e-47f2-a3a8-bfa1b690ec2f", "comment": "Malware payload (Prometei)", "value": "95a1a53857a2e1040bea63c15542988b5c70d67c0b3e663b4a559711a1cad7fb6b2103526873182322b1c8d0f8c8a727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998727, "uuid": "e5825e3e-1543-4fb3-b255-21191399aaeb", "value": "T1A5A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D632AF2CC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998727, "uuid": "62c5a702-8a40-4e4d-a1b2-5c050069bfdd", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsde:Fs6pyCC/Ya2hpi6T6N4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782998727, "uuid": "43679a9a-17a2-4544-8cc4-ca3709f65771", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782998727, "uuid": "418aeeeb-1387-4a2d-8b83-a3119b1e982d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998727, "uuid": "eea7f57b-06ed-49d2-817f-7744d923f763", "value": "ef00389e3fb080dc811a7b0793ca481294191eac1d57fcc2eacf1af544c28a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76113d81-7635-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783010741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010741, "uuid": "d5d4d6ba-0923-434e-9abb-d2d9ab92d93f", "comment": "Malware payload", "value": "82acab57b3e352aa57c2bff056beb246", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010741, "uuid": "3c46b4e5-0704-4687-bb7f-af48ed2ad962", "comment": "Malware payload", "value": "ef1e01dedb35d8f1c7612ab3fb202ccb3503e0d004f60acdf0bd354aedd05a20", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010741, "uuid": "21923079-770f-4b05-a7a7-c72ccf3eba4a", "comment": "Malware payload", "value": "67343bcdaa581a8bd0abca42642376d25b580be2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783010741, "uuid": "62e42e04-e531-4049-863b-f5176359ccd3", "comment": "Malware payload", "value": "e6ffa60c0a4ab4b0404cd05469c7befb418660ebbaae87ff52c987109cbdfe92056d19c43fe5a7f6897d8094552c7666", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010741, "uuid": "7b5fc6ae-2b87-4af4-aa4f-92c9318f4506", "value": "T1F6763396F98679B4C08BE3B18257627D72153FD65E685E0AB3D9B71C1F33B1408BAB00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010741, "uuid": "475dc778-f55e-4aaa-a6b3-091eb917df41", "value": "196608:3i2hjUNX0bBi9D2tQ2RKuEPS9UmkLUBtCCR0TBCFbxt:3i24XKBODoQgEq9UmjtCCmTBAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783010741, "uuid": "d04c24c1-5f0e-4861-90d3-7178eaf6c20a", "value": 7278592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783010741, "uuid": "76ae3037-ac58-44e4-a24b-63228ec9978a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783010741, "uuid": "150047ac-7542-411a-b04c-81bc7dbcbb13", "value": "zintall.6638250001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d04c2e-7604-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782989614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989614, "uuid": "d41616ed-621c-43b8-858e-52037b3a6d68", "comment": "Malware payload (RemusStealer)", "value": "c8f8e2ba5b5f6bfc812db4797a8d9c09", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989614, "uuid": "73225ba2-c6cd-440d-b515-f95871295e82", "comment": "Malware payload (RemusStealer)", "value": "f0b40aff6844b4063b24c3fe2c48513641104c16f2d8a3b95293391295776dfd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989614, "uuid": "6dab7cd5-6d18-4d92-beda-43cd1626fda5", "comment": "Malware payload (RemusStealer)", "value": "bbf919832e1407b1a9f3b388e78c74652afaa6ef", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782989614, "uuid": "c37328fb-4140-44f1-a013-443cbded9e04", "comment": "Malware payload (RemusStealer)", "value": "8e6992221fa0ce8561729118a3d2b1acc1e52b08b47f1721cf974cdca156ee7f8c7d34eabe24a2f16c7e5f28d0bb6408", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989614, "uuid": "3d21a3f5-78cc-4cb2-bb8f-fd0aba74c9f9", "value": "T170664A07FC6518E8C1ADD63189A29262BF217C495B3523D32F90F6283F76BD0ADB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989614, "uuid": "06403e91-1aca-406e-a449-332ffcd64cc0", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989614, "uuid": "c66dc7c9-d679-46c7-b1ed-029a67fb1d63", "value": "49152:lDgb0RIAp1c+6iZxAp9abOWLjASutjPsO9N0uDX4JPIErPjhuAO9iOCfwgBrKQKM:lDAcp06jyPD8nZOQBmtuKqEIsSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782989614, "uuid": "f99e8fed-c8ab-45fd-afce-81ff48838948", "value": 6873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782989614, "uuid": "bf86060b-8610-49d8-a11f-af54c5ac50df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782989614, "uuid": "6caf3883-7e89-4380-90fd-cdfcdbbc7163", "value": "Phantom Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c11040-7625-11f1-ac1e-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1783003791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003791, "uuid": "5efb3a54-3404-4e59-809c-a01f5a6abe77", "comment": "Malware payload (GuLoader)", "value": "52fa117b71c087d3b0bad27cdafd803a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003791, "uuid": "28d97d94-32ce-4206-9dc5-46fca4c9cb22", "comment": "Malware payload (GuLoader)", "value": "f0f153962115ea9c51c8591360d45d483ea4700475a66ec09213eb7832d6410d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003791, "uuid": "5050dd8d-3daf-4285-b2fc-dba79b82ef77", "comment": "Malware payload (GuLoader)", "value": "e875004990f5df84d12aee0e17b4dc2ee91b925f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003791, "uuid": "d2952018-d5ec-41ac-80c4-1e10d41805f0", "comment": "Malware payload (GuLoader)", "value": "7716b0280c056870a0d53d8098d08fa19837fdc674873e3195505ad3a3fc3daa2bbb61955bcc5a5d77b2442ea48f7ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003791, "uuid": "a243e63d-903d-4530-837c-782c2bb9c625", "value": "T11B841246FB30DD27CE5E853059399FF92EADDF2E40596B2B17003698ACB2341621F356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003791, "uuid": "1cf2bf55-b33e-41a4-9166-c28a8df5c552", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003791, "uuid": "46b3d457-b680-4fbb-a315-a2d9d16308ad", "value": "6144:ZGMoidXz0d+jF8s7aiA3fqBi3FfLTV+HXh/xF2SxStRoPD:ZGsXZjF37aHP3FfXV+3VqS9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003791, "uuid": "f85cfc54-72f8-4b75-966e-21e639ac3753", "value": 397416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003791, "uuid": "19e400cb-330e-4f1e-aa25-ee28a8a1c602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003791, "uuid": "66784592-94af-4ccc-ab6a-55a488bbc7ab", "value": "OC (Orden de compra N09991212).xml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d42d96d-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783033462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033462, "uuid": "728ed92a-3aa0-4f57-acee-f7bc5a956983", "comment": "Malware payload (Gafgyt)", "value": "b43c06732fcce85cf6e5c80be7a71769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033462, "uuid": "58852ed1-e72e-4f62-a133-236f33d17c19", "comment": "Malware payload (Gafgyt)", "value": "f0fba59fac26fe8a909040d381156f5db6c7c03d47a723b6545e47a5377d59bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033462, "uuid": "a437c08f-7618-4b4a-8f02-d3bc85ecd787", "comment": "Malware payload (Gafgyt)", "value": "6143a72ecdc8f50493e27d90ef51788b5bac835a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033462, "uuid": "a6d5e8ec-2a83-48a3-983c-5eedc6457e97", "comment": "Malware payload (Gafgyt)", "value": "c69b011fe5835e953e1b1ef17b1e2a57b9ed5685c0e12c7fe2409e542f3ddd640e2782e422b6c11733b0a89853cd5413", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033462, "uuid": "678a15f7-1659-4a24-a2ec-6575e8de3092", "value": "T1D2D3B021E4006DD1EC2129F578BA97B80350EE700BDE5582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033462, "uuid": "d590dbf5-0fbd-4cdb-aa77-3a536fd7f0f6", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xU:PiySSGp+PMmT7zMplq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033462, "uuid": "054f426f-3e93-49e7-9488-800791444673", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033462, "uuid": "ce1d590e-f53d-4cd9-bbbd-119b0628010d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033462, "uuid": "845b553a-8967-4cf4-89f8-55841a3350e0", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb631c3a-75f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782985114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985114, "uuid": "b395ce16-6b0c-47d2-8ee0-ff24451b749d", "comment": "Malware payload", "value": "ad1d161282dffec602c59b18434ee492", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985114, "uuid": "84b07ea5-1249-4cea-b136-9e80b4b13b35", "comment": "Malware payload", "value": "f2bed071676feb831ed460489643fd57f6c6c1e0d024a1ea447820276fb13828", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985114, "uuid": "ea7b4f8b-7baa-445e-9529-e0f1820acbe4", "comment": "Malware payload", "value": "9899e7195e1143f746f1e86e92029d813e1baaf8", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782985114, "uuid": "04a13152-b89e-40bf-9c8b-4780c39f3388", "comment": "Malware payload", "value": "85a158d5a838e6d270a08d89696304877f3127e706a65695c8b97c8e5e985a737aa726e64c3a21ae7af42b5323aff5d7", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "ZohoMurk", "colour": "#2D8854", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985114, "uuid": "4868f527-0ecf-40e5-80ce-95f589c3ed7b", "value": "T1A2B55A20EA41A019FCEB05F78AFE10BC656CAEB047D854D381D56AEEC32A6E17D31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985114, "uuid": "ce63df11-a02e-48fc-985d-aafc6c57540c", "value": "40113fcd39deadb193afb7f7e7fe1b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985114, "uuid": "fe98d064-8b74-4ffa-9c99-1499e566c48a", "value": "49152:eXe14sO2btdRmynOgGxntpQ9cm6Ki2nMq7y8cTJ0O8K0:eX042ZdRJi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782985114, "uuid": "12d027dd-711f-4707-98b0-5ef477c85891", "value": 2391552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782985114, "uuid": "754710f6-e352-44a9-bfcc-3e2c7c5158b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782985114, "uuid": "fcee98ba-b5b4-4583-907a-56884437a908", "value": "f2bed071676feb831ed460489643fd57f6c6c1e0d024a1ea447820276fb13828.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acde6e6c-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966594, "uuid": "8bf6349d-1980-460e-bf6c-da2712a157f3", "comment": "Malware payload (Mirai)", "value": "f9dee161da5d155d3d9d9dd5682169fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966594, "uuid": "b812394b-cf31-483b-944e-56a3d0026e79", "comment": "Malware payload (Mirai)", "value": "f2fb50c771143507eeb3a5753bab53a8c87c4dbefe35adfa65dfb1a98e1c7639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966594, "uuid": "1e08bc4f-10a2-4847-92c0-0a1366f6c3e4", "comment": "Malware payload (Mirai)", "value": "99d59703ba0b14876283af2357a044ec47f08262", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966594, "uuid": "45628a7f-53ab-4226-b6d4-e11a1c354354", "comment": "Malware payload (Mirai)", "value": "8a5c5980dadaa4fe9e3e1b1244fba6cad94c694124a545dc177fe7ea2560f47779549329bd9ca8bedea3521eb8c93b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966594, "uuid": "7592d12a-1a85-482e-88aa-44f0a5331939", "value": "T18A533AC1A983DCF2DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966594, "uuid": "eb009928-4e1d-4ae3-9223-c5ccc6926303", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5Bs88oUqpY8+3UoBiAGpTLE:VMzVhePlkmetvBcxJhyu5B1QqpE1oAGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966594, "uuid": "bba743a3-ee24-4ed9-a836-34878daebc05", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966594, "uuid": "fd731480-4cb2-47a1-9619-f47e8d144253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966594, "uuid": "38fee660-de6b-4748-889f-85ad62e51ded", "value": "vcimanagement.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bacb53-75e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782976546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976546, "uuid": "27f22104-c698-4442-9b1e-989423125052", "comment": "Malware payload (WannaCry)", "value": "27eb875cdd50b0c0ee58a389779ded2c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976546, "uuid": "bb16d342-6b79-4433-84bf-e36d85e9f9ab", "comment": "Malware payload (WannaCry)", "value": "f34dc503d0bd569065b8ad2460bf2ccc8d56a901840cf98a93e3215abfeb3e49", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976546, "uuid": "c6ab6326-7cbd-4270-a228-e14cf1ca7872", "comment": "Malware payload (WannaCry)", "value": "e67ea5d535b156f9e54f5bacc7aa4cb5602e589b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782976546, "uuid": "776115a6-d6e3-4b99-b64d-0447d0d380a7", "comment": "Malware payload (WannaCry)", "value": "59d138134a1a712f0d43be017521ad939db06dd9e4fe8d9e6142f8fc28852f7c2796194c7c69b31cc1323b49d3a0490e", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976546, "uuid": "a67d815b-e122-4859-a832-97216ee24a19", "value": "T182B5235531A8C074D103157488F7CE62F6B2BC2A17BA594FBF904A7E2F23B92E715B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976546, "uuid": "98a6ef48-c514-412c-8039-fbf9ad2309ff", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976546, "uuid": "20a41c95-de76-4288-898b-e19139f302c0", "value": "49152:jnsnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMpyfBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782976546, "uuid": "2675faa2-d4bd-4112-ace0-b90bff835795", "value": 2410496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782976546, "uuid": "0c97e5c8-585c-477f-8bf2-4f6efe42c7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782976546, "uuid": "ccaef1d3-6c68-4e28-a687-643abb124737", "value": "f34dc503d0bd569065b8ad2460bf2ccc8d56a901840cf98a93e3215abfeb3e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec48f9e-7631-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783008930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008930, "uuid": "5b3aa6d6-0293-4f92-8d7c-8f7707b67225", "comment": "Malware payload (RemcosRAT)", "value": "c2c4fcaa0b2a62e71056e0d4f7411f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008930, "uuid": "cc30632b-b1e0-4b6e-9fdc-b66bfd464b89", "comment": "Malware payload (RemcosRAT)", "value": "f37d19918ca9a92945198b23ab4e10be7d681e4aa1f8dfd1b0905482a006e7dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008930, "uuid": "dd0aac30-f621-4402-845c-961dd7c5e4eb", "comment": "Malware payload (RemcosRAT)", "value": "6d2c4dec7124013ede8472a8cc4af34dff96f2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008930, "uuid": "78103a16-f16f-4d49-bbbc-d0a4977befdf", "comment": "Malware payload (RemcosRAT)", "value": "2994ff3349d2303c19253fe2dd4e19c1a87cd67bd935b3f5f41a3a1ee7fa4763b2e2001c69268ec9d8ce98f4ab3bac60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008930, "uuid": "3486cdc3-3e17-4798-8638-75188598db46", "value": "T12055021026EEDA01E4B64FB80872D2B01BB77D996931E20A4EEC3DDFB777B415814792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008930, "uuid": "098c2182-3a8d-4d81-9b24-e737cd76c483", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008930, "uuid": "7311b789-9419-4d88-b1dd-8b5c55c4bd3a", "value": "24576:ja6UwZel6gjdS1AWlTePMrP99wVWjy1TvPCL0k:ja69ZQ6ISuqB9iTvPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783008930, "uuid": "b03f66c4-5dd4-4a7f-a92f-690e1de9d77e", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783008930, "uuid": "d1843a02-597b-4c1e-8eaa-73c45a218e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008930, "uuid": "c88154b3-788b-4791-8028-e8285d453501", "value": "Q 094 -06 FMC-26 Supply 13 58 5K 11 10K - EBEN-1X.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188de596-761a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782998987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998987, "uuid": "0b8f5506-3367-4f89-91c6-1d0eeebb219c", "comment": "Malware payload (Prometei)", "value": "99bd60fe2d8ff59fe22a7be5de1cae8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998987, "uuid": "b53a210d-705c-47b6-a100-8432575e8ff5", "comment": "Malware payload (Prometei)", "value": "f4efa9279ff58c03e75631fca5293c64d25f5eab9584a820dfefd6244b433bb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998987, "uuid": "8294b204-c785-492a-af0b-7cb661c289b4", "comment": "Malware payload (Prometei)", "value": "51ffa90bcfe8254d78b6b0f0457d4fe71baa95b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782998987, "uuid": "61f82727-9854-4707-ab27-712cbdc225c4", "comment": "Malware payload (Prometei)", "value": "e79aa80479d41e3cf859c69a1693dedc154dd0b499fa71d3c051808ffa17e7bf2042ff06dc60db85508473de45d295e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998987, "uuid": "ad1f7b2b-ca3b-4e4f-a824-70f717bf1b64", "value": "T10305290BB7B668BDC6DAC4748A5BD5F2AC3078141222393B75C5E9312E26E204F6DF71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998987, "uuid": "b8392eec-f054-4350-9704-ecd366b14ffc", "value": "12288:22eLlEqcQ+XPF5ilvI+X7mFSq2mQNj4GV8:klSldQGAmFc/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782998987, "uuid": "644d7632-da4e-401e-bd05-3b1150595b97", "value": 847312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782998987, "uuid": "9534ad4d-947b-4707-b84b-7bf8cef4643e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782998987, "uuid": "00bc584e-e1e8-416e-bd7a-021d5cf5e004", "value": "f4efa9279ff58c03e75631fca5293c64d25f5eab9584a820dfefd6244b433bb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af01cf16-75ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782966598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966598, "uuid": "4e1229ec-517a-4956-ad28-8a3b85d3a46f", "comment": "Malware payload (Mirai)", "value": "8ee8b9bee6ae8223636b6ed3cc0adbcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966598, "uuid": "bcb050ff-835a-4472-b85f-4b28101f2c0f", "comment": "Malware payload (Mirai)", "value": "f5344149c1197d65c74f5594fd9e569b34605cd10e7e3cd5bc5ee17f003c2e66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966598, "uuid": "0b04d540-3094-4e2e-825f-be2a620abf00", "comment": "Malware payload (Mirai)", "value": "b125da0d822b0c439c6b58a4601764210f7a6521", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782966598, "uuid": "ba1aec2a-cebe-4ef9-bd96-452177b3c0c2", "comment": "Malware payload (Mirai)", "value": "48cf758b380f456fb2e7740263d68ea952ea7e8ac88dd620c11647f1d50f57d8af71f0da475fcbc2891803bdb9fa5bbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966598, "uuid": "d85b1842-8462-48bd-8297-5f04bd64f4c1", "value": "T190635A356D7A2E27C1C0A53E22F74764B2E1178E3AE8CA1E7D720E0EFF50A5460176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966598, "uuid": "594e7bda-61db-4f23-9989-cb7343ab9b2e", "value": "1536:xBzNxnVCvXUB5HtSxZ8ChBKBPgvYLZGGTTJj:fzMx1vWIaGG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782966598, "uuid": "808970b6-f555-46e3-b3a1-171ed590d170", "value": 72800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782966598, "uuid": "680d7f34-708c-46ca-9470-3afb6c0cb700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782966598, "uuid": "c96ed301-7bfd-407c-8105-1f51013cc812", "value": "vcimanagement.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89fa036-75db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782972198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972198, "uuid": "d5d6026f-be96-4eac-b607-9b096bcf3ceb", "comment": "Malware payload (Mirai)", "value": "d296fc027c3094981e276bddedebb927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972198, "uuid": "81ccfcc8-bb0f-48b9-b2df-a0d642026e72", "comment": "Malware payload (Mirai)", "value": "f5a59a4005bacd09215a6d9f81c6574648a04fa75f220b6a1124249d52754f31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972198, "uuid": "e6c7539f-d6fc-4d29-ad79-b2988a2244fb", "comment": "Malware payload (Mirai)", "value": "ad8eb8334d9b9cf947bf44bf65e7d91e420a23d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782972198, "uuid": "0e2611cf-56fe-461f-8362-b39eadd6cbc5", "comment": "Malware payload (Mirai)", "value": "145be0e109a0a1d3e6f0e8cf004580f1541c2dd816f0ee592597793e4dab92a4d22af0a6a09ab6eba21e6264fc0907de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972198, "uuid": "fdf7a4ea-646e-4912-8415-eeb782262881", "value": "T153B32A96F8804A22D6D1157ABB6D61CE331383FCD3DE33125E24AB5467879AB0E7BC41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972198, "uuid": "338a19c5-c4b8-4e4f-b902-54f9d794b398", "value": "1536:OIny7gly9zH1UMktjHpt652zaIO9QJMnimkQeplQv3z45eYOlYLTe:EglyBVpAHrzaXDkQeplQv30tiiTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782972198, "uuid": "cf7e7b80-08de-440a-af59-e4f5a7461bf7", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782972198, "uuid": "e7c60306-fd84-4729-a1ee-60aa79e51617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782972198, "uuid": "19a51821-7c46-4cfd-b2b7-b07e70a85996", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703f0058-7652-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783023186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023186, "uuid": "0e61b673-e94d-4148-8705-72f9c9e247b1", "comment": "Malware payload", "value": "e1238a85e5e0f518348304fc59055a42", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023186, "uuid": "566d25d0-b7f3-4456-8aab-ab235c697699", "comment": "Malware payload", "value": "f5b84a261a19b8066cb609124d97bc52df08f08f564d32358a15aaf511caf5e4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023186, "uuid": "f906534c-7333-4246-b1f4-1ae4c01caf0a", "comment": "Malware payload", "value": "2b0946805d9a5e00109ad867c33716485471931b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783023186, "uuid": "088e45c6-ad32-49f2-9d5a-1c3e3c97ed6d", "comment": "Malware payload", "value": "35d1619fb5257a216ed3293473df1858a8bde4fce8f8e1f20b0d0ed0f3184911993df766c868c5edb21cfdf227624618", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023186, "uuid": "9283fd53-6f76-4c8a-a759-2091057f8b20", "value": "T1D6B46D06EA904E33C4AF127D45A31780373AA949AB43834B320DEA787FB33D65B975D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023186, "uuid": "c697ab9c-c158-44c9-ba40-777a456065d1", "value": "6144:/odf9exi7x2lV5RMFs53cogD53Mpd39RCjB9ruft:/oT7xsvMs5Mzmp+9ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783023186, "uuid": "9f28236f-a885-44b6-997b-30606c7cca15", "value": 495606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783023186, "uuid": "1ec9c204-e965-48b4-ba04-1b567b0448ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783023186, "uuid": "c07635d3-50f7-4d73-a2f9-2356d7bb2f0c", "value": "dogandcat.apk.signed.tmp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24c3ec8-7667-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783032343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032343, "uuid": "eceef814-5276-4bd4-89b8-46c5a2d077d4", "comment": "Malware payload", "value": "0ba861da8d1bb18ab35ca1e30122ae72", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032343, "uuid": "5da955c1-086d-475a-ba97-dbfc480f4f7e", "comment": "Malware payload", "value": "f5f263ec0dce3c9adc2a7b33a033a48865eaac6909c5022b200bce610823254b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032343, "uuid": "fd0bbbf5-12cf-4606-aa64-564db494821d", "comment": "Malware payload", "value": "3777848b1c8a6d1bae1e608d98060d8d4727e3b9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783032343, "uuid": "3ef2de30-729e-4698-b68a-cef0c4f6b3e6", "comment": "Malware payload", "value": "345ba8ed3b56d3135831230e1e8d0c7e8f3cb9cf69528ec5ebe994ec87c2ad2555a3e5759801ee165f0303010083936f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RapidStealer", "colour": "#2555C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032343, "uuid": "de57fcc0-a0c0-4548-beba-e58ab2738950", "value": "T1972401048DA85526E6B73271C12100D2B52FD28E528E7C7709FB06DFAD96EAC953372E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032343, "uuid": "40a0009b-3a79-41e8-b7d0-fcb863f7e6b3", "value": "6144:fNQnUfduZz+L+7TdR4/z6SEGQpAMsva9qiAGht:fNQnUFuZyLWdR4/+JGQ+Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783032343, "uuid": "7be20fac-05c9-4046-a831-8c07dc02829b", "value": 223771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783032343, "uuid": "f6f6c27f-810f-422f-81db-41dbbb97c6e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783032343, "uuid": "a6f701f0-5fb5-49e1-b14c-8a503e0070b7", "value": "NekooCraft.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3cf32d-763f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1783015232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015232, "uuid": "994fb208-618c-41f1-8cb6-a41353e891b8", "comment": "Malware payload (RatonRAT)", "value": "2de32f09e2ee68bb35d0bf164e6cf4b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015232, "uuid": "68a0dd3e-377f-4af4-b794-fb0c89fd6436", "comment": "Malware payload (RatonRAT)", "value": "f770e3955872fbb611e7a8bc154efc34b2e363493847c3f211da72214fb2c4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015232, "uuid": "14ca10f5-350b-47e0-92a9-1e5369bd3491", "comment": "Malware payload (RatonRAT)", "value": "f65c490de79558b3b29076e026783a9c408824c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783015232, "uuid": "bd4b868c-06dd-4a10-890b-f0c25005756c", "comment": "Malware payload (RatonRAT)", "value": "5db80295e67b03a69c24522c7b6c01c953650416b82d8fa014ef44f3e145c793325b08b3c68a405aaa90670ae05cabb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015232, "uuid": "fac6c612-5cd1-46bc-abd3-4c525c824684", "value": "T1B8C5011C33F9C618F1AF4BB4A57189664731FD179C62DBAC58E139AE04B6F44BA10B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015232, "uuid": "aa8eafbc-6d43-4054-845a-c61145b766e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015232, "uuid": "b0d101ff-75ea-4746-88de-a646335858d4", "value": "49152:kgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4iAn4W:kgVUuHjkDGjYQDGuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783015232, "uuid": "981b8981-563a-466b-9a75-5ca90c1dd7ca", "value": 2506240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783015232, "uuid": "db8483a3-d3fd-4831-beb4-c34d4f709175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783015232, "uuid": "d9923b91-9efc-4470-b0f9-b0d5c8390eda", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913e688c-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036556, "uuid": "1510904a-e18e-4b95-bfc5-0d776d525f0c", "comment": "Malware payload (Mirai)", "value": "fe6b9e82228e6eb482317313b896f97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036556, "uuid": "ac686d1e-d28e-4d42-ab92-a093aa82a447", "comment": "Malware payload (Mirai)", "value": "f7bb9631725f583a88be4f08895c26c92ef9d069d18b03934d38fc3aa794b351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036556, "uuid": "38a39230-292f-4184-85a9-fd5e47909b49", "comment": "Malware payload (Mirai)", "value": "d6c8a9e46c05a51a4606b95061dbb0ca37cf17d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036556, "uuid": "21266c21-6236-4042-993f-6f185978ad2a", "comment": "Malware payload (Mirai)", "value": "7220ea488c196baf3b8c60b9f890cbfa784119bd980a5c4c750bbed39b2ac8c17cf554f0eb04c2f09e12916a7b890262", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036556, "uuid": "1ba6f6c4-3547-4ea3-9ae1-14e687fa8e1f", "value": "T1C604C50EAE618F7DF79983341BB78E219758338326E1C546E1ACD7115F9428E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036556, "uuid": "3529d096-1540-4d55-88a4-be380b5e8793", "value": "3072:x98b/DqKAuv5nPyZhFKLLj1kQnUqopYRE7X7kZYoMMRlGsvFb41LFJjKHZ/UZcp7:x98b/DqKAuv5nPyZhFKLLj1kQnUqopYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036556, "uuid": "c2a59d98-4e81-4487-a6e6-6ed020cc6168", "value": 178108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036556, "uuid": "f485fba1-aa38-4986-bfff-26ee28cfd261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036556, "uuid": "6d849c07-b36a-4432-8194-6cdf5d35b0a7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5a7688-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033323, "uuid": "c4d29384-bfc8-4484-9bc9-4fc15e386338", "comment": "Malware payload (Mirai)", "value": "471150356fa95fee7371f34a15fd6a80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033323, "uuid": "083279f6-0914-4e19-a5d1-3a4c1dc689fb", "comment": "Malware payload (Mirai)", "value": "f91e0130c1e55dfd84d38b9865d7ff122e5060c93f33b8063165402c4d9116e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033323, "uuid": "4f9d9e70-9104-48d9-b2c2-79cda366f54c", "comment": "Malware payload (Mirai)", "value": "12ad4b1f67a604fd0470d21c36665869cbb4d29b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033323, "uuid": "7e850df7-d7bb-4c8f-8104-b9aa1e0781e6", "comment": "Malware payload (Mirai)", "value": "e6105c7a6010330fc55bcf970b1dbca4f3903ef02bcfb976d05af9c6c1b1d92a0133ec22c5282b1d61e41a92d1d815e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033323, "uuid": "cd183b3a-467c-4287-b227-8e178528d601", "value": "T1F06172C6204A83F66FB95DD322BFC8193082E49E10CE5E4D98E974B5F98CF49353C6A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033323, "uuid": "cb79de76-66dc-43e1-a9b8-4cec44d6828e", "value": "96:i2Jk2q62rw26q2YH22QG2HE2VU2YEL2x82GK2qi2GaGwo2zI2+J7:RJDqpr365YHdQNHjVTY9x7GZqRnXzP+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033323, "uuid": "5352a56b-232b-4b3b-8c6e-39a58a1eda35", "value": 3314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033323, "uuid": "eab4e692-0aaa-467a-8293-e89ea11373bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033323, "uuid": "5b8330ac-f69d-41a4-91de-559bcbbb7877", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf1c8ab-7614-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782996711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996711, "uuid": "98cb7403-c6c5-4b2e-91b1-8e9d0aabf8f0", "comment": "Malware payload", "value": "915cd8d64f116f4279b7d8a05d0aa06e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996711, "uuid": "2dc2b1be-ad34-40bd-84bc-f0cd3c07ca86", "comment": "Malware payload", "value": "fa51dad8bca716e23e9131fc031b8db5f072f255f56969fa1045fe760e2f1100", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996711, "uuid": "cdc13e5b-1d17-4ae7-8826-af87cd03de9d", "comment": "Malware payload", "value": "1071d441a92fce62bb1c7228efcfb709a3c36507", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782996711, "uuid": "04381028-0018-4b62-988a-4e078d876a31", "comment": "Malware payload", "value": "c45ec73c6500a084ec8cb2384ef7c52ac73a2f3502343d5f1d41cc8ab74e2d11cc7d0b8c7e76c6c340caacd64949f15a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996711, "uuid": "320c6148-c042-4d1a-9e07-cd5cddcc866f", "value": "T122562382FF02D92EC077883749A747716256AD2EC697A34798EC762C2C77AC40FD99C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996711, "uuid": "43a0438d-6c41-4d0a-bb76-2f281a7d7371", "value": "98304:pEemIO0QZFAIw/YHaU3izUfz9KKJ3HOweGkLqkPPR9QpNKwRTwYADs:PDqSy3izUJXJ3u9lnITD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782996711, "uuid": "48642b8b-c575-4703-b33b-58c0d75eec3c", "value": 6372763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782996711, "uuid": "4db8829c-a396-4187-80ee-9d07a54a5bb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782996711, "uuid": "4157b92d-59ab-41b4-85f0-b110b477113f", "value": "\ud835\udd4b\ud835\udfd8\ud835\udd42_\ud835\udd4b\ud835\udd5d\ud835\udd5c\ud835\udfd9.\ud835\udfd9\ud835\udfe0+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b1bb5d-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783033317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033317, "uuid": "372cca0c-8d86-4f88-98c6-376c10542fe1", "comment": "Malware payload (Mirai)", "value": "b8f0edaec4d5e699b55a0028a4572284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033317, "uuid": "58549922-bdc6-46b3-9c30-e81e0a78df69", "comment": "Malware payload (Mirai)", "value": "fb1dc19c0ddc511361a6cca94dafd61d579d53a38ed3d3d8cefd25ffedc390b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033317, "uuid": "124eb893-80de-48bf-8a80-0cac1c90b82a", "comment": "Malware payload (Mirai)", "value": "f2b5d4b2e2aad03584e86beffe9b25611eac68ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033317, "uuid": "11aa92b5-520d-4375-a50b-b988e7c33755", "comment": "Malware payload (Mirai)", "value": "d572bd2431f918c12d156a3aefea01184eeae6ae869f43142712da97af9b73e9950bdf36b2ded0cecb5be0a9c06ce959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033317, "uuid": "4670ccc9-ac85-4395-b14c-aa74645b351a", "value": "T11D931982BA43CFB3E84314F112F79B365A31FC7E182BE982E379BDE199415C1A505768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033317, "uuid": "e005f860-456a-4457-bebd-7a0829c1c86f", "value": "1536:D/QCZaxGdvts3i5JPhofsxPu++4HRsUIKqI4FrS4LSX:DYCZa8dvm3oJPhisxP5lR+KfUmDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033317, "uuid": "dd25333d-bf25-4436-b8f4-75b7cf8fbf90", "value": 94812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033317, "uuid": "5dbf852f-ef3d-44a6-86d9-869861de952f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033317, "uuid": "7006b736-da5e-4fb7-86d6-86e5d6dc13ae", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277debcf-7631-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783008891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008891, "uuid": "a1a56967-2a19-4595-b360-8dfe3210d6e9", "comment": "Malware payload", "value": "e267458a180d667e1cd6d57aca39618a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008891, "uuid": "0d3c8f1c-f0f3-4c22-b667-9a9c91896164", "comment": "Malware payload", "value": "fb4de6688600bc8149c54e81a50e25383bc3beb0ad8c49a77133d9e6efa1e076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008891, "uuid": "164fdddb-f8fe-40c6-85d4-5ce03be9294e", "comment": "Malware payload", "value": "833c5f322b15023758f2130a8c6b2e0bf54f0ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783008891, "uuid": "8c4d0353-4d9a-4a66-861e-2b0112e71d5d", "comment": "Malware payload", "value": "6b41c7795df02d057d3ab390e7c0779d9400ebcd4b633f039c1c4d32eac147d04951d45a52c4d73890e4359b02458963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008891, "uuid": "4f2f16e1-a4f9-4874-bdd0-340a4f805290", "value": "T11FD59E0BACE109F9C496973288B611937B35BC590F3627D72D50B2782F72BE0AD36794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008891, "uuid": "a9a2c089-5e1a-487a-b5df-08c1856ed21e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008891, "uuid": "f88f8ca7-0a8b-4c6c-a5a5-6df764ab4151", "value": "49152:SwuzqQUe5OLxzNfE5Vp9bUtg2m0yUJLeZlF3TeNgJksl1k4M:huCz5CRphNkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783008891, "uuid": "218cfd16-883f-4e46-8f32-15ad5cd8e495", "value": 3003272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783008891, "uuid": "63020c93-9c68-4cf5-b2a7-bc171bbc68bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783008891, "uuid": "fcc9c515-aeb0-4e93-acc1-780924905312", "value": "af9231c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3326d487-762b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783006333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006333, "uuid": "df86c002-9e11-44f0-89f3-a0fea50ff339", "comment": "Malware payload (Mirai)", "value": "e1cb63d54b2c77a0f34bf5294f3b37fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006333, "uuid": "eb9383a1-d149-444a-aba7-3153a40b120f", "comment": "Malware payload (Mirai)", "value": "fb904d858a7cefd2b769a9b72e68bf1aaa39c107dc4de3d488cb9475a3f48c4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006333, "uuid": "1c0e1fec-476c-4411-957a-cc2668b3147e", "comment": "Malware payload (Mirai)", "value": "c44d8c778e03f6239123fd029d77a4dadda1b971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783006333, "uuid": "d0c8e49e-c6be-4966-b50c-dc935aed5d88", "comment": "Malware payload (Mirai)", "value": "bbde7054543adec500da23fc5c38f94c0391650668c49fcc45427da162b0dc93144fb12da713080d8bebe701266cd53f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006333, "uuid": "28b82c58-7df7-4afb-8073-8384359ec6c3", "value": "T1FDE329C7F800DEFAF80AE33648530905B630BBE115921B372257797BED3A1991973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006333, "uuid": "1c93ef35-00f7-49c7-ae74-d5d184ab6ccb", "value": "3072:SmzTDH86JI78FyVVJjA1yGidugQ9miVvjbiaLDpeyUg0X7:S2TDH86JiPjA1y3dO9mwLAyUHX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783006333, "uuid": "5f2231a7-cd37-47f2-aa73-07c4592b14ae", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783006333, "uuid": "a840ac01-9d3a-4e19-9acb-26372415e804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783006333, "uuid": "0d2272ea-c296-4768-9686-a437f2b49ef1", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e317f7b-7605-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782990004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990004, "uuid": "77603154-54f2-4a20-b04d-3eabffc9fdef", "comment": "Malware payload", "value": "c61b0cda51be2e6ae5f9129d2d0f5d1e", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990004, "uuid": "e0fe91a9-baa2-4087-8b78-fcc3cb2085f2", "comment": "Malware payload", "value": "fc6fa79f8873c89bfa20fa4b16041f14e85076bebf9ed27a2c7ac66a9a0fa2bd", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990004, "uuid": "86f57e6d-b4f6-4f40-a028-5cee9ecf3d05", "comment": "Malware payload", "value": "5b0f4851d52c7a91ffe5a4b7ebb433de60febd8c", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782990004, "uuid": "5137490d-1e58-49b1-85f8-f0a7faaaa09b", "comment": "Malware payload", "value": "3e4fa470188b820ecf79ab9e074bdba5aa4da8fa3c5d27b249393ea23ae885cf28bbb8c2cdc26cab1b48dc72270b11b7", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990004, "uuid": "e6585309-7148-49fa-a919-def608c5dec4", "value": "T12DA5F757E49590E4C0EEE174C726A213BEA13499473837E36FA187F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990004, "uuid": "4fd62848-aede-4b7e-b969-f810d5456531", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzBz:cqYUQuVDtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782990004, "uuid": "0dda3833-06cd-4835-ba01-23f028ba2a84", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782990004, "uuid": "7bb9b8c7-eecd-4c8b-b925-dd6566bdd101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782990004, "uuid": "72a3da8f-6e6c-419a-a16d-3b969c77278e", "value": "fc6fa79f8873c89bfa20fa4b16041f14e85076bebf9ed27a2c7ac66a9a0fa2bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92af1b3e-7671-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783036558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036558, "uuid": "07d2abf6-2714-4de0-98ec-9bbc9f19bab1", "comment": "Malware payload (Mirai)", "value": "7ad1044288d1dfce396e30d8e3dad4e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036558, "uuid": "4423281a-9a56-43dd-b502-950f0581dfa9", "comment": "Malware payload (Mirai)", "value": "fd80731a69f51e1d797cd0c0b34b064a296658468a5ee859563280c73f1794cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036558, "uuid": "639446a9-3f08-4ba4-82fa-0f5d717f3df4", "comment": "Malware payload (Mirai)", "value": "ca89f1d8c4f654e9b16b55bc586d49125dbad9b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783036558, "uuid": "858acbde-0cda-4975-8cd4-bf008d1cb797", "comment": "Malware payload (Mirai)", "value": "7e4d3ec19b6051545b6d352c6d2e53edd86f0a3e4760abee94632a9139425fb35b4eac073f8d3cf6c800a7ff7e13ad39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036558, "uuid": "4dbcac2a-bf3d-4315-990e-a3bc30befb67", "value": "T13FC38E32D5A4A9D4C0624135E462EA304F63E6C902971EBF2FD68A754087D64FF09BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036558, "uuid": "baac3266-5716-4d1a-a4f4-db9832cc3ac4", "value": "3072:byj5ZKoipZS9HBYHlmq1+rOBQ6BKKlz6B2E1E:bytZskhMl0mQ6B5DE1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783036558, "uuid": "9ad1dbcf-765a-4305-909c-d894978ec024", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783036558, "uuid": "14ea62bd-ad75-4596-81f4-c54661ee0bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783036558, "uuid": "18cf4be9-e9c5-4e81-aa7a-bc004261b815", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a462ad-75b8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1782957108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957108, "uuid": "48e29fd2-04fc-429a-8c14-ddf067d2668b", "comment": "Malware payload", "value": "d1fdf726c0df8d71948b08853fada56f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957108, "uuid": "2df70bd7-d514-465a-bbac-57c1add1d2b9", "comment": "Malware payload", "value": "fdaac01917b2641163f593fccb03f51db0aa368e4acb1d955d8747c5a93faadc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957108, "uuid": "cddf8dde-6639-4dce-a272-3a67e8c4be67", "comment": "Malware payload", "value": "b3299c16c1d4d01a9464fa3292d4831a4e8a12d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782957108, "uuid": "32dc24e7-f137-40bd-8aa2-1ea67dfa2690", "comment": "Malware payload", "value": "d7c20dfe98189047f8b81d3791ff3eae8d15a8019b46ba4818fd46e1a5dfba17f4ca9c22e7a5b4387c8a6d9b409d75d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782957108, "uuid": "8bfcc500-fc07-4074-915e-a4a5b426ca10", "value": "T118D33A06B70D0947D2632EF43B3B27E193DFDA8124E4E744651FBA8AA171D32458AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782957108, "uuid": "9a5a8a35-0fc5-4f04-a878-5965e9993b9d", "value": "1536:RZFVXjZxlrfRWU9F6H+Mf+U7uyUaQ7VpY1TANEuXgfSBvAnkiigCoFNGvWCHDt5/:fFVzZxdfRWUbfCT5uDOnjg0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782957108, "uuid": "b968749a-244f-4720-b532-53ebd347aa62", "value": 138236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782957108, "uuid": "0f3f8ead-b63a-45de-a93a-fe3a3246825f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782957108, "uuid": "8106c3ee-2228-49c5-aa78-20a7c7b2dce7", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2961cb23-7616-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1782997298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997298, "uuid": "98d0fff7-71c8-42b4-9ab6-9bc1f2e55056", "comment": "Malware payload (RatonRAT)", "value": "a1cdb3fea0437aab03b9fbd4dcce6416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997298, "uuid": "5250d0c4-5ab5-4dc2-b142-6ac747702f72", "comment": "Malware payload (RatonRAT)", "value": "fddc9cca767ef639b17d70374bb9ca9d5c6516f58b9b63cae86f593ced0f3b6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997298, "uuid": "5226aa18-680f-4b84-8638-8700feaba34d", "comment": "Malware payload (RatonRAT)", "value": "15c68e17d1f3905e527bbf217bf2614f82dc552f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782997298, "uuid": "bb0e1929-cd81-4949-ac46-b48ef7039c8e", "comment": "Malware payload (RatonRAT)", "value": "a83f6a5711a81aee174166003279628c6e6a47974688ff1bd5e4d2bf96f74957a35dabc2b3dbe56ee8d5abbdce85d463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997298, "uuid": "11891b9d-ed44-412b-93fc-e0e1a2d33b61", "value": "T14CC5011C33F9C618F1AF4BF4A5B189664731FD179C62D7AC58A139AE04B6F44BA10B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997298, "uuid": "93a0253d-c163-456d-820f-7d578846be68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997298, "uuid": "bb51e01b-1793-4f60-86d4-dcdd2f00e755", "value": "49152:HgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4RAn45:HgVUuHjkDGjYQDGuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782997298, "uuid": "90e402d5-b45c-4163-adb6-0b65e4635872", "value": 2506240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782997298, "uuid": "868d1367-bc94-4f56-95f6-4c21bbeadf21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782997298, "uuid": "a0af412d-189b-462a-b72c-e63740e2d1b3", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a21e66-7623-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783003224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003224, "uuid": "de0dcd8a-9be5-4208-9ed4-3b7320f60cad", "comment": "Malware payload (AsyncRAT)", "value": "538860d455edc8108e667b8498a41fe3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003224, "uuid": "63e99f7d-a254-487a-ad9a-6444794eb6dd", "comment": "Malware payload (AsyncRAT)", "value": "fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003224, "uuid": "36b872e2-59a3-4c44-b409-fb0a9f8df4c7", "comment": "Malware payload (AsyncRAT)", "value": "6bbb36dc96230667e363d62881a6166ec67b8a89", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783003224, "uuid": "59256392-a03d-4fcb-a25c-fc79ecad3669", "comment": "Malware payload (AsyncRAT)", "value": "eefdaca07782202eac54b4d0defcb62c5976c4bbcef341b1632c6f47e0de7995b27e5ee3cab86174361272194143b149", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003224, "uuid": "94a53b47-a0ee-4ccd-8aed-bc6acd409aac", "value": "T114050229125ED807D4625FB00F72D67883746FC9A521D213CFEDBE9FB677AA02904392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003224, "uuid": "08c70e1d-4ca0-4fb0-88e7-51a4ee3c9e47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003224, "uuid": "6a73a4e0-5f00-4a6e-a6e0-f46037c1be5f", "value": "24576:NJa6UwvkxSxczIGoHh4mSKDVa5dw8PJr:3a69Mbzi45dwCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783003224, "uuid": "63625135-0bdc-499b-a767-6533c5e87c36", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783003224, "uuid": "f5f7671f-e3d8-4f4e-94bb-884d8944def1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783003224, "uuid": "e5399d27-3677-4db4-9151-4dadb0ed5426", "value": "yazi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ed2c51-75e1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782974616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974616, "uuid": "6d62a5f3-42b7-4011-8628-4279b8ef91c9", "comment": "Malware payload (Mirai)", "value": "8e264e8c05d958405dd4bb47dddedd48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974616, "uuid": "c665bfb5-a700-4c64-8d2c-64a193a67b57", "comment": "Malware payload (Mirai)", "value": "fe78dcccb84347d9ab57003fe3e8b53b2fff1d082d24d499eb8695ab264d43f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974616, "uuid": "ec61a6f4-796f-40e5-b8e3-d5125f718a5e", "comment": "Malware payload (Mirai)", "value": "ad697fd78301ada90e9654e9b4502c4c89317cc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782974616, "uuid": "7fab7b05-66c4-4acc-b731-b5cefa1c5690", "comment": "Malware payload (Mirai)", "value": "432af38df4a0434fde0e5f0b96500f4ec7509b590d0d4894c48264841d0a04c56dd6ee02a92bbe2a35f2ef55d84c026e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974616, "uuid": "6f5901d8-e326-4e15-b9e4-da034a2d1727", "value": "T106D3E71F7B615F6DF5A8C23487F34A75929823D126E1C280E1ACDB0C2E7434EA51F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974616, "uuid": "bb593642-c734-437c-a64d-6e692fe31981", "value": "3072:kHg0QB7o60hXxADCCf2qiXbC7s+Zn/5Rq:kHNU7o6oSDCCuqiGB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782974616, "uuid": "50c58765-9418-4014-b691-3cdbc4e4d57c", "value": 131036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782974616, "uuid": "4fed1963-cf94-4d52-85a4-8ef1ba36f1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782974616, "uuid": "a01f6e60-d26e-40db-949d-614f901de7c5", "value": "xZPw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d462a5f9-7626-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783004456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004456, "uuid": "3a83c0f1-21d3-4751-865a-f8c677e70a26", "comment": "Malware payload", "value": "1653cf75d642253ac2736485bfffacc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004456, "uuid": "dd27cb48-713a-4477-834f-13c38165e5ce", "comment": "Malware payload", "value": "fefd061faf0b51e9bb12247f7e656cf87c0be8794b6dc09615292b16a01740f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004456, "uuid": "d1543cf1-dfa5-4bf1-8649-842bbd256ac0", "comment": "Malware payload", "value": "e4037bbc4e52528dcd4aba48396d1d6c29574631", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783004456, "uuid": "f2d87390-ba03-4450-bd52-f212cc9ab391", "comment": "Malware payload", "value": "5f97b8139c0664eb8637941c8ad9894cd36535d42ad329963aad0f89186a644a960c7e1f5129b1c618287f4ffd71d2e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004456, "uuid": "c79a3a13-08fb-4b33-9e3a-31fceebba42e", "value": "T17381532514F66955037376E8558BE871397B9393338CCB503E2C83B09FA11288A76AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004456, "uuid": "724bb994-68b6-4d78-a575-c706e1b353ed", "value": "96:qqoAJJatDAlIwjpG98N8ipg9sRg3koYLLAu0Tfta:qqoAatDAlIwjpG98N7pgyR1oYLL8Tfta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783004456, "uuid": "52350c05-cd32-4ac7-be03-906745305723", "value": 4080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783004456, "uuid": "86ce2c09-983b-4926-bd1f-a5d629435d19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783004456, "uuid": "dc4b5860-1b2f-48b3-815d-e6713768eda6", "value": "fefd061faf0b51e9bb12247f7e656cf87c0be8794b6dc09615292b16a01740f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac35f95-765d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783028063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028063, "uuid": "2c9a2d53-f5ad-400e-91b4-438f85c3cd0e", "comment": "Malware payload (Prometei)", "value": "d32a6f12ae3234ebab9b240102730f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028063, "uuid": "33f603ba-e654-4aac-bf90-e8ab21a79011", "comment": "Malware payload (Prometei)", "value": "ff825f043105b50df62b498b65c6c7632f2e7aab5efff1cdca49400e38bd2943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028063, "uuid": "cf3982be-0c47-41e4-997c-f40c2f732a31", "comment": "Malware payload (Prometei)", "value": "0641dfbd351174bd8c5ead8962ec24ab50b5d3a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783028063, "uuid": "1b445146-249c-44a9-b19a-f9cbc963691b", "comment": "Malware payload (Prometei)", "value": "4c17dc0f2e0a133bf121f0a394de35669f818852cce2e6fa2d8df1ea6874d661e9c948728fee5443740a16ef7753e062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028063, "uuid": "80a9b38b-1722-41d0-8ac1-740fdccd109a", "value": "T12034BE63A4BCAA9FDDD82F379C4E880713B66FE5D890203E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028063, "uuid": "8b20a410-6fb7-4ff9-a86f-495feed881d0", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028063, "uuid": "a09c8446-66db-4ea1-8aaa-4d5a6b439839", "value": "6144:mGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOU:mG60BpL8jk1FGjDc8GVdOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783028063, "uuid": "53f8aec9-9b82-49ca-bf86-08cfc126cb9e", "value": 245870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783028063, "uuid": "2eee1914-2fd4-48d1-86d4-e0ae86481808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783028063, "uuid": "1a3a5921-d9d7-47e4-933e-373a2d8dd568", "value": "ff825f043105b50df62b498b65c6c7632f2e7aab5efff1cdca49400e38bd2943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0b5c89-766a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783033487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033487, "uuid": "f28d37ad-d961-460d-83b2-82eb3ac883ca", "comment": "Malware payload", "value": "59cb7dd4a3cdd5409357057649353525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033487, "uuid": "f889d808-3e8d-4676-807d-f5f5a83a3848", "comment": "Malware payload", "value": "ffb8ddbabd993eaff6bb842707ec5c73cb1ba6aa8c15bd17fb3adda06a2c6944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033487, "uuid": "f7726e74-c0c0-4511-b581-ab29d2a96205", "comment": "Malware payload", "value": "7a56b5927e4ff15421cddf7f3dcb2886a2485c72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783033487, "uuid": "001d6092-3f14-40d3-b984-34e2111c722b", "comment": "Malware payload", "value": "ac26e4dfb18378b0c97745cde7889eccd2890e97da9d5862536bab4c4fe7e2eac0f04b49ce62c7bf4e40a12daa6c60fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033487, "uuid": "99c54d1c-1875-4f74-a663-ce7d0f9e7c46", "value": "T175D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033487, "uuid": "f0c91788-b3b2-49a8-886b-122326a0d64a", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQD:yIRfe3xvvSrlvZZ7UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783033487, "uuid": "13728428-45df-45d1-ad0e-485f6619410a", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783033487, "uuid": "87be121f-dd5b-4226-8687-336719b1996e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783033487, "uuid": "32af212b-6507-43e6-8f49-1292215c7f45", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }