{ "Event": { "published": true, "date": "2026-07-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-21", "timestamp": 1784678582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ee072695-5ea6-4b09-836f-f81def3caa37", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627e380f-8497-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784592115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592115, "uuid": "cc1dcfc7-fb52-4728-8687-014439009629", "comment": "Malware payload (Mirai)", "value": "6255259b59f9da0ab142cdceede5db80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592115, "uuid": "8329e1ac-abec-4c40-8061-aad27bcce239", "comment": "Malware payload (Mirai)", "value": "001b17ec7703e99a383799c633408b2315e9394bc1af1b924721af640b628a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592115, "uuid": "1a882e81-e6cd-44ff-9573-63217bf53032", "comment": "Malware payload (Mirai)", "value": "317c5fc375aa59f034af9b9b8da93fd156c70725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592115, "uuid": "3a716f25-656b-46ad-9181-198e6a9cd644", "comment": "Malware payload (Mirai)", "value": "90ddb40d7b29c2686a8f7fd926c32f18096453bb2f4851b4c06e78a9ceedf5c5129ca3d39b8e8a89904e66ade2d5cb6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592115, "uuid": "ea5b8632-ce1c-4600-af72-821efe9fecf6", "value": "T18104090AAF601EF7E86FCC3705E94B4A25DC655722A43BB53534E928F60A54F0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592115, "uuid": "9979c0d6-6a42-40cb-8d08-3d1f75e0b22a", "value": "3072:hkmGeeedgvJVVU4EKZWGs0VZhH+SKzKUNMlSfnbL:+mQyKZWGs01L6HNtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784592115, "uuid": "b4ab21c3-4d81-4907-a698-dcad571946e7", "value": 181036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784592115, "uuid": "620ccbf0-1656-470a-a371-59c553eef581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592115, "uuid": "25b909cc-8f29-4f34-b22f-737cc19aa0f6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd59e1e4-84ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614198, "uuid": "b31121d6-d60d-4f94-8be3-f307bb346617", "comment": "Malware payload (Mirai)", "value": "70418eed34720a96ca8fbcc303bff56f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614198, "uuid": "0c5b3577-cbcd-42fe-a691-b7119a4c8c6c", "comment": "Malware payload (Mirai)", "value": "002120c9f9811812e575f5dcce2c9b9f845e1dbe3addaed1af8199ac672ba3f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614198, "uuid": "ad08cce7-cc3e-46ba-9f92-166f1dd60f49", "comment": "Malware payload (Mirai)", "value": "197a8951ef9781030bbd6ca351b1796780fe6cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614198, "uuid": "dae24bee-58e7-4b2d-967b-47f9e1671770", "comment": "Malware payload (Mirai)", "value": "dc89250abfe7033400ccd13c3d535a68fd2478b00aad1b390b9ab7ae42ea08e0d5dc9a8920cabeafc2e1c33591ae8b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614198, "uuid": "b3e34567-38be-4da1-9337-b6711bfa07c9", "value": "T103D3F649B9419F02D5C731FAFB9F42593353ABA8E3FA7102E9205F6023CA59B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614198, "uuid": "06e2107c-d334-4548-bac5-b759c6db0279", "value": "3072:bznTXA3u1VEkk4gasiDDnpJ+ahGqzBIYFys5niEow1oHt/:bzTXAe1ytV4Dnz+ahGqzBIYEQi7w1oHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614198, "uuid": "7c88022e-2af2-42e3-84c5-3cdf5f895320", "value": 141372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614198, "uuid": "34182fa8-c524-4961-a401-05f1a4b74ab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614198, "uuid": "603947d6-3d1e-4189-86f2-b0d6a8a408c9", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c67c5b-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613458, "uuid": "8d37eb43-3b65-4d16-857f-ad33ad387a22", "comment": "Malware payload (Mirai)", "value": "5b24e3dba38b037aac8f239d6d45e5f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613458, "uuid": "6b443a3c-2180-43bf-b898-bd38e3ea05a1", "comment": "Malware payload (Mirai)", "value": "01bdd508596f3df96874ecc2fd43cacf0482f6e7041f383704ea2e7ea321ad4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613458, "uuid": "2e9cc9ee-4aa6-419d-b054-950002f99fe1", "comment": "Malware payload (Mirai)", "value": "acaa7504f96d42e0e5dd16de9373702f95d15c49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613458, "uuid": "c398a147-37b9-4b3a-a2d0-bd91870478df", "comment": "Malware payload (Mirai)", "value": "0ea53cb191ca0e568aad066b2a4724dd7667fc741ac2c950dbf6a00421c0e1ec891769997bbb5fab8d12f1f7c1f1ab54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613458, "uuid": "1fe15bc9-f154-4017-a1c8-90fb975cd33e", "value": "T129935C22B5391A3BC4E4947722F35326F1F6438A10A89B1E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613458, "uuid": "379f0ff4-5b64-48cd-ab90-a43e5e0c119e", "value": "1536:Ol5GrqkdLdA0rfQzYeR9nShcUvytX5Ym5ngP5gYtGSJ:RnvA5l0FaB5YOgASJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613458, "uuid": "c382ad82-e465-4447-b605-7972f2ff9130", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613458, "uuid": "addb3de5-906b-4dfc-9b21-2af30367182c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613458, "uuid": "8ad8c618-f607-4108-b810-6c5bae418775", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c69c0f6-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613204, "uuid": "2c2920e9-5485-4454-8fa0-9a813284a52f", "comment": "Malware payload", "value": "89d5227cdda234f49f7820d5152e0700", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613204, "uuid": "099cd53c-d618-45af-be4c-624aadcbd60e", "comment": "Malware payload", "value": "051ed403f8ab320c4913c106a04e071f8aa0372fe1bf3a1bed636e3f5b293a7b", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613204, "uuid": "2c2879ba-6d87-4cc7-ba38-5219297cd2cf", "comment": "Malware payload", "value": "50b972fa923e3d60229adb95ebcbfdf3ed7d87f5", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613204, "uuid": "558f1e6a-9576-4a67-b54c-ab87090cbc92", "comment": "Malware payload", "value": "8fc41457001129660e8550835b32adeed1a8b44ec72821552e5578e6fc35c4b912793fd48df0801896179ae95a20e2f2", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613204, "uuid": "7703d9fd-65ec-4167-a56b-e5235e4f8a2b", "value": "T1DFB41AFA56179E8FD62A0E61F40C130AEC7CFC9B71D990B9AB484EB34D594884CB4D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613204, "uuid": "3f9d36fd-1603-407d-af14-16514f681503", "value": "12288:ArVOVwevC7ORk5QYXKsYVqkqUq/0xP4Ba:ArVOVwelRkHXYqvf/0xP4Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613204, "uuid": "9604a172-164a-4896-87dc-3bfbf65814d0", "value": 532506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613204, "uuid": "242e5a79-9983-4fa5-a5fa-a2856943bb72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613204, "uuid": "340e1838-bf4d-423a-8ce4-fae5c93c85cf", "value": "aaambros-pwonly-phamupload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a51b23-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784613806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613806, "uuid": "c9003975-eb3d-476c-916f-a47b843ae3ce", "comment": "Malware payload (Formbook)", "value": "76b351bc55e4bed9d46b7f587afb5fcb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613806, "uuid": "35450d34-d744-4687-a655-fdbf71fc0a18", "comment": "Malware payload (Formbook)", "value": "053400e282b6ac5abb1dc9eeb320c3ede641529e429cfc363c8133b0739420f7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613806, "uuid": "7f0153a6-5339-46f3-aff3-3eaff34f5f49", "comment": "Malware payload (Formbook)", "value": "75929f82f521218788c9ea6a80d29d1b22be0f14", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613806, "uuid": "fa377993-a7b4-47bc-a3b0-077c821f0e07", "comment": "Malware payload (Formbook)", "value": "d6e23b406e15e280511aacf742669798939124e9658708fd0914714224a01fdff73927e2b06cde62bcf872d9a82747ac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613806, "uuid": "1094a14d-afb4-4054-876f-abe580c83cea", "value": "T1CF45A073167FB085A5B8271BCE44AC065F0A8341899D443DBD9A89FF071F6A9DB08DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613806, "uuid": "74461348-cce6-4643-a8a9-4d51b70908e0", "value": "24576:PfuYETJXQjz9yzLrsTqMykUcCqlIPEgCFXvTlFck9xpXA:Prirpl2Sg9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613806, "uuid": "d490d955-1209-4520-be7b-a539892509eb", "value": 1230421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613806, "uuid": "e4110e89-be1b-45f1-b6b3-0c97a0ecb5b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613806, "uuid": "efed3a58-e724-4878-a66b-d789270db837", "value": "D Space.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acc96b4-84f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784633763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633763, "uuid": "9952fa78-538e-447e-b1b7-353553531bb4", "comment": "Malware payload (Formbook)", "value": "088d432df4ccadb352081564a4f4518b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633763, "uuid": "ed24241c-306f-4c8f-b0a2-a69aa80052ed", "comment": "Malware payload (Formbook)", "value": "053b117e9ed3d97ed109590d414e1db9321475564e8ecd120221a56610b05c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633763, "uuid": "9d496a5f-2678-411f-8666-fe3f1ca452d8", "comment": "Malware payload (Formbook)", "value": "a5dd33113852f6d14e0da0a40eec1b1275569d45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633763, "uuid": "dd22a038-2175-41d2-a3c1-bb3883f86bfa", "comment": "Malware payload (Formbook)", "value": "b6e1d54b4da652a751628732613ad3da2330cb5d56b0cd06298decd2d1f7f5c78ce1e4eb6aee24e7a235e05ebb43941f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633763, "uuid": "a06ee9e6-9651-41b2-ad80-226b11388eac", "value": "T11335F054160BD802D4D587B6F8F0D2B422A44ECEFAE3C3936FE93FB779267825594242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633763, "uuid": "42390c34-31f9-4bae-8720-0e78ba806d58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633763, "uuid": "a213481d-7ed8-4d0d-a5a7-54a501890b96", "value": "24576:Qp50y90wK86lUZixEd/fDmOExIW613NyzG9xwpU:Qpd0TIixo/625yacU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784633763, "uuid": "16227147-3f33-40e4-b355-8d9aac776a70", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784633763, "uuid": "a83c1455-74f9-4d7f-b422-4ea24eb7551d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633763, "uuid": "0df5f7ec-4c6a-4da7-8908-21bfc4916b9c", "value": "Order {RQF} Specification and Confirmation hNxy5bhw5mo919a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c744b2c-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784672931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672931, "uuid": "19e5018f-4e65-4a37-b7dc-41bf7bcb05b1", "comment": "Malware payload", "value": "4512b6167da0f15c08dc7528814df840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672931, "uuid": "a5fc7a1a-fd95-4f39-ac40-9991c252689f", "comment": "Malware payload", "value": "053f32ed6a86050a782b96a51e4194287fa9e7985b992f32a69aa06ee562f929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672931, "uuid": "5d93e222-cf71-4251-8221-c4ca1bc191cc", "comment": "Malware payload", "value": "047cfea5ef681a799b62e60a2995d75bd85b0eac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672931, "uuid": "e8686abb-d3d0-47d2-8e4a-54d6d8e6efb1", "comment": "Malware payload", "value": "1e219d080ded0311a55891b6c498029dcd6fde3e517fe133d83fc2964a82b4cd1702b061a22e149eca243eadd74a543e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672931, "uuid": "8d255b52-3d22-4326-959a-5ee665ddd2fb", "value": "T16863197ABD819F16C5C52677FF1D8389331723A8E3EA7113EA152F6537CB82A0D2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672931, "uuid": "98828764-3d5c-4e28-8832-a45debdb6aff", "value": "1536:KfrOjmOWL3w13AyKsYBgNPSbAb1S6R/W76cWNQZcytFZ1Uyl/PSFZ:KfrOjm33IwoxNu+1S6/WGcWi1tFZ1UyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672931, "uuid": "46bb32ba-5c22-4229-ac67-5580611cd986", "value": 71260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672931, "uuid": "51ab109d-8580-46ef-91ba-03e82bc54032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672931, "uuid": "1d071cbc-411a-4908-b563-3a6e460a82f1", "value": "dNPT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd6c348-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615192, "uuid": "f72a9c93-3106-4fed-955b-5b682d4bb0e5", "comment": "Malware payload (PhantomStealer)", "value": "131185c401587a6279aba78da3ee7ccb", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615192, "uuid": "f8160721-4bda-438c-9f18-7d696d29047a", "comment": "Malware payload (PhantomStealer)", "value": "05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615192, "uuid": "ea6644aa-2961-4083-a55f-912eafeaa33c", "comment": "Malware payload (PhantomStealer)", "value": "a734a805abf76aced10e41d9a130564ebe1e9449", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615192, "uuid": "7fa59044-2267-4805-bee4-9b4cf03d5b31", "comment": "Malware payload (PhantomStealer)", "value": "de827df2a31bf16a087858efb508e8a58cdcd8ff532696bb5b3d80337bf8507f514952c76582450a982cc1daf55ba107", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615192, "uuid": "c6b28649-2a94-4894-8a95-4cecaccb4edd", "value": "T138C312DED09B05693DFA2B6DBD818C1BA16705DD6B6AB237132D18C38C6D943F8C7428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615192, "uuid": "23c9f293-0e84-4032-b09a-1ba77fb80af0", "value": "3072:ijz1w0ntrGwd9lzJW8zDQPrG5YOmGt5bg:iX1w0n8E9lzHzcPrGCet5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615192, "uuid": "989db7b7-759d-4070-8876-a1bd9ab6eb78", "value": 127158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615192, "uuid": "be0b8ec4-e653-4c92-9fe0-477a0810cc33", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615192, "uuid": "1951d192-40b4-42b7-9273-d87e174ec2a1", "value": "05ae50840a1027c6086daf415722121f7a260ccb4c3609cb049f5c8a2154187f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2dd3c6-852f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784657253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657253, "uuid": "799c0e28-0f43-4ac6-bb41-6480bc66ce78", "comment": "Malware payload (Mirai)", "value": "c280f34f09ec095454314dca110690aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657253, "uuid": "8e895cc2-b0c2-4cb8-8558-5f187b7bbf74", "comment": "Malware payload (Mirai)", "value": "07b8ca62d5b394842a09e05d06fa833d51504b69b1085eec49732e65594e5392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657253, "uuid": "61b6008f-3b00-477e-a61a-738c65e11fae", "comment": "Malware payload (Mirai)", "value": "903065380ed7e158ebe84495297e6f87e5c2acc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657253, "uuid": "3e6572e7-f355-42b5-816d-9df918b6a7e6", "comment": "Malware payload (Mirai)", "value": "0ad9a16252a2366f2457fad4c41fcf612ce8c6359b2b8ffb8340d8926d13a3dd22884c36b5e19fc710e68cfb4b2c1d64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657253, "uuid": "22ef1b9d-e659-4013-b4eb-c4019f87ad42", "value": "T1A5831859F9406F15E5D625BAFF0F414933634B6CE3EE7202AE245B2523CA91B0F7B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657253, "uuid": "3feabd69-50c8-489d-84c8-f52cff2db01a", "value": "1536:jxnytSW7vJjGMPCKafzCkh61vo5ZlwViiy040eqC8ZXYgVRtX:UMWcMPCKafzCkh61hO040eqC8httX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784657253, "uuid": "c1cbad5f-b884-4259-9005-646a89e25fee", "value": 81744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784657253, "uuid": "e5f78a8a-4b7a-487f-b10b-9ba3f6f0ec89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657253, "uuid": "3c6cfcf6-ff0c-4751-aebb-20b2ee9010f9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab44377-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784620663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620663, "uuid": "fe990b6e-c9c0-4219-aa33-dab08dc8fd3c", "comment": "Malware payload (RemusStealer)", "value": "4073d7246a5f35e60dafe12c14cbf95f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620663, "uuid": "1f881c58-b4ab-4fca-b06d-4348a15eeb9d", "comment": "Malware payload (RemusStealer)", "value": "07e0b63badbcdc1efa43a932a7025c1b50d3ba8a446223ce3659541a41133a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620663, "uuid": "b95d1bb0-0185-43b5-be4d-1fceb40b79f6", "comment": "Malware payload (RemusStealer)", "value": "b9ffc844ff7ab33a8dc9a12a316f1397bf2d4fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620663, "uuid": "4156a1bd-47eb-442a-a81e-22f792d94be4", "comment": "Malware payload (RemusStealer)", "value": "590a6577d7318e2cabea19f9bb6ae0c602b1c49073f85f9aae97bb097300cf001341a9ec00c262be22f8b3269957b8f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620663, "uuid": "cd8a34a6-6d2e-405d-afdb-2c15a4baaa47", "value": "T101C53A17AC9048E5C4AAD332CA665255B776BC080F3237E72E90BB783E727D09D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620663, "uuid": "06db2a90-cddc-4f0a-b4c4-fd3e42b142dc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620663, "uuid": "76cb0ac9-be51-4786-a6df-359bbcba04ec", "value": "49152:jyhpDNZgYTDaiwS7Zw7a4BgMOdghfeTLMRtCSbX:jSZbybfe3MnCyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620663, "uuid": "d69b026e-33a0-4dbd-8d70-8c167f85b637", "value": 2687344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620663, "uuid": "330707dc-f342-4109-a8c4-1efe6ab60f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620663, "uuid": "c1e46c1b-b2c2-43ef-9aac-00d7e14685bb", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d3e788-8546-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784667128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667128, "uuid": "145f45c6-79b8-447e-b39e-63eaffb643c7", "comment": "Malware payload", "value": "44ef192c90d9ea302acceb3a7c70d8c2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667128, "uuid": "83bd48f7-cd09-4347-a884-a3042d7afb88", "comment": "Malware payload", "value": "08916c59ba59c089e9d1140b6efa03611785e5c40d907cbb797e0f958be2dc29", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667128, "uuid": "f3260fe1-68a0-4048-81f1-988b7ee53141", "comment": "Malware payload", "value": "7bfc9791f8645400f209a638810c0fb321bb8fbd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667128, "uuid": "7496c266-7908-4617-85ce-23973e35adf3", "comment": "Malware payload", "value": "b79e75daaf20890e0605ef82b0e81f1f9b2eec138f153cb446c93d5922ae6b5dab1991aaa14f713cae644ddab1a4d3f1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667128, "uuid": "cd2dcf77-072f-417c-9da0-74ccf7e1c12d", "value": "T1CCE6330C6ED012EEE6B3603DFED469D2D16934751735CAEB03AC82E21E572E0C53E696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667128, "uuid": "d7653309-1684-43e7-a677-a919d2793eed", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667128, "uuid": "1d88c73e-da47-42e7-a810-30567b58c861", "value": "393216:pRXTTCw3J58zURNt2HXMCHWUjXscuI3/PGTAI:pRPwHHXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667128, "uuid": "102e403c-acd6-4984-b2fb-2b8d70438e83", "value": 14323369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667128, "uuid": "4362ce3b-f608-4707-8902-bb202e8459a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667128, "uuid": "b250728a-3c33-4b30-aefb-6488bb1de368", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302dfb80-8502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784637986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637986, "uuid": "a439dd09-3a51-4c26-bd0e-c5468da805e2", "comment": "Malware payload", "value": "7be8feb7e5398153b8ee0793fa02a40b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637986, "uuid": "e1eba82a-b050-4811-8ebf-3e21be50f4e9", "comment": "Malware payload", "value": "0a25be6a0fedbb5c23e1b951214800ef7e86ae36626f27bfe7c9399f1527a0b0", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637986, "uuid": "ae91c684-d712-4834-a2d9-ef10fdd22d20", "comment": "Malware payload", "value": "dbb139f502e5c3b1341a11fb9a1d8a678b24cb88", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637986, "uuid": "8265ed87-995b-4d16-b40f-5cd88d990f11", "comment": "Malware payload", "value": "9ea3454b9f08e8bb4d5a7dec7464ee0c17c7dd955e9c795d232e3c1c15ca6bf0d3a229d3b2063e87bc80abdfafc253e3", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637986, "uuid": "d01a9e64-d901-4789-bf4c-885a18d49d12", "value": "T168F0AC74C0B8F591C9DED335C829CA4B16BE5F1052B580631C203660F9119BE5E5679A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637986, "uuid": "87e74b7a-1a72-4efa-b5ed-0f240f554508", "value": "12:5jeEqUHkhmhr2nWXUL6LJyzj/dazv4py1SAuAo4/DYJw4xoye0yFz4iE:9rq8khmhrvQgIj/dazvumSAPv/DYJJxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637986, "uuid": "37858f82-7fef-4efa-9563-b474e80b35e0", "value": 642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637986, "uuid": "6addf72f-66b0-47db-ae3d-5031d24826a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637986, "uuid": "31c45b71-7539-4d9a-b902-9ef3326c2b50", "value": "imgset_81362783030328.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045326c1-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593245, "uuid": "1b2dd3d0-9536-4c76-947e-4535cd19b792", "comment": "Malware payload (Mirai)", "value": "2eaf355629ace12813019e2b59dd7038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593245, "uuid": "a3e0e464-033e-4706-bd35-e8d1cbac5f9b", "comment": "Malware payload (Mirai)", "value": "0ba8684a96ed25751f1cee251f68437c9030725f8bbebb0bbedad4454ffdea34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593245, "uuid": "890fb2f9-9b67-4934-b14c-dbc84796f350", "comment": "Malware payload (Mirai)", "value": "9d80ccb503ca463e7c3c8c351da6ed8928388600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593245, "uuid": "01432a57-71b2-462d-8ade-f7e029eea065", "comment": "Malware payload (Mirai)", "value": "3f836a659f264d73917a44cb47f7f88573065ef8dbf1bf98561e14a1660fd7d5f087f596f512d9da73b315f79eb38b91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593245, "uuid": "328053dc-4bc7-4100-ac73-421d2d43b9da", "value": "T143831982BC41A629C7D0137BEAAF508E3311B7DDD1DA3242DC254FA47ACA91F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593245, "uuid": "71cf74bd-85b3-47a6-be05-3aa169139ce1", "value": "1536:yPjwUUaianjKST+TegqUkyKNXECsvkUEwYCB8t46zG1neU:yPUUUazKeCIyELy84MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593245, "uuid": "5dbadbce-f3aa-498d-8b34-af7a2769651c", "value": 81564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593245, "uuid": "b885cbf7-5ce7-42cd-9791-df43c7aa6a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593245, "uuid": "78af3e41-d00f-47db-b7b0-797848d684b5", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74761093-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784618344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618344, "uuid": "7c3a9cd3-b78f-4df9-9e7a-0a71c7e3c191", "comment": "Malware payload (Mirai)", "value": "052aa9af052aac6b637b613c3240f42e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618344, "uuid": "93a00851-d3ca-40eb-ab76-71eb352ab2a5", "comment": "Malware payload (Mirai)", "value": "0e2df0e7deee6f88efbe3f63f1dce68f5cb8807fc1913c7873084f7a8e0e75c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618344, "uuid": "c1e4d308-9820-4703-896c-c5a18f09b085", "comment": "Malware payload (Mirai)", "value": "c80087eb2dc3fc2c63fe75fb79aff87d466c5c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618344, "uuid": "3ca713be-0bc6-4b42-afee-cf34ff5f4ceb", "comment": "Malware payload (Mirai)", "value": "3b76b31d36561ce3614003bab19fea42a52e019f27a89a2bfe6ae113a8a2d780f7294c80c8ca0f8cca5c449db131244b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618344, "uuid": "4f13bf16-0508-4032-9c75-bf974625c822", "value": "T1B9D3E645BD518F17C5C311F7FB9E42883B167B69D6EB7103E924BFA0338A4DA0E2A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618344, "uuid": "741eb6b5-1f9e-48f1-a558-3b0d09cdf197", "value": "3072:/vF1i/r67yPJqyLJD4PpBjiyBaM/BjtoP6:nFAr6+Pwy9D4PLjdBL/BjmP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618344, "uuid": "1240c987-e4fa-4cc4-bcfe-51396af8a39a", "value": 142876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618344, "uuid": "da5a3014-bf7b-464f-8ce1-423cd295a3aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618344, "uuid": "1f52438c-1349-4174-9345-e9455c667394", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c31d98-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613575, "uuid": "acf90675-b7c1-4d03-af41-6f589ad755b8", "comment": "Malware payload (Mirai)", "value": "f0e9df425354598254be39fa572c24de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613575, "uuid": "9103703b-205a-4097-aaa2-ff311d80704c", "comment": "Malware payload (Mirai)", "value": "0e6b8fc7d70c6db66a7900b1d6d7bebab370735e87cef82e2a8975d26b8ef52d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613575, "uuid": "b450a80b-399c-4539-9117-d8993fadebae", "comment": "Malware payload (Mirai)", "value": "737da250716b51cd014362ad815ec4424e48d33d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613575, "uuid": "99f0c2a7-ea6f-4671-8c61-07905086d354", "comment": "Malware payload (Mirai)", "value": "755166927c25777474a2af3a68c6a105fb22dbf7a31e6cc5b7fbcf567149902418d85e40af5d9f686c619333c1002ce4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613575, "uuid": "8998a3e4-994a-4934-8670-3051ec3c606f", "value": "T142C32863DD269F1AC126A5F0B2F18E791B53BC2659572BE9A476EAF48043CCCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613575, "uuid": "ee7648ab-7584-447a-85bc-04ba32f179a0", "value": "1536:RRkWma+cC06/HYCoKOdcF7UpFXbSSEZFfWouhM18VSAt9C:Hoc6/HY6O6KXb9afWlK8IAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613575, "uuid": "81b539ca-a16b-4695-9306-7bd5d9aef06f", "value": 126776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613575, "uuid": "3cf85089-f971-444b-a27e-776f9f31e4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613575, "uuid": "0da8419c-9e3f-420c-9a2b-5f3a05701641", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9c4afd-84d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784619811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619811, "uuid": "bd8b36cc-950f-40e8-a5eb-d3eea14b7683", "comment": "Malware payload (Mirai)", "value": "db3273ae38b2b3348103380d38397f6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619811, "uuid": "5269b949-65e1-4af0-9c08-fd55c9e04d00", "comment": "Malware payload (Mirai)", "value": "0e8bb412e1556aade8266d990c840a45b282c53e25da22c10693cd113781b9b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619811, "uuid": "441627aa-27fb-43dc-a2d8-44baf80ad254", "comment": "Malware payload (Mirai)", "value": "c5832ba0cb3670e43b8cdded0a835b0135866d12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619811, "uuid": "f9ebc6be-60ef-4755-bd2c-892c0d4a703a", "comment": "Malware payload (Mirai)", "value": "79bab46b8e10d7724ff97dded1b5cafb4bf7e917f3ba9ce818acbeccf3bc53dbec8474a549ef27ddca71a9a0ee7a9913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619811, "uuid": "7e0f8df9-7161-4d13-aa85-1ab109b84eaf", "value": "T18F14C50AAD21CF2EF32D873147F74A25D35AA6C217E2C646D59CD5105E203CEB85FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619811, "uuid": "e9979360-da23-4110-981b-981274418e2c", "value": "1536:D8xVt9vlzQJAFM10zE2RQdBsUo79axHZcoQTetheLQm/MzUYVnQkjttea/Q:g9eAJE2RQjq2OfTsK0zUYVnQkjtteaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619811, "uuid": "a47d0adc-e013-47f6-97b1-3f1e3e2ea743", "value": 206424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619811, "uuid": "6d8e5011-68f2-4a78-86e1-3ea4b2ab9ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619811, "uuid": "9a9608f9-ec63-46e9-bc4f-a43ffe0fe3a7", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c63636-8555-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784673746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673746, "uuid": "08a362ca-0dcb-46f8-850c-7317dd78e8a8", "comment": "Malware payload", "value": "d8060d80e528f962a6411316941b7dde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673746, "uuid": "5e133cca-7a99-40d9-a68a-7d9a53f38407", "comment": "Malware payload", "value": "0f09c681e525e89b72c1a714c6cb52702aea52aa0db6217ea7a6886b3bf45894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673746, "uuid": "52b2975e-25e1-4137-a818-56da05b413aa", "comment": "Malware payload", "value": "ef7ea56dcb3ec85dc738d6aa395d9d7820e7a8f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673746, "uuid": "0b30873b-a67a-4b78-a53b-6328f15dca07", "comment": "Malware payload", "value": "bdf8e3755bf5fd1c203806b98d0ec7ae50c90d8bd239b34023bc70dae10a5f780da2cbb0b4ca410ecd546786d7a57e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673746, "uuid": "f74a0027-646b-42fe-be13-9d93c73873a7", "value": "T1ED631975B8819F56C1D52677FF1D8388331723B8E3EA7113EA196F6137CB92A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673746, "uuid": "cf157b0d-4a5f-4a87-9ff0-290a3da38ee3", "value": "1536:YVbe7DuaBQNy3biqPCbmeT1yCn3yBYcHZWyRZceWU7Fa1UbLOip:Y1CDu4ZTOm81yCn3gYcHZB7pL7Fa1Ub6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673746, "uuid": "f743cfd6-974d-4e8a-b1be-ae8f4bf0fe9b", "value": 71028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673746, "uuid": "6c04c4a8-51e4-4a98-b1d1-fd64da52c3a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673746, "uuid": "672be744-a51d-4fe6-afc9-a8d17985659a", "value": "tvCr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad898a3-84b5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784605041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605041, "uuid": "4e8b91b8-e0b6-4f31-aa7c-4ab7daf3e7c2", "comment": "Malware payload", "value": "386529af136fe96a23da6aaa39711e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605041, "uuid": "b685f2ab-7c6f-4f13-9240-540672277775", "comment": "Malware payload", "value": "108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605041, "uuid": "6e48bcec-7634-4e27-9420-332214b9dfb9", "comment": "Malware payload", "value": "f34330d4c6e0aa978dc3af40360c14b31ad51127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605041, "uuid": "08dddbdd-2269-4857-a766-c967b842f19f", "comment": "Malware payload", "value": "00b477773896c21aeca2c63acf8c1b1d4f5f1efc820a80593f232af03a0c64be6da25af4c4097cd70b289fc5087ac44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605041, "uuid": "41e44935-e89e-42b8-a8db-069905fa1c44", "value": "T1E30733907CA4F70EDCA8D438C97053F041EB0EEDF6769017A4A27E6237B7293D69A845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605041, "uuid": "c08b889a-302f-4162-8067-98dc55f40b65", "value": "12082e77cfc7e34f96f21f95764c8ac3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605041, "uuid": "4cc404ad-1cc5-4967-9459-9108bec89538", "value": "393216:Sz0LnfhNw32VNelklzfhSecSpv5JwuFUvmB8leDOgwtEI0ppjagOibnaE4qX5y:SzMnsA88tSxe5JhUvmO0DOgXOgOijacQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784605041, "uuid": "f1750cb4-d4be-4834-bfc2-ec7bea58340b", "value": 17896424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784605041, "uuid": "f1cfe6e4-37a9-46fb-bb4b-783b15d83e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605041, "uuid": "e6798c24-4574-4468-99b7-52d81b51e314", "value": "wmaines_rmm_v2.5.0.67_oid3f4ebaba-6585-48d9-82be-4e2f3124e8b3_bid8etMwZceBUaX5sZKZactsw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f399bdc-850b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784641931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784641931, "uuid": "fdf3334a-6eb7-4ae8-b3b7-d573b386059b", "comment": "Malware payload (Efimer)", "value": "1fb94676a81df59eff4e401c00a724c7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784641931, "uuid": "290f7999-abf5-496b-b6a7-735fba411cc7", "comment": "Malware payload (Efimer)", "value": "10e06b5be9c382810757bf0d58872392c8d2e50fed5036ffc5ec458de0200fb8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784641931, "uuid": "24b323d5-7902-4de1-abb8-2474f3e5d86b", "comment": "Malware payload (Efimer)", "value": "9cc19b259f9e807c6aee77fe220f8753a58f57b9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784641931, "uuid": "360c19d3-ce48-4139-9bab-668d6876ed92", "comment": "Malware payload (Efimer)", "value": "8d9312100a9b575b0ab6037f13a70146e815971c9c4114d52f0d9bd5cea18880f80fb40d6448da781c2e609a81a2e4bd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784641931, "uuid": "5442a1d3-5ac0-4f15-8341-f2022652e2bb", "value": "T177E633489FD106FFDAA3803CDED21A9AE7B57C741771C8DF07A48290AE131E1983A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784641931, "uuid": "51022e22-4e8f-4a47-9828-876611c5e66b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784641931, "uuid": "36e08218-a1a2-4a76-addf-9c19b1958a73", "value": "393216:8Iy0dSROjUof2MfWXMCHWUjXFcuI3/PGTAI:8V0zUouXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784641931, "uuid": "0161e350-807c-43c8-b5f2-925ca1f161a8", "value": 14288339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784641931, "uuid": "3ffbc6f6-8a07-4fe3-981b-1ffe0fe46a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784641931, "uuid": "459bd36b-a1f9-4796-9d9b-ac79fc4f1959", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5841509f-84ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784600688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600688, "uuid": "fac67bfb-0bda-41c5-b895-220fa0b7e721", "comment": "Malware payload (Mirai)", "value": "3fd762fe2e87352ffa725d1bdd682d32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600688, "uuid": "4b0f09bc-d0cb-40c3-8c92-69cb8a40c0e2", "comment": "Malware payload (Mirai)", "value": "12552a110d5bcb5f593c40df2e78ce7253cc6103b245adb3029b15d44026f3c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600688, "uuid": "ea5741ca-429b-48cb-8e27-cc940714fb50", "comment": "Malware payload (Mirai)", "value": "f9c97c0af0cbaed6854b7c9ad24010ca92160dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600688, "uuid": "beede2cc-f8c8-4abb-b7ad-7171e44aaa30", "comment": "Malware payload (Mirai)", "value": "dc57378c6fde849dd55e4c4c239f2881f96e8985084fa44840caa08ce128d29dffe21a30bea9ed16958cfe401795926a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600688, "uuid": "b7501a7b-f5e8-48ea-8310-6888f7d49b2c", "value": "T118E33B45FC509B26C6D7227BFF4E428D772A1768D3EE320399256F20379A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600688, "uuid": "8e06532f-780a-4145-a745-831570a3dde0", "value": "1536:B8fp4C9pYOKQG/qAC8p8o8PFlhN9IPhHetADL/7T5xAzFo4ZXO2JtsSTdB2lE6wy:B/CPfKCJNCEtAn7FazF79qSBHEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784600688, "uuid": "6a151d38-29f5-453f-b8da-48cae2748b6e", "value": 150224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784600688, "uuid": "1d84d3fd-cd10-4650-822f-73bf587f0cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600688, "uuid": "735eaa0a-1cbd-4dee-bdd5-f4630385c7f5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037bdd2b-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593244, "uuid": "0292cac6-4a29-4f79-8c00-9a10f26b3586", "comment": "Malware payload (Mirai)", "value": "8316bec51a88000b6bb7e520271e1b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593244, "uuid": "12979ff1-75d2-4a8d-8674-c9753c17b170", "comment": "Malware payload (Mirai)", "value": "12f1d677a4f4dd24a1f21cb02d9dfd0eb5cdc58c69024efe3eb66ebd1fa3562a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593244, "uuid": "a8fe608f-4a51-4bb4-aa6c-715c6504c966", "comment": "Malware payload (Mirai)", "value": "6cef4b1801346487c9794c9831a0a3e156c37762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593244, "uuid": "86262c2d-8fcb-41b9-a11c-b8dc9aeac181", "comment": "Malware payload (Mirai)", "value": "915fa45430f62dc130b0f2d9219b243f552d8ee84a6701f6d8cd569bfae65012847939823e8096df94fd53b1c501b156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593244, "uuid": "e8f7fa7a-909d-4006-9ea9-dc6acf214df5", "value": "T157F35D86EA408A13C4C61777FAAF014D3322E759E3DB73068D185FB43F86A5E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593244, "uuid": "78c9c74b-02a4-494b-8eee-09448a905d5f", "value": "3072:3PFsu+bVZFpfnHpKhjiYq5YYujSrwGy/tBF1EDfX6OxM/9a8cdAr:f2u+bVZ/nHwMgSrwGy/HF0fKQM/9aldQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593244, "uuid": "532d7959-af45-490c-9c83-2feb9d1835b9", "value": 163542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593244, "uuid": "c88d9490-1b20-48ae-8f05-022e0b7b541e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593244, "uuid": "65abac7e-4160-4444-ae72-d484a26ca538", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afad774-8531-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784658352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658352, "uuid": "dd1d6193-43be-47f3-8740-5205424d93a4", "comment": "Malware payload", "value": "ca034452515154ab4ec0f4549107cabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658352, "uuid": "04303527-887f-4ea7-b45b-3d702a8373c5", "comment": "Malware payload", "value": "13589679f87696c61d4630c870b5b8be347d37e0134bffec7e7f3941c692c73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658352, "uuid": "eebd730a-c85e-4af2-a45a-74a37c91efe6", "comment": "Malware payload", "value": "587d1313e926c6889f90f50494044670686ca0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658352, "uuid": "06167125-ecf3-4582-84bf-8de2063de6b9", "comment": "Malware payload", "value": "fe783b5859cf8d7073043e6b2aba80b72de9b82be1faaf40223b1cbf28d1e6dcafd4194db1013524113ddee305a685e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658352, "uuid": "87e36934-94f8-4fad-be7e-d6f2fe554786", "value": "T19108331C6D24C66EC62AFBFE5D03171265C46B6A79370C17A758C2BC77D0F52A03A22B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658352, "uuid": "50992de6-72f8-4d31-96ad-1951f07ca1cd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658352, "uuid": "9b246000-7242-4738-9af8-62b3604712e4", "value": "1572864:bt9IKP5dJcRWYC7n2Gbd+JraYfvHQuA8juyMzUsMF87Vj+0hcxcFZSg7:bUKRrcRWbxczHQ8SV4e7V0g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784658352, "uuid": "2a4ccf04-12cb-461d-bfd0-d65c3d3d053e", "value": 77549835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784658352, "uuid": "594f5518-8b96-4799-af8f-af2bbedf701d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658352, "uuid": "9d0d8530-f586-4820-930e-d8058830f2d4", "value": "Nightmare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11b827-855f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784677928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677928, "uuid": "5ac37426-8123-4990-ab08-b82be5c9ff20", "comment": "Malware payload", "value": "dd348ba303af14edfbf64a1ee1b67150", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677928, "uuid": "8b23a110-3fe3-490e-acc7-2ca00a4773f8", "comment": "Malware payload", "value": "13ee006f629843e9d74482b9b6a5cc2a7deb7c343729e69bc92d5f10c0c1879d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677928, "uuid": "3ebd7118-0213-4ff8-9756-8bb37dfe920b", "comment": "Malware payload", "value": "62fe7c80aac811faf12b6c35f494ce0e3ab0a274", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677928, "uuid": "6ab7371f-27aa-4832-ab7e-808ccf981fc0", "comment": "Malware payload", "value": "ea389d17d02e4a35723307d30291148d0dc22ebf34ae9dd71b898473c50671ca69911045963c51d010c2ac8af7b18008", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677928, "uuid": "3cb744f2-8f37-464f-8348-c261b19e38c5", "value": "T18AE63318EEE001FAEAB7917CDEC181C1F96974A11772CACB4BFC92A19E971E1453C613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677928, "uuid": "a926dab1-a4e6-4bc7-bf11-d17280d8c779", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677928, "uuid": "43e20cdc-c054-4587-9762-8be2eb58e038", "value": "393216:09XcFO8EziPzbn+ZhztuG2HXMCHWUjXRcuI3/PGTAI:0V98EuPzCLstXMb8XGH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784677928, "uuid": "d0467ad4-9201-4859-9f3a-e4fb55ad0ded", "value": 14321221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784677928, "uuid": "5daa7661-997e-427c-acbe-76d0bb92a6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677928, "uuid": "f1e7d56f-4ac3-4340-b004-c6ed9bbdf546", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1631c9e4-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615180, "uuid": "4d52d3d4-22ba-4e64-9e6a-84004dc2f528", "comment": "Malware payload (PhantomStealer)", "value": "ac06f11fbf4839ad7d21591f92c61a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615180, "uuid": "fb007003-5ad5-4086-b24f-89ebf489fc0d", "comment": "Malware payload (PhantomStealer)", "value": "14967b7eaa3bc959adf0f0345d88561aca5cff9519e72b698facf5c569bfc48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615180, "uuid": "b04719f1-f541-4fd0-962f-11d3384c102f", "comment": "Malware payload (PhantomStealer)", "value": "cf01c02af342326cb98dc3d9b95289b8d001649f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615180, "uuid": "3629e8e6-8847-49a3-802c-e3d98566e4d5", "comment": "Malware payload (PhantomStealer)", "value": "7b653fef837ca199e51bc11a082b195e61f59a15fe0ef6313761fc4e7706edab3d40436b2778dd8e4445125c46aa8db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615180, "uuid": "d930b12a-54ea-4042-adcb-6819aa41a102", "value": "T1ACF49D68A3F50499F1FF8B7494B68421DE31B84BA938CB5F168452AE0D73742ED60B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615180, "uuid": "ede3e8d1-6f95-4d49-98bc-a9da6e625495", "value": "12288:r9C92gRSkfzLPMpay3OJj6wBxb8ic+Kt0+:r9CQgRxnMay3OJjvxb20+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615180, "uuid": "81bfc39d-7a49-4f3e-b857-661e11dc775d", "value": 764620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615180, "uuid": "cbdb2a29-e8f9-4a25-acd9-9a13e9410d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615180, "uuid": "59a51282-a9ac-4819-adc4-5190e96bc177", "value": "14967b7eaa3bc959adf0f0345d88561aca5cff9519e72b698facf5c569bfc48d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1022ec7-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784646014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646014, "uuid": "9ab87265-00dc-4d6d-bbd5-a3ecd3fb3e9d", "comment": "Malware payload (Mirai)", "value": "640c4b92576ac844d8d332d20c841011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646014, "uuid": "e2f22bf5-1453-43bd-9443-dd5681f09c69", "comment": "Malware payload (Mirai)", "value": "150609a660a659b9be9fc7c6b7846c0a94eb81cdd7a0ce848855a78be8239267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646014, "uuid": "e341f1d3-4e8e-45ae-8e2d-3f5ec1f9d9a1", "comment": "Malware payload (Mirai)", "value": "b69b7d84fd6eea01da839001e68bd318aaa53423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646014, "uuid": "22eed288-4327-4240-9856-2a6ba8cf4085", "comment": "Malware payload (Mirai)", "value": "b3d55dab9079604461463dada60c22cf67973b968f57c27df8ff3ebba24c87f0eba683c37e24680c4e4aa027a36c8dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646014, "uuid": "faaf58ba-ab03-440c-a482-67a232832b11", "value": "T120935C46BD81DB02C6E82776BA5D82CC332603F8D2EA7106DD265F6137DB91B0E7B650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646014, "uuid": "d40b0b62-7474-4ed1-b272-25ccbe05f051", "value": "1536:SLgZrbAHs9tVeJt5VpvmOYTRhzAkOP/i0q8Sna8Q1Wm24d28zTV:VZN9PeJt5/vmOY9RAkOPa0q8ScY4BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646014, "uuid": "a5281913-63a5-4314-949e-db8693bd9dec", "value": 95552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646014, "uuid": "4f45653f-45c4-4b1f-b92e-3cd8ca108212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646014, "uuid": "0070b93a-9c6f-40dd-be12-277369b58e39", "value": "150609a660a659b9be9fc7c6b7846c0a94eb81cdd7a0ce848855a78be8239267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf3b100-8503-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638355, "uuid": "d7812586-0c45-4880-89a1-40d830658da1", "comment": "Malware payload", "value": "a4d9f5c8023e4207ed562ca6b9acccff", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638355, "uuid": "3581924d-9323-49e0-bc4f-9f6d89d6318a", "comment": "Malware payload", "value": "150bccbde3ba9db9347f5e41984ac9643f860ab423c62376cdafc031c2e8458e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638355, "uuid": "3f5d896d-59e2-40bb-a402-1ff2dec6daef", "comment": "Malware payload", "value": "f1c8fe26ba9494b520e601e856ec959d72f9d985", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638355, "uuid": "a2f85b4e-4f42-46ff-9992-79f62ec8e1be", "comment": "Malware payload", "value": "5b1bb54e6ad9ed9c83115804a224d70b9261fcbd29eb1284db2b371c5c2bc5d9f59f89f58b2879ca3ef1739bb60844ac", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638355, "uuid": "96cca3f2-2947-4d02-8887-4dd421be6fa1", "value": "T1E592D8273AA254A543833D7889CDD108E7681597000E5FACF8CDD786EF6362593FBAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638355, "uuid": "b591cbe1-0efe-4c64-9658-aea3e184929f", "value": "384:pWEDael3X+nABCNSNLoLgElRK+C3kE/ET4Q:EWaA3+ABiSNLoLgElRKwE+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638355, "uuid": "b8555714-8b23-428d-b97f-ddd21b49013f", "value": 21010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638355, "uuid": "8e744931-7237-4307-b127-74222f370f23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638355, "uuid": "039930a7-2f4d-4fd8-be3b-b46ef643bc73", "value": "fivebellsinn.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa63319-84e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784627060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627060, "uuid": "64c2f36c-1af7-4f1a-a7d6-b2332487aca5", "comment": "Malware payload (AsyncRAT)", "value": "ff3bbc4ca5b236727a1c0cfdacc770bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627060, "uuid": "a8d56b3c-1a93-49dc-8132-4dcdef0a2b3a", "comment": "Malware payload (AsyncRAT)", "value": "1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627060, "uuid": "48ae8fc2-3fda-4b8f-8f40-5ba2ddd0bdf7", "comment": "Malware payload (AsyncRAT)", "value": "33315c0906a83e46f62686ed71b6956aed30e868", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627060, "uuid": "a3a3a6ae-da67-40e5-9cd9-e22e39e55b4c", "comment": "Malware payload (AsyncRAT)", "value": "6386255dd0e77d94f6931f71284c30a347b77c3f30f8f61f68592883372d268b7c1beff22f8784f5d566ccc089b597b5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627060, "uuid": "93d46b72-9284-4515-9532-6d8fcc65969d", "value": "T1087515E74ED8C483F4252626DE099034FA7287627EFF266F70F376885B21055886C9F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627060, "uuid": "0bd3f848-bc76-4385-8ad0-d0c5bfaee6ad", "value": "192:5pxIahuv6OeK6LVLqvsbzRVX/Al8/Zmr7:5b9huvitJqvsbzRta8Qr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784627060, "uuid": "51365822-03ff-47bf-aadb-e832b1d81c74", "value": 1686072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784627060, "uuid": "996ddca9-1baf-4c56-8bf8-db1205f27e6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627060, "uuid": "0998b8e5-47fa-4994-b09a-cd223fe18cdd", "value": "sample_product inquirywa004678.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2194e931-8525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784652994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652994, "uuid": "c60ec082-b6fe-4b90-bf8d-341618338085", "comment": "Malware payload", "value": "eabf6402df0612bd1fbf4106e528a1ef", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652994, "uuid": "0c5df64f-9bbf-4bab-9957-6e4b4d57c262", "comment": "Malware payload", "value": "16b42c88cc7140522e273071df1eb98f02850d6a69a4ffbe20b7cd388063ab16", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652994, "uuid": "e9e3f83d-3c20-426e-83fe-d8c3b16efb64", "comment": "Malware payload", "value": "fa3a38a6a0e054afa12506233e6add629b09fe5b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652994, "uuid": "1d5e6c28-63b6-4598-927c-aac6fc75debc", "comment": "Malware payload", "value": "5d25b9b6e5584cd48e50ea07084cfd58bbcd88c0d82b4e19459b5567ae1ec2c0dd79e79ee0d3f78f61f5583f24a798ad", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652994, "uuid": "a3eef535-345f-495f-a865-b4e90ad142b6", "value": "T17B6523956BD000AAD87BA3B89AF322536775BCC517F4D3CF624082A92E339C4717B746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652994, "uuid": "69a84ea3-4d15-48a1-b905-a1fa74ceb7db", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652994, "uuid": "1d402c92-602b-48c6-89bd-4376b8fbd507", "value": "24576:wrsRcbYKNp03n4gZWmA7OABU5CpU8xPhuyHyCH+8xc9jeYu+gXTk0kyI:wrsabNNp03FWmA7O95iUUPwULH+8Ff+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784652994, "uuid": "5d26030c-bfb3-4bdd-ba40-6a43ffe95d5d", "value": 1533368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784652994, "uuid": "9ccb4271-36ae-4da1-bbe0-1655237d3ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652994, "uuid": "2a708824-505b-4be4-8087-5bff05e2c2a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdacb6c-84cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784614417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614417, "uuid": "8eedaa1e-5d17-4806-be22-e013e69b174c", "comment": "Malware payload (RemcosRAT)", "value": "a5ecdde9d8a150611dad07079b465a95", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614417, "uuid": "c4dbab72-5354-4c49-be76-fa7bff9d0c60", "comment": "Malware payload (RemcosRAT)", "value": "16d3ef151d14921c1b6e883ddcc218b20cee2e1e0a312a8e0c09df281237b963", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614417, "uuid": "0413829c-70f2-43e1-8e86-7767f7daccfe", "comment": "Malware payload (RemcosRAT)", "value": "e4d394f8f2fab1c57b01eb32175640977c4bb757", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614417, "uuid": "568cbdab-274f-4a28-8406-1be3b2e88ca8", "comment": "Malware payload (RemcosRAT)", "value": "f97419bfc79e6777a0b930db679a81ec323afb44b8f19ddcb20a0473ba5bd0252a26110cccd5b6132d035941c1657416", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614417, "uuid": "4b7f4f9f-7f2f-436c-80d2-57d09d55b126", "value": "T1117230379B9249F8810415BC774DA6DCB3305E0BC49D88ED6333B58AE613EAB0C436B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614417, "uuid": "def3bf25-cc5d-406e-bd81-53a0bce996f8", "value": "192:BJkZuwehmMoKmkDKZNUJu9kimGKW4FLINSZYWu14trP6cQEh:TWMhmPKm/ZNUJu9cGfNLL4xP6cQEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614417, "uuid": "68f9d601-4f13-4ca7-9c67-7bb39c4f3b7b", "value": 16027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614417, "uuid": "e06e8f85-e9b9-4a98-b68f-201750eef419", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614417, "uuid": "2b2dc7b3-5bea-4718-97b2-77671580adf1", "value": "winthematchwithbestfeelingformebest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5793fd8e-84dc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784621732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621732, "uuid": "97446ddf-25de-49f6-8bea-076db5b1a4ff", "comment": "Malware payload (Mirai)", "value": "55d46509eca5ecad8e57300a65580a08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621732, "uuid": "22fa969b-2a77-4899-8fc5-1fcb1f02555e", "comment": "Malware payload (Mirai)", "value": "176420754571f94f9f35614adb262679607614a7d800544f8c1363f2d26c82cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621732, "uuid": "b862e31e-d4cf-4f8b-a5cb-e56b1ab9e54d", "comment": "Malware payload (Mirai)", "value": "7bd024e75c6949ba35754fa002e2d970cf37b9cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621732, "uuid": "b7b7b1be-800b-4df0-92ba-70a658777dd3", "comment": "Malware payload (Mirai)", "value": "b2bb32e48f151f5eeb27ce6215af2525eb3395ecd0178e53b78691297a346524438471b7ee59a69be881ec3a74465ce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621732, "uuid": "e523e7b6-4de1-4c7c-ad02-0556a42631ef", "value": "T182042B86B8C59B22C2E14277FE4F014D331597E8E2D9731ADD284B93378B41A4E6BE25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621732, "uuid": "adf2a2d6-4774-4ccc-9f72-f15fb88d5d06", "value": "3072:XI0j5Ew9nLeIg008qN5QMSB7h55GfcNFdMAvLQSZ5LeYVnQ1:XI0j53eKPqN5QMSB7hKUlMsLQ2o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784621732, "uuid": "5f4ad971-769c-4ec8-b10f-adb31361a7a2", "value": 181440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784621732, "uuid": "9a92f553-4c35-449f-bf51-486dcd5d02c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621732, "uuid": "f2e27c41-0009-4104-b627-dbc70bcc6207", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43930f86-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784614826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614826, "uuid": "49262a72-2704-40e9-897e-7d1032711e3c", "comment": "Malware payload", "value": "09dcefea25c0b967f565483921822ab5", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614826, "uuid": "bb45be40-d1f4-4069-9fdc-c3ddebf1eae8", "comment": "Malware payload", "value": "17d5547ebd2e3a9ef610bbee77eb9dbb4955f37f616867b086507c88a56bd219", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614826, "uuid": "d7a7227f-8a43-4e6e-ba75-af530f1937cb", "comment": "Malware payload", "value": "baaa9825603dcac31a412e96f9682ae98d1a87df", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614826, "uuid": "d0bd55d0-43b7-4aae-90d5-5dee39db24c5", "comment": "Malware payload", "value": "9f5143ddd2a83ffd410ab21d6f684fe5ee4116da1941416cbafc3b3fa478ed4560c096d87454ab6032dcdcb76a805295", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614826, "uuid": "c5283022-2b26-4ac7-a3d8-b918b30ccb91", "value": "T1C1F56CC3EF440090A818A5F55C93A3E2F896978E7F9FA15F9C45CE14B132039EA5E5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614826, "uuid": "a8e35e40-be36-4768-836f-d5f014b0e2c9", "value": "98304:Aco/a1bgynNaOiJyeFgOLl61aU3h5I2WF1YFK:X82bD4OiJyeFgOLl61aU3h5I2WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614826, "uuid": "2e55401e-21af-4f1d-8a6c-1efd7d853f00", "value": 3565425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614826, "uuid": "19c08268-b2bf-4b4f-a4b5-3a9cd6abf9a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614826, "uuid": "ce9ae4a7-c5d5-4846-af74-84f7e7da46a4", "value": "HDDT v8.9.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5021587-84df-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784623257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623257, "uuid": "040e9239-d7ff-4cc3-974d-50b5c1af38bb", "comment": "Malware payload (SilentNet)", "value": "9e37c6b237d488ab073c90e892140e35", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623257, "uuid": "be92c678-ce50-4d50-926a-13e7977746cd", "comment": "Malware payload (SilentNet)", "value": "181897e48ef1effc738d8aa1dcb2f08d1427eec5d57609c68629992fc04b5dfe", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623257, "uuid": "065fbdc8-b7d6-4b4c-896d-4db31075a26f", "comment": "Malware payload (SilentNet)", "value": "d4682e46770b9ef87dcd4a78ca7dcd5023bdadf8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623257, "uuid": "06e18597-a71a-4609-a8a3-162c84e139b0", "comment": "Malware payload (SilentNet)", "value": "060e130fe38cb04ad396d767dffd843edae6dc0fe259807dd0c100491dd93d04ef1ab6a6c377fb8e5b4e20b651be96cb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623257, "uuid": "33227f65-617a-4ae3-9ea8-59f26d39bbdb", "value": "T126963376E915183DC6E7F136F422CB93A63E2FA1E21DBD2F85BCC0571089C981B15B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623257, "uuid": "a19eee37-2681-4fcd-80b8-e4a74077572e", "value": "196608:mLEEW6uPpdnmHrtYY7Y+muX9ynJaa7Y/Hk85rG1:mgEW5BOrtplmuNynJaa7Y/Hf5rG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784623257, "uuid": "7ef8ae8c-9462-486c-8470-48d5c93798e7", "value": 9294771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784623257, "uuid": "83bd1dd2-5c5f-4b46-900b-27001dcfacaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623257, "uuid": "d170fe89-8334-4711-a9b2-5b1ab87ea33c", "value": "anamvm-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077eb15d-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload (Adwind)", "timestamp": 1784672707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672707, "uuid": "b0825483-603c-4b0b-9ef3-59f035dcc3f1", "comment": "Malware payload (Adwind)", "value": "8103660c25c02cc557ddd355f83cc432", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672707, "uuid": "9dfc0d92-2bfc-4851-ae9b-73a335ca7d1f", "comment": "Malware payload (Adwind)", "value": "18d22205fc172fcb534505791d7b6ddb08d58fa31063be642e9fafb415ba3891", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672707, "uuid": "fb59a177-9065-4c37-9ba8-293d9f59722b", "comment": "Malware payload (Adwind)", "value": "4ce114be49a9a3f55895389efd318f6c136425ff", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672707, "uuid": "6c80573f-0ed8-4c6f-8f59-c3098f89ef66", "comment": "Malware payload (Adwind)", "value": "62089bc3ebde5104a64145099f4d2080ba09b6e9032ef0332f34ef2fe5bf1ed32790c72eb844f3d827b905c39ebb7f9a", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672707, "uuid": "e9df775f-6268-4754-af95-0b0cf0daa1d8", "value": "T199B423761238D7A47613FDCE96595F302B63F91C6F8D222D65C61CF153A8388AD2223B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672707, "uuid": "2b814a26-6a13-4d5c-b627-a7a0df74db9d", "value": "12288:oZ4MC20jN8+EAHRdYwCFH/I3n9uGdWSuCMILMm02PzQgJBDggCYVRUv:Ku3hBHH7CJI39Hd2CdYm02PUYBD5NrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672707, "uuid": "91d59d0b-a898-40d7-a489-a7e0abe4200b", "value": 528835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672707, "uuid": "103e5fe4-5cf5-4155-8ef2-e046e5a844eb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672707, "uuid": "3384ab61-536b-4cb3-9cc0-299cda23bf28", "value": "QUOTATION #POPO996574620775800000.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0e55c7-84d5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784618703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618703, "uuid": "ccf5d9b0-4482-4d02-9104-6c463a3597f0", "comment": "Malware payload", "value": "a5ccf9b1b7400aec820d3a13e470ee4e", "object_relation": "md5", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618703, "uuid": "b292a6a0-4275-493e-89ae-09ac34ee5261", "comment": "Malware payload", "value": "197372db99b51bccc72b34dd3c7f13087720eb93564f4b8acca06820f36ad46c", "object_relation": "sha256", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618703, "uuid": "88fe63dd-e263-40f8-9d0f-f4e090a7ac79", "comment": "Malware payload", "value": "43e26baee9de1b7bc49ca048355723df43499397", "object_relation": "sha1", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618703, "uuid": "abb011f1-8fb2-48d1-a2d7-ab433e7d84b2", "comment": "Malware payload", "value": "7fa57dd834adebbeb48aba3b19ecf150067010276298cc84cf948dd7dbe075c42f3189f106aa805e6dd9adc6b79f090f", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618703, "uuid": "8ce1c28c-0f89-46b1-80c6-f66ea205efb3", "value": "T11E74233A5F0AD9BA76E6DC272CBDB128FA202F340BC83BD172584843DE573599A1453D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618703, "uuid": "2f6c6c1d-a088-4629-8dcd-206256c242b7", "value": "6144:FRsXO1HdwtH+HZehfORz/l/QQftSdtN7k3kdwINo3IFFPZlkrnb3T5:Fq+PQHYehiLl/QQfYdwciIvRlkTr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618703, "uuid": "f2b4f067-dab4-4e70-8bb4-19e58eb306b0", "value": 360260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618703, "uuid": "28f35215-e4a5-47e3-8f0c-eea8295a0a19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618703, "uuid": "0b8e9454-96c0-4c1f-8185-dfa9041c08ca", "value": "ShellCode-Donut-Marte.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b14ba66-84e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784626382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626382, "uuid": "46b264e7-8759-40ff-bff4-c7a54ed5b2d4", "comment": "Malware payload (CoinMiner)", "value": "26a4afc03fc7e4f1168fd9edceae6f8b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626382, "uuid": "48c555a5-86d1-41e2-9e73-c3fc61297f17", "comment": "Malware payload (CoinMiner)", "value": "1a937fa01d4ff5ce37ce61bd6b6abdca0c9bd6f66752e640b77bef673f20bd27", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626382, "uuid": "6d59f1d9-ba50-427b-a199-f5290f89d570", "comment": "Malware payload (CoinMiner)", "value": "2277580f66e7fec812e2617f586e9d2d8f7a643b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626382, "uuid": "f10e0844-e0ee-4403-8a21-ebdcedbd941c", "comment": "Malware payload (CoinMiner)", "value": "58d829b4220a8ebb6eba681a57f3c44ee6e89e581ffc0293cb4475b7a6ee3f44b0df272f6c46c3e69dcb7c89b248f4a3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626382, "uuid": "4c11c5e9-d1fc-41cf-9deb-2bf1f3eb3880", "value": "T127541201F62594EAD86487FAC02FA623667FB4851B3676C30777BA0935568D063F81F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626382, "uuid": "812e10a8-6c68-48ad-9333-9cc3efdd25dc", "value": "ae80905c26c5965a204fc5adfb15310e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626382, "uuid": "20a9d544-0877-4295-acdc-533f07806c04", "value": "6144:YTx8jKD2gfcCkxZCfKMh6tDDBYneComxN13+FgNSUofO4:YTx8jkoG3hAVYn7rV+aof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784626382, "uuid": "567fd74e-b42e-4ef7-9d93-bc70fdf97a86", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784626382, "uuid": "f3f33289-d6bc-4efb-95a1-95db24a2d8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626382, "uuid": "c3e3447c-1b09-46c3-8f4d-43ced123384f", "value": "SecuriteInfo.com.Trojan.MulDrop38.50788.7486.7398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1384a97f-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613028, "uuid": "7be68606-c324-43a2-b2b1-2006dacbb3e5", "comment": "Malware payload (Mirai)", "value": "64990edc694857fa26dfff7b64d7f8bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613028, "uuid": "ec8f008d-a2ce-4a32-a5f0-80a4ed7a116f", "comment": "Malware payload (Mirai)", "value": "1ab2909551d6de12fe91ac5e6ca2e81c62d84f26739321a88a5794c749475eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613028, "uuid": "63aec1c0-126b-4c5c-abd9-6b63d7cc6687", "comment": "Malware payload (Mirai)", "value": "946711b1b5562e748db0e86aa38a58826d1fd623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613028, "uuid": "5d9861ed-4da2-403d-a326-80f33a10adba", "comment": "Malware payload (Mirai)", "value": "65788be62b3c6ed2c56360548058e20d0b372886db1a4abb9d5b620b8c754d5eddc7129b424f58425e103b00ab5b8d20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613028, "uuid": "182a2046-62ff-42e2-8e72-060e24909cd9", "value": "T1DCE319066B0D0E03D1532DF437770BE1839BAE5228F9E680751AFEC957B2DB2A506D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613028, "uuid": "5942647c-bf31-40e1-8b93-c9793c89a94b", "value": "3072:5hDLCkIAcGcxjva0+ZfDIk6bU+rhsuq2HX:fH7PcxG0+ZMk6bUUhsunX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613028, "uuid": "d76a9ce2-211f-4fb8-9ff4-12d7a7a12f5a", "value": 147124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613028, "uuid": "fce035c9-bf7c-4196-ae02-f1a24bb163ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613028, "uuid": "1df51719-5ea6-48c4-a71a-9d16c0502b5d", "value": "eclipse.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637e6765-8507-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784640220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640220, "uuid": "9861a2f1-e834-4ad4-928b-605b21c8f3d5", "comment": "Malware payload (Mirai)", "value": "7f448a4bc02f639e7aa9a4fe003d10e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640220, "uuid": "ff5de62f-4a59-459e-b86d-b855823f3c35", "comment": "Malware payload (Mirai)", "value": "1b665073448a854dde3adfa8746598f3a2cf7dde258362d2faae6b85ad4f4bf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640220, "uuid": "a3084612-4d6e-454f-9fec-462bf2c86f5d", "comment": "Malware payload (Mirai)", "value": "a8d3dff1f0c24af0934c9e966d50192ebad3e009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640220, "uuid": "3ba96268-0862-497a-ad27-8f8c5dbf8394", "comment": "Malware payload (Mirai)", "value": "03d477f8a5b53c0e5eeb69deb5bf6f6a47ac4c0cde4b031d4beaf6146087a0b6f2abc4e981a957c93905d94df3c534e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640220, "uuid": "47e4dafc-69ce-48f6-b8a3-3999a2554e01", "value": "T1DE045C46EB818A13C0D71779B69F524633239BA4D3DB33069918AFB43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640220, "uuid": "924bc917-af97-4396-bc7d-4d1e301b179f", "value": "3072:OUYNIkBWDMBaShF/h9b1tgBKsXCmiHUdLoy3d0fM/9jezpFM:OUKByIaShF/h9xtwdCPH0Loy3dEM/9gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784640220, "uuid": "2793693f-42f7-428f-97ac-d5ed852ed2b6", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784640220, "uuid": "72c2634b-f970-4ca2-965a-33f38076efc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640220, "uuid": "dce32f08-02ed-460e-b5a5-b85d57076b17", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b689fab-84e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784625979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625979, "uuid": "7bcb4c58-9bd6-4f9b-842c-9382422f8cfd", "comment": "Malware payload (Vidar)", "value": "399bc27de8504d4d7a179610daf536e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625979, "uuid": "5c6ea8c2-b44b-44fc-ba38-ced607b9c7e0", "comment": "Malware payload (Vidar)", "value": "1be456ce5dcc58dbf9463d155d5013bb03c1df0627be17ecfc4ae5d45c6529d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625979, "uuid": "18852572-980e-4fd4-9272-f54cf2eebc48", "comment": "Malware payload (Vidar)", "value": "a1962c5ff185e7f667ae6b8ebf943c97ee1ef4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625979, "uuid": "e6e15b2b-644e-4e94-a180-e0fa0b216dc6", "comment": "Malware payload (Vidar)", "value": "b6e72f80fcf3b3a650178e1466beabfc3138217c6b8eb64610de449d4bd76c4ca76c98699b961b37f0a5724b0dfc6f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625979, "uuid": "403ac9cf-bee6-4c0f-9fbd-cb9c0762a177", "value": "T155267C176F9089A5C495D232C97642057369F80F07BB33EB2D76AE383E327D59939B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625979, "uuid": "954f8f67-c2ec-49b1-a068-33c575611036", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625979, "uuid": "6aa92264-9b2d-407d-89f4-7b4e0998873c", "value": "49152:wrxw5tDtreg4ycl84gLY49i6mB+onr31PB/WPLly4i3k1dBk7kMn1xAftxwNVBMJ:wrCAvuq3k1dBk7kMn1xAftxwN0FedyPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784625979, "uuid": "90176b47-d52f-4f5c-a9d1-03d30a15bdce", "value": 4439200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784625979, "uuid": "b65ccf69-4090-4c81-a326-ec9211755909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625979, "uuid": "e230f9b1-b2d5-4668-9f59-ad52ecb9bb1a", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af34d41c-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784611141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611141, "uuid": "05187ada-aded-4baa-b113-518cdca5387a", "comment": "Malware payload (Gafgyt)", "value": "39e867f7e1a80eab55bd39067de2d101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611141, "uuid": "6a645a42-a409-412d-8739-96f42839f3ef", "comment": "Malware payload (Gafgyt)", "value": "1cf3a473824ecd73dd246db96a9a11a3b094cf1052a085f86fa5327f550eecdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611141, "uuid": "13470c20-fc12-48ae-9091-45db7463facc", "comment": "Malware payload (Gafgyt)", "value": "0397b0bcea1ec0e210858852aee32ae18a5e440e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611141, "uuid": "9fecf214-7a88-4183-9afc-a8f824344219", "comment": "Malware payload (Gafgyt)", "value": "87cd93227fa6ff748c3d491e97d30f8a0101323a24640d8951da5fdc2aa5289a15e2556c56ce2e719ed6a8235042eafa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611141, "uuid": "865a039e-d2c1-4cd0-a918-16b88a946736", "value": "T18E14C719AF510FBBDC6FDE3702EA0B0529CC655722A43B363674D928F54A90F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611141, "uuid": "586c3688-3cbf-4c7c-ae51-2bc1100c09d1", "value": "3072:VfLDumBEuqQxj7ms/bHFzwXICJLd7ag0VbgfBDCcT:VfLiExj7d/GYM57BIsmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611141, "uuid": "88f40e6e-5741-42b9-ad7e-265527f35308", "value": 207552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611141, "uuid": "b3f48b76-60fa-48c8-9935-85c07c654bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611141, "uuid": "efbc0a39-4750-4e8f-8d83-4bea71442bd9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de8ee3e-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784619058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619058, "uuid": "eae699fd-fee1-40b2-b45a-4d6a7fe24de1", "comment": "Malware payload (Mirai)", "value": "3976cb22667f808a825126cc270beff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619058, "uuid": "32690513-68bc-4399-bda4-8dda3bbec121", "comment": "Malware payload (Mirai)", "value": "1e2fe76c69ec4f78d0e63fba2f08b919936f5d82c1dddbacd74b82d6a33f01e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619058, "uuid": "16d79dc9-f8b6-4221-bf53-0a7d4f978c5a", "comment": "Malware payload (Mirai)", "value": "0dcd7bb5807d574a69ef2a411253c65c66f83ceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619058, "uuid": "e7b32d52-5814-4113-a8f9-b1221142fd9a", "comment": "Malware payload (Mirai)", "value": "794569b2741141ae7ba29580dc08344a1a0a71fe8c44d8827087cc38cafde5fdf3175a718f220258f6f1408dd048fc8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619058, "uuid": "0d46e5fc-c9d4-41c9-808f-a28dcdbcd74a", "value": "T19B730229F6294F7FF15008B86EB00B4263378FB16536FECAE964C9C5C9921D62E07653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619058, "uuid": "39b62107-19d3-4159-aeb4-51bb8c609c6a", "value": "1536:gG7G7jRCBiq07qfYCRIhxxlWRkptbs8/mx0zJwmW/CeVTisM7+NYV1cXTm:fSpr7ghRI3xLphsomGzmC4TzMKuV1km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619058, "uuid": "5c7a4716-386e-498c-a390-728e64996266", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619058, "uuid": "7789c046-bb7e-4217-81e5-5955bb04e4e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619058, "uuid": "92d02844-2d67-43e4-b605-88605aa51150", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0844d405-855e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784677433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "eeb3f44f-8faa-4a69-9c8c-96579c913f40", "comment": "Malware payload", "value": "f42db6ffdf93e601e7fd8de6087a9bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "89a73d69-187c-4e87-a918-4dfdbd654056", "comment": "Malware payload", "value": "1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "cfdce780-68e9-466b-bc60-1f086b790cb2", "comment": "Malware payload", "value": "f4dddf0fee73465efbfaf305482c9b4c1480a529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "7e727960-3317-44c2-855d-5d868f92c255", "comment": "Malware payload", "value": "26fb84cb9cfd386e845c8aeaae017f70919ffe1ae79e7279c26410b835c24654d5defabc1b6328ecd47ff069c0598888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "f0e98446-40f8-4d8d-8c0d-61b9c0964511", "value": "T15B664A17FCA524E5C1ADD1308AB69653BB727C891B3123D32B90F6282F76BD0AD79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "ce414d48-af77-47ed-96e7-93f36a338aa5", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "433239e2-f398-4362-afd7-dc742a3c4121", "value": "49152:eiQMUqtiuVHM8VogQ8MXiQQLhD+qBC+8hVvALe+MaPujoTpIASRrs7ZGPwL3l+Ng:eirPI4qDAWoTn7xpLtiUKnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784677433, "uuid": "f7f9aead-fc29-484a-9ea1-d3c124bb4c76", "value": 6808064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784677433, "uuid": "0406b3b5-75de-41a4-b6ce-f684a8331797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "65b1283c-827e-47b1-8a82-7973be1a0122", "value": "agent_windows_amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a36d03-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784620467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620467, "uuid": "eb1746b5-a520-4903-b790-df6170f3ae09", "comment": "Malware payload", "value": "cd3e4231548c5034886f98324f84e3c5", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620467, "uuid": "a7784986-53db-42a9-ac0e-d283c24ae5ed", "comment": "Malware payload", "value": "200d998427ae5e0ea0a05cadd5ab2261258b047b6a976e1a25d6f81e1961ae3a", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620467, "uuid": "6106af37-2c2e-46d6-ab77-eb7312ccd513", "comment": "Malware payload", "value": "39cbcc22c0787d93e2ac7d87a88fa44fcf7b2d7c", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620467, "uuid": "ff4ec799-b8c7-4c9f-a8ab-c0f1666b0b00", "comment": "Malware payload", "value": "99c1c6dbf95e404e1f80bd849d7c37128a68ed7ecd10469599f3aa6b148f68a1eaa43ed93b88ea1218ba27ff734e28d2", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620467, "uuid": "0e73a383-169c-40db-a045-d80e4e9f74fc", "value": "T1091733B21DB4490FCAFB5DF703D003621B8E8B310865D5ABBF5E94E9F66E642820D359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620467, "uuid": "6e6b7c91-d43f-4fa3-95dc-960325ad47b3", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620467, "uuid": "92eb2aee-9df4-4c0d-9084-e327007340c1", "value": "393216:vijPr0EBx+gtzeZMi/IEUdkJlK4cgEfAXNY0CR79hcXv+SYM:vsz0nIeu8JvXe0Cp9hcXv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620467, "uuid": "a155bb9f-f20a-43e2-81c8-a245332e6464", "value": 19091456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620467, "uuid": "4258f380-ca50-4588-a771-98d53610da83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620467, "uuid": "d8115f6b-5e07-429e-8933-f68d814e735c", "value": "Installer_v3138_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7d5974-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784619240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619240, "uuid": "46ec2eac-59c2-4cae-8953-4845c092e615", "comment": "Malware payload (Mirai)", "value": "dd3fff0bbcb2f1aab618c8c1a06a83ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619240, "uuid": "46abcae9-4223-4982-b739-29f9822d69d2", "comment": "Malware payload (Mirai)", "value": "2040185beb934da4c451dff56f113c7644d9edaf34ed61916407efb99651d94b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619240, "uuid": "3d4f9785-761d-4319-b509-a0e890fdcdc3", "comment": "Malware payload (Mirai)", "value": "5beece3faf24688978386fed90cf910c66664a58", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619240, "uuid": "b4c30263-2a12-4d4a-87f3-26086f8f2b67", "comment": "Malware payload (Mirai)", "value": "11e6449bc5e354010f8f5d4ecd3eb1531d1971d92616209bf599393ca99f1e0a768ff4de6a07f5909fe3c25f0bb9a3f9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619240, "uuid": "a58efff1-e845-4b32-a415-6bb578f950d3", "value": "T1245146C8737581303FB2E97261E95BC422D0AA9390E56FC2B0F6BFA1518CE2D7094B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619240, "uuid": "13031608-ffec-40d1-ab6e-433371c43e91", "value": "48:vWiYWNbNCWzWWkUnWvsWucWy8W4S4WuWW8WJmWW0W9WpCpT+WUH:vA7l+n9Ma3mjFX9yuT+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619240, "uuid": "ba74d74b-a603-4351-8114-0df07291cfd8", "value": 2654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619240, "uuid": "aa5ed609-6cb6-41e9-a3ad-b6d7a4e9053d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619240, "uuid": "8c14290e-a2fd-48cf-9de3-3155f95c4f9b", "value": "nullnet_bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae80b9cd-8525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784653231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653231, "uuid": "0e2b77bd-16b2-417f-9b80-caf281127d22", "comment": "Malware payload", "value": "d8c095ad4606cfee078ec665fc7f8d3e", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653231, "uuid": "43a71bde-0c4c-424f-900f-eed0b5fde3b0", "comment": "Malware payload", "value": "217da2717f538903ab31fd688baef1d0d609d8ffd7d589066707cd91ba3a3525", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653231, "uuid": "5ada18f8-69e8-443e-a4a2-3b9568b3cfeb", "comment": "Malware payload", "value": "b79a2b1b23dac5d98b0433a162ab98e8be07cf11", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653231, "uuid": "677400b3-3826-41d0-954d-9ee46133cdff", "comment": "Malware payload", "value": "c31cbe6cfe07b1d380f0068bad8635ef626e092980235cf3720ab4fda6dab8a4d729f285c2a885fc42a17e744e45968b", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653231, "uuid": "a2f8622a-d6d8-4960-97b4-1d6c6a1e5fc8", "value": "T14CA128BBB1519E317CCB962C2B506C96940BA3E3691FC4D6754E3D02BFD6E90BE29700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653231, "uuid": "473485d3-a2ee-4e54-9561-f078553c93bc", "value": "96:HsKBiqTamLrDCkxwqyWuIRJxQrmGiGJKuedMDHHyPcMbj1yXqX:HsOCmRaoMDHHyh8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784653231, "uuid": "f3efb0aa-1413-4ed6-b94b-b4584065d4d8", "value": 4867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784653231, "uuid": "159967e5-ffcb-4b28-826f-a81418612930", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653231, "uuid": "fe972426-f216-4c31-b049-ad8a2295075e", "value": "217da2717f538903ab31fd688baef1d0d609d8ffd7d589066707cd91ba3a3525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418e10ff-84d5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784618688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618688, "uuid": "ac7fc21b-4469-4158-84c0-d19bef6dbb6f", "comment": "Malware payload", "value": "38ae9179256fbab35e0069cfdd04eded", "object_relation": "md5", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618688, "uuid": "9a23e9b1-bfb6-42c2-b7bb-c0d50b055e65", "comment": "Malware payload", "value": "2199efc51ed28df18b323707931ab33ded5cb3ddb090797b76e87db9b38def84", "object_relation": "sha256", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618688, "uuid": "1cf9c0cd-a412-4aff-aa7b-e508d4c5247c", "comment": "Malware payload", "value": "81864b0239eda003ae0618e77010c252a06be2fa", "object_relation": "sha1", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618688, "uuid": "46afda28-5a40-45c6-97c1-d7285b5b4e45", "comment": "Malware payload", "value": "5e3b00e181f6dff5642e4bf5d2774bd1cc8567bb697c56a3d45e79f308b63d5e81982fa061767189d3bdc63706aa09be", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618688, "uuid": "02637ab5-1675-4f66-a373-e91c2217ff57", "value": "T13EF4E136BBDB1C1B6EB7154AF0F19043DB78C1E3122140CE67ED0279835E85997AB62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618688, "uuid": "3bcd61f3-4511-4249-a2de-447622592333", "value": "12288:Qwl0aDl7ZVoL5KVMKOeCAFkR+722BQGhUyr+LR7yxiWblpUqpRMqQ6DH53wOy:caJILYAA642pGhJqLRPOlpTDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618688, "uuid": "bd6fd68d-bb71-49ad-af02-eb1a3ffeeb49", "value": 728982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618688, "uuid": "f8a37dc3-4b2c-4bd3-8186-2f1bdf274ae9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618688, "uuid": "c9b2dbde-4bdf-4d99-876e-be41eabcdcf3", "value": "embedded_runner.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deff0238-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784646011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646011, "uuid": "0e444df2-2dbd-480e-9d1f-67b90cffd17e", "comment": "Malware payload (Mirai)", "value": "c21078339fa0bd148abfd01e2943345b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646011, "uuid": "0fecd0bc-2235-450d-a2c8-e03082390c43", "comment": "Malware payload (Mirai)", "value": "226d5f0493530a890fe642db959232b63ba8b7be48ea94a65cc68f8437b10ae5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646011, "uuid": "6490beec-3841-4c53-97a8-814b5f7c5d08", "comment": "Malware payload (Mirai)", "value": "af8c8bbe61494b5ac8cb1811066ce833c1ab7a1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646011, "uuid": "71174626-ceba-4b55-b091-79079b931db3", "comment": "Malware payload (Mirai)", "value": "c16f088bff787c88e40e88e8282e9e689bfb20ddacd7e6d9f473c8b4d3a82ed43e11faeb10ffbf46fa84b6bd5d06f29f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646011, "uuid": "2f9209bd-75d5-4c0d-99b9-e1713afb9ba0", "value": "T15BD3F809BFA00FFBE89FDD3341F90B0A258D691763A97B367534D818F59A14B0AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646011, "uuid": "5eb51c29-266f-48e6-87af-716603e0bad1", "value": "1536:kaDrBahdmmasZO+D+e7C1HldWtsVf9y4aYvrDLx7Fqlv0DiPgsReo63F9QWWpCjy:LXsulm+1G4aYvzxESyeo63F9QWGKbVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646011, "uuid": "7bf62c94-c411-4500-97d5-59d4f00b3077", "value": 130224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646011, "uuid": "6e914a50-51f3-44c0-874a-836faf75169f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646011, "uuid": "306ad1a0-7bcc-488f-aeec-4fd26fe2b90d", "value": "226d5f0493530a890fe642db959232b63ba8b7be48ea94a65cc68f8437b10ae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76b9daa-84a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784598324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598324, "uuid": "9bb4316a-1535-4b8b-a4b3-55a024621560", "comment": "Malware payload", "value": "1954f3708f4785957a7856dc9bd991c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598324, "uuid": "1294f715-ae22-4328-9bde-e94bee19b161", "comment": "Malware payload", "value": "238938a735d49263fa104db44584978eb478d6fee9617881c60762f621715325", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598324, "uuid": "0015b894-d87c-4643-84c2-b57cc2b89bf8", "comment": "Malware payload", "value": "d5687aebef68c95a92b00096f425a7e75e5257f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598324, "uuid": "856ac843-63ef-4119-a6ca-fc824b378f56", "comment": "Malware payload", "value": "286f03bfbcdbcbcdea59d7a88434c2d4338b71cfff590ddb0767befc78063cc347ca2ef8c4659e181fdc4cf4d580b3a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598324, "uuid": "eda181e3-8003-4ce9-95ce-b812fb196313", "value": "T1EEC27C956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598324, "uuid": "5e8848e7-4a0d-4afe-a984-d24c4f4eed45", "value": "768:u8vCB+25j6es8RXz9FYpMSUpi+20qUpi+20YQX:u8l25Jld2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784598324, "uuid": "530bb680-a074-4311-b2cc-f1f820d6c053", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784598324, "uuid": "d9562beb-ef0d-49ff-a0e2-ce8d8d3ba476", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598324, "uuid": "804bc2d6-d7c2-447d-a62f-d9b45661770a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fa4e72-84f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784631131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631131, "uuid": "d7341c63-535d-40da-a8b4-df6eb54407bf", "comment": "Malware payload (Efimer)", "value": "d0e235665ee126f510df32a174753e91", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631131, "uuid": "302fff9d-c23e-4da5-b112-2af2079db487", "comment": "Malware payload (Efimer)", "value": "23dfafd4337c63ace81f90323ced61ed1132ee9b4bc977efa664ae08892e6c45", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631131, "uuid": "302445ad-c4d7-4c0c-9748-14a908928d03", "comment": "Malware payload (Efimer)", "value": "7f0c7ccce2e561162cf25398f9a6aa2b7e7b3d5c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631131, "uuid": "3a2084d8-4776-425e-ac66-ef0c57854a50", "comment": "Malware payload (Efimer)", "value": "bcfc741a91ac776d200be1a3b36181b53d5abc22540e9377ddcad16629b2879737cc4476a50fa06f636fcc347ec2af19", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631131, "uuid": "489d7156-0322-42d0-9b5b-071d8104fa94", "value": "T1E2E633085AE406EFEAB3413CBD929656D4BAB0352FB3C5DF5BB48B111D632A08D35723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631131, "uuid": "ec2443ee-d4eb-4ffc-bb7a-c7b365959fa2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631131, "uuid": "2cab3d86-104d-4cd1-9b7c-686fdfa39325", "value": "393216:3jM23vNBGeqH0iwXMCHWUjX8cuI3/PGTAI:3jhv+YZXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784631131, "uuid": "b37ed9f7-f3de-4aca-9fed-ae6d3f27ce47", "value": 14308553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784631131, "uuid": "47e8c7cc-5151-4578-a774-ef197b15c88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631131, "uuid": "487c7717-3530-45ee-a380-f27f990a7ceb", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfe2965-854f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784671000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671000, "uuid": "8b2bc001-01af-412f-884b-96d7beacc7c4", "comment": "Malware payload", "value": "4298f1dd49ab388a5e94e931abcca293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671000, "uuid": "6f0c3fb3-d7dc-4d20-8240-cd42323c1620", "comment": "Malware payload", "value": "243a16f7868aaac29db90690c5315a94e850b5e150dddc72814a2c064155324d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671000, "uuid": "660ece93-de78-4baf-89c4-12c2a8cdc6bc", "comment": "Malware payload", "value": "24542922b0144eb22bdadf4c8c15a31761b1fd45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671000, "uuid": "4319f853-2a1b-474e-b576-b7afe502baa9", "comment": "Malware payload", "value": "c10af0e42c5e3ca7c62a63a9d8e8c058128abc3d4ee3d256f85756b5a6d86e1649450b1d9d6857ef8f0e5a68d4a5a0c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671000, "uuid": "46ee8a27-18a4-4e46-820f-0abdcf583375", "value": "T1CF631979B9819F1AC1C51677FF2D4388331723B8E3EA7113EA156F6137CB82A0E2A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671000, "uuid": "4a00ecb4-f03c-4607-9eef-a4c25d6c658e", "value": "1536:efDOLmOmLuw1vAyKsYFMNPSbAb1SOE/S77cWGMZcu1FS1UvnwayF:efDOLmXuIIoJNu+1SL/Svc1e51FS1Uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784671000, "uuid": "7e0e0e66-bd3d-47e9-b2a9-d80bed7033d5", "value": 71104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784671000, "uuid": "ffaad156-eeae-4b19-95fe-155267d70335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671000, "uuid": "bcc005ee-b083-4d7c-95ab-a2bab534f118", "value": "23N", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e76094-84cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614540, "uuid": "81759299-4876-47bf-b843-009abf6b283c", "comment": "Malware payload (Mirai)", "value": "35c08050ec19f21f50c8769e845cda40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614540, "uuid": "d3729381-7d7b-41da-93ae-4eed990f4290", "comment": "Malware payload (Mirai)", "value": "2454883c623ef51854d9f5d85e45050cc2330f826ddf34bcdf09d2f3f8f9c7db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614540, "uuid": "d39e598d-6175-47b7-8cf9-841cb99d84e2", "comment": "Malware payload (Mirai)", "value": "a92baf3b2a196becbddeffeeb22d3ebaa83db038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614540, "uuid": "e9dbba09-db56-42fe-ad2d-2e98a2f2eb63", "comment": "Malware payload (Mirai)", "value": "9e97b81d3677af9a711fc9ffe1a6b626684151c5b4fb2df09336925a666002684dd839dcde7b70fc442988d547cb3645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614540, "uuid": "0810572f-924f-4526-9e29-ada274986209", "value": "T177142A86FB81AB11C5C3167AFE0F014933135BE8E3DA76229D245B353BDB52B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614540, "uuid": "b805623d-a548-4c18-ad0f-9da8e2d11edd", "value": "3072:V8P/cFM6EODPFfS3l8iGC33wo0WCaeWo/y+5E1oNnFuyiBYVnQi:VO/kRPFfS3l8+3gwCaeWo/yqEeFLihi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614540, "uuid": "89711e06-c3b2-445f-a1de-948fa23f7f03", "value": 202224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614540, "uuid": "3cfea2da-0cf6-43f9-8743-61a601b664b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614540, "uuid": "185f1d19-956f-4bcf-8f11-a63978958857", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0889e118-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784613009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613009, "uuid": "a02740c8-573a-4293-af98-c28d01ae74d7", "comment": "Malware payload (PhantomStealer)", "value": "74752f49b54e728e9d15482c7322bd1a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613009, "uuid": "ea4f8cef-c5fc-4d26-b6ed-206a1d6045e7", "comment": "Malware payload (PhantomStealer)", "value": "2537b238f77b4e37ec5faf600d850c630b03ea7d640cf7503a4d89f7ae454bba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613009, "uuid": "835a8a34-f5ea-48fe-adb4-559a7c164463", "comment": "Malware payload (PhantomStealer)", "value": "28d8219bdc1c8ce5cd781c05820769553b1e9d5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613009, "uuid": "38c4270b-f6ad-44f1-af08-b38c762b2581", "comment": "Malware payload (PhantomStealer)", "value": "5ec67952c3008ecf90fadde641ee68591d2a4f2592d6b11919cceeb6c5e06a5eddb02c080ef023f3e159fdd94416d3c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613009, "uuid": "0e195c66-5385-4aa1-b6c2-863abd186cd2", "value": "T1A3A57BE413AE22B10209DC46CC6C1892F840DE47FDBF9B653D9B41E4927A74EF2B6875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613009, "uuid": "03b79c51-404d-4fa4-9a6c-3f7350936d6e", "value": "384:uuTgp2k13yRuhRYtHgRyoyyrEHyuyYX7ldufc4GWNSw3w:82fLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613009, "uuid": "9765964b-263c-4a2f-b5ed-0b6bea2f225e", "value": 2259815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613009, "uuid": "499d132d-899c-40b4-8ef9-41cec67f2fd9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613009, "uuid": "28ab6e88-35bc-4340-838a-8a6d6cbbe9c0", "value": "MTO RFP-000000186592-MNF26010 (TA 2026).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac036bd0-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613713, "uuid": "fd6bdf03-c524-4169-a495-61522ea519e2", "comment": "Malware payload (Mirai)", "value": "4044311b308ec68caa352f0d338f8298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613713, "uuid": "3a210cb2-0465-4ae2-b264-c5aabbb3fe66", "comment": "Malware payload (Mirai)", "value": "26570ef2071d23c7f231cbbb1085aabca9a935d6413f6aa6b6fa0872aa05571f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613713, "uuid": "d3cb9a73-a058-4796-9b98-4fbc3a5c270a", "comment": "Malware payload (Mirai)", "value": "b63e21766f0e76e0f15f933224c86e81aa773e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613713, "uuid": "5f2b88c7-7783-4b3f-8857-5105c738cc74", "comment": "Malware payload (Mirai)", "value": "8f261b6f7666068d4dffd5d6cd5ae68e91a8d69029f84635fc675ecece8c493e6451d1a86618167045fc7a57cea4bcd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613713, "uuid": "1094a6a9-00ef-44df-8e1f-11a6818feeb2", "value": "T14B24A40A6F919EB7C86FDD3706F58A0124CCB46731643B7A3274EA5CBA1A54B09D3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613713, "uuid": "9883d610-552d-4c51-a5d5-a517d2c24e80", "value": "1536:hiABCKVXKaqVd4QYvAAdlBVD43iYKzZ9oZ586lOCZUippsgieeOJ01ad/AkVhv9M:4AhV6ayrYvv9oZiDCHIc01aKkXv94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613713, "uuid": "7849bd3a-1001-4fe2-9cc0-57ba0fc492d5", "value": 218472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613713, "uuid": "2c893b87-7948-4563-b187-6f5b5b92bdb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613713, "uuid": "05166dc4-2877-4bed-b6f5-186d626f7ee1", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2217bf9d-851c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784649130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784649130, "uuid": "c5c5d38f-f34f-4518-8ca3-9a2573386817", "comment": "Malware payload (Efimer)", "value": "a244b80f281995a03d8d5bba092a436d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784649130, "uuid": "879aa3ae-8aec-49c8-84cd-3a3e28178ec2", "comment": "Malware payload (Efimer)", "value": "26861b70a4608bdbf702598ea84a4f09103df8304e943117440b75e1e51803bd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784649130, "uuid": "28484b74-1641-49dc-aa1f-0bb768301ba7", "comment": "Malware payload (Efimer)", "value": "10bc5411eb9a5a755daef24b6ad466faa4f37a72", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784649130, "uuid": "c2677eb4-e6b7-493e-b502-bf369fa0868c", "comment": "Malware payload (Efimer)", "value": "fd5d65a610d56733bf81e896239a977badf3bba03ea9f2acafc9cda0426761940aeafd22ee1e1adf49c5386784b0e05d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784649130, "uuid": "dcddd1a7-d575-4d1a-9f19-6e4fd33ec541", "value": "T1E0E6334855D002BDEBF3563EEEE35295E1A074364771CEDF878886A8DE5B2E08D3C606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784649130, "uuid": "4cda902d-a3f9-4e1e-ade5-dc4bcc3cae12", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784649130, "uuid": "6a6b0bfa-069b-4737-a51a-8ab295d2fc96", "value": "393216:SNfS7bh4VAQpgzRUzvfRC8XMCHWUjXhcuI3/PGTAI:S2quQp0WzA8XMb8X2H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784649130, "uuid": "b15fe5dc-626c-4736-9e52-b2c6d003cc7b", "value": 14318185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784649130, "uuid": "e9ffd66f-eecd-42fc-a79b-116f174adeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784649130, "uuid": "b759e21f-887a-4a0f-996e-c7767483fe0e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8705be6-84a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784598728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598728, "uuid": "fe1de5f6-d499-44c4-b91d-0a335e867acc", "comment": "Malware payload (Efimer)", "value": "9d9debe827b125fa52e76692b0d6d25a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598728, "uuid": "48e07a80-46cc-49da-935a-877508ae13b0", "comment": "Malware payload (Efimer)", "value": "26dfbed73c43b51a8b0b2136e35f78bd987aff9fd163c5c7abaeca4ce639ae17", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598728, "uuid": "62654d06-6c4b-4f8a-8328-27f72ab3311d", "comment": "Malware payload (Efimer)", "value": "60e2f3ee0d06652eacfc71d1c36f503d68b28988", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598728, "uuid": "186d213e-c4d3-400e-8567-b530b2e64d6e", "comment": "Malware payload (Efimer)", "value": "942aa6fae9abbc742e595e4d5c15c51f300883976cdc3d759e0c397222257c9d859e7dc7ab956eeb294aabf2e7a56105", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598728, "uuid": "cc8ed3e9-5702-4b45-bbf4-473d9f89e0e9", "value": "T152E6331866F812BDDAB3513DEBB19561D0E7B03A0762CC8B5B9893B16D132E04D3E793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598728, "uuid": "46e52afc-f6fc-44c1-9e7e-70a4908fc7e8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598728, "uuid": "ee0dd7dd-29c9-4278-97b3-d69ba47347c1", "value": "393216:eBOvQTtRbwgL+1XPYWwC3y6bXMCHWUjXNcuI3/PGTAI:eB9BFwm+1fUCxbXMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784598728, "uuid": "73a82223-b694-4fed-b72a-a68ba7fc4070", "value": 14302142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784598728, "uuid": "6a3b4024-98f0-4158-89f0-764fd2735e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598728, "uuid": "7ceb92e3-9301-4b9c-a8b6-5a805817207b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98de030e-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611104, "uuid": "395adde8-3113-4d2f-aa61-83bc16a7df24", "comment": "Malware payload (Mirai)", "value": "b1c3686ce935d7cf4677e941da780319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611104, "uuid": "fec31c27-d2ed-42ec-806d-65be4541abaf", "comment": "Malware payload (Mirai)", "value": "283104d47f651eb64b7e95a40318337b7efa6db1c6651e189941483e7b13c745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611104, "uuid": "fb43ce64-195e-43be-8667-69b6de6217d2", "comment": "Malware payload (Mirai)", "value": "f7662bfb3aab0ec315d89e90c694731631a22bea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611104, "uuid": "5b5791f4-1c46-44ea-930b-5a3f877b2326", "comment": "Malware payload (Mirai)", "value": "979990df9adf31d8ed7af3a36cc39e51a482e3584f4cdb0936e79969deaf1a7f1f97c034f2d4928c5f7f4ef6831a2093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611104, "uuid": "ec46343b-b2de-4268-a6a1-833acd2f6776", "value": "T1DF430210D1E98A03E2E618B364D3C243D1C527B596ACD1171B5DC9D03B4F6E2A7FA9CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611104, "uuid": "34a12c19-4b6f-4567-b80c-940748c5975c", "value": "768:D+v0su7bG0n/WPcjDvIU00FquFd/2tHtYiDF1eOhzLCrC017COO2w7G/UXirq3U1:D+DH1cnvBowYv31eELoCLOOJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611104, "uuid": "28d4f260-3fd1-4c2a-afab-845248173fbf", "value": 55588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611104, "uuid": "b7dc24ac-dd96-4f4c-bb02-f6b33d817dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611104, "uuid": "9db84462-29eb-498f-9c1d-1529374987ec", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41db9fd1-84e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784626849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626849, "uuid": "1982b5bb-017a-4f81-ae16-8d96fec45c07", "comment": "Malware payload (AgentTesla)", "value": "768d36e15c427624087a955317909c2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626849, "uuid": "38daa233-82b6-4f3d-a178-3f6cf5483a1f", "comment": "Malware payload (AgentTesla)", "value": "28f592105342cd4f8719a41a355e859428c5e0844a4843ef71d8307c068034d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626849, "uuid": "7c8a2487-9595-43e2-aabe-a0dd12816eb3", "comment": "Malware payload (AgentTesla)", "value": "afd80cc8f1acb8589d5385d1800b783deb1f460b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626849, "uuid": "ad4ead2c-a515-4620-af31-a3e630d83c7f", "comment": "Malware payload (AgentTesla)", "value": "908dfeb840feb278f8ea6b9ae861edc83dccfef97d799e365b294d2ec914acf790c6dd6ab6b6d57c08fc0277a31147f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626849, "uuid": "65883163-5f8d-4800-95f9-53c284451f14", "value": "T16EA51250615FE3ACB8F6B7E70C69CDB428EBE09E09261AEE704CB7C951954C18803CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626849, "uuid": "2dfe232d-9391-4bb0-b981-6cc5e51bc7a0", "value": "768:BJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOJOZ:UOlClIxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784626849, "uuid": "b212ff91-d6a9-4aba-9f8e-980a3e05351e", "value": 2257581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784626849, "uuid": "e55bda86-0870-4c71-8a13-614e43f7c338", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626849, "uuid": "baae3eff-bad6-454b-b665-6241d6ad5c7c", "value": "Richiesta d'ordine PNCG-0027392026.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d02c8e9-84c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784612399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612399, "uuid": "415c4fac-7ad2-4c79-98be-184b1cabbef2", "comment": "Malware payload (Mirai)", "value": "3ca76315709f0e977081115f8fe9bacd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612399, "uuid": "7f9de29d-a632-488f-85f1-2a2518d0b944", "comment": "Malware payload (Mirai)", "value": "291d03172e06e9e95e794bb65db38e68c1c18489b03e6d5b00457350c13199e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612399, "uuid": "39077fe7-7c1d-4f11-b092-b269a689626a", "comment": "Malware payload (Mirai)", "value": "ebf6854451fdbb4d3dba0ccf3f35c8ff6d1fa085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612399, "uuid": "d6470c84-931f-409a-b59c-e4c10ccc261d", "comment": "Malware payload (Mirai)", "value": "724e3007eb65b25bbd7dddf2c1f349fe3cd7d6a1be4356c0739bf5ce8b3bd135254ee7b644b5bc74403d59a06a4f339c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612399, "uuid": "8c3f0fd6-330e-4e5b-a920-c7d463415160", "value": "T17513E1FB025ED6F9D82794B014194791E8A53C0DFD628BAF056853EE09FE5902F22BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612399, "uuid": "cba7c1d1-c28a-4ffd-a61f-370620e2f0a2", "value": "768:b7yky/ynPdrHnU6WeUXiIArbgrS6pW9n2dPJJI/O79hxtls1YBx05W:bGkPPdzpWeUorbgHs2+GpA1wAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612399, "uuid": "46c7ca3d-273e-47f8-9338-bf7937c8c884", "value": 41996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612399, "uuid": "599ac34c-2a4e-499a-a6aa-1f0948affd82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612399, "uuid": "97a96751-d973-4d69-8ef4-3f0b197ffbe3", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098ee558-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784613440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613440, "uuid": "53884da9-26b8-47df-a23c-a536b815ff95", "comment": "Malware payload (RemcosRAT)", "value": "d801b39bc1155dfcf90b108ca3c97cb1", "object_relation": "md5", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613440, "uuid": "655413cd-8f0b-497a-9a34-c58c163e1992", "comment": "Malware payload (RemcosRAT)", "value": "2995f8d205e7c47a66f109365a23b4f1b534cd8f5fa224b838287f25c22ca692", "object_relation": "sha256", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613440, "uuid": "10c96b8a-f4a0-4033-9d32-87284b72420e", "comment": "Malware payload (RemcosRAT)", "value": "35bfcb77aa4e59a73701ff59ba3f59610ec55b89", "object_relation": "sha1", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613440, "uuid": "43d4b079-1d7b-4608-b630-4e9e38c005a2", "comment": "Malware payload (RemcosRAT)", "value": "0f12fabc2cdc67ff76e1bcdb9061d52a9936cc85e14e0013ad4c559781ce53f7aece2b60f4522d53cc846c0a4548f34e", "object_relation": "sha3-384", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613440, "uuid": "0dfc2611-9fef-4f66-85ff-872a02e60a09", "value": "T197415312215BC50E5AE74064F9968F45E91C92679400A040B1EE5DF88FF4AFCF2FCBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613440, "uuid": "0e47561c-5be8-4ba0-b618-a1a629540b5d", "value": "48:SUiPgn5hHoc19pt1dkYZhJXM3Rffj5VoSbCVoSR+Wf:8k9p1zvdkYZhJXMhTboR+Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613440, "uuid": "0608453c-69af-499c-ab9b-e52cfd2cf29a", "value": 1948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613440, "uuid": "7bf70949-35fc-40e3-bb55-27894961a1a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613440, "uuid": "efbad078-606d-4c38-8f97-c955c467461b", "value": "2995f8d205e7c47a66f109365a23b4f1b534cd8f5fa224b838287f25c22ca692.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d3a777-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615281, "uuid": "347719f8-bdcb-4853-b028-8867d43c18df", "comment": "Malware payload (PhantomStealer)", "value": "4605c0b216ee284bc683aa3cae99cf65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615281, "uuid": "1612b095-6720-41df-a221-9fb8df1ed1e3", "comment": "Malware payload (PhantomStealer)", "value": "2b07d9485d644e740ebcf55a5f2a9768b98cb97e3238977e16ed3c77a55ca2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615281, "uuid": "3909a9f1-055d-4bd6-99f2-b64b1bf7ec02", "comment": "Malware payload (PhantomStealer)", "value": "9e922e8074f3f3193261ef55d75fa6e412cf28b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615281, "uuid": "55be8f2f-a78f-47c0-b95b-1ae0add9fa34", "comment": "Malware payload (PhantomStealer)", "value": "e60647554f278a1e0a47f2758064fb3d3cf5def215616678231a937833e389554b095b3c88bce0eb1ef66902d5ca00f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615281, "uuid": "25bb0f4c-c115-4658-8b5c-1a5410c18550", "value": "T1BB8407A433F44615F2FF6F75E8B045118A32F88BEA39D75E0AC8449E0E71B50AE50B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615281, "uuid": "440aa2fb-9f1e-4187-84b6-649b6065d4d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615281, "uuid": "6eb843bd-633e-45c7-993f-dd2bbd1fd346", "value": "6144:IP4yOcYaCgSXJPudvCSlmcZAabGZgvkwUzzAdPz:IP4yOc3CgSJudvZ+Akz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615281, "uuid": "342110b2-fc80-44fd-af32-3991983b6ce0", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615281, "uuid": "3a7ddcc6-c086-4fbc-8446-5fdce572c5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615281, "uuid": "cf729ebf-0448-418e-92c1-daa0f039fc88", "value": "2b07d9485d644e740ebcf55a5f2a9768b98cb97e3238977e16ed3c77a55ca2ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7633c172-84e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784623931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623931, "uuid": "ffbdeb7d-43f2-4bd3-b382-7adecb7753d4", "comment": "Malware payload (Efimer)", "value": "c35e70ae5feff55b00d6c742c51a26b2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623931, "uuid": "fd390db7-7d86-4775-88a8-fc587beb8c4e", "comment": "Malware payload (Efimer)", "value": "2bb2cf7acec5f05edac84d7fd457b1fb249dbea432917706b6bb898cea2902e2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623931, "uuid": "57475f05-1d63-4214-a0e4-28fbe799f3ce", "comment": "Malware payload (Efimer)", "value": "a3f5fa332485a78bec666cc3af811eb3db075618", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623931, "uuid": "7ff1e8d2-8a12-4307-bc2e-209ad82df509", "comment": "Malware payload (Efimer)", "value": "6cb14d0742c17294f5c0f8b9423d98e4819ea186d24930db548a055d9aab498f3d56acb4c8dd25a9ad98c5abc0d1d60a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623931, "uuid": "181d2599-3f0a-4907-b3a6-4bcd529c02e1", "value": "T1A8E6335829C111EEE9B6823DDE929292E855B0660771C9EF4B5C83E2BF770D0C93C35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623931, "uuid": "29634696-1ee6-4301-9bc8-c16b90f26301", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623931, "uuid": "3999cfc8-1f37-4233-b935-5fca9d3b8103", "value": "393216:4CBnuxzX4CsZNNscQ8XWQxXXMCHWUjXwcuI3/PGTAI:46ezjOlXXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784623931, "uuid": "bab8f158-858a-4119-bad1-e2edab403a4c", "value": 14287920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784623931, "uuid": "dba56f31-dcfe-49ea-ba27-26c1ba9e107e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623931, "uuid": "a726ea72-5f7c-46ec-bf57-5fbad434f048", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c57bc1c-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784613177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613177, "uuid": "6c669778-b400-4b6e-a910-12660edc142a", "comment": "Malware payload (PhantomStealer)", "value": "a3acfb33bc369fa29fb5a191ee8ca09c", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613177, "uuid": "d7d2a073-0ce0-4310-9591-2b6daae7afc2", "comment": "Malware payload (PhantomStealer)", "value": "2cd6897845961d94d058970266728a7abb4d6fdaff48bb295acdb912dfac9f89", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613177, "uuid": "2ba19d84-2358-4c31-814b-8165a0fe5e36", "comment": "Malware payload (PhantomStealer)", "value": "399827923edfd980fc24e9c8590d4c76b2e65e95", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613177, "uuid": "9057b726-d5d7-4c22-8a41-d141d53ab7d8", "comment": "Malware payload (PhantomStealer)", "value": "93291ed564aba45e4a5e902aa38c11587662b40b9c024f0ad57f9bda4f23c0f7df9cbed6141bc6d069b8ed52fbf9aa2f", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613177, "uuid": "ea1449fe-4d00-4ea9-b008-e3dc875e4819", "value": "T1D562443AE69CEFF40B2E11D1018B7D021059A7A6B53D8DBDD4C5C1987F2A7108FA68E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613177, "uuid": "2632254e-d262-4ff1-bc0b-bf051c35ba5f", "value": "192:kyZgD/glv5IDH5XNS6IydK/H5Ee3PrhY3P5d4P+CX1VMPuyk:u8bIDH59RIydYH5p3DhIxiFV+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613177, "uuid": "15dfa4a0-b8a9-41ec-b173-43dc1ee45ff4", "value": 15772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613177, "uuid": "f9dcb323-2e2b-4dce-ad9b-ab8a2df4a853", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613177, "uuid": "2715931d-9d92-49c2-ab2b-ab722a214fb6", "value": "852000031.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa21fdc8-84b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784606408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784606408, "uuid": "c6be464d-4210-4832-bf56-feb41fbfa011", "comment": "Malware payload (njrat)", "value": "3781c80eccec6712c70d7d372f591a88", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784606408, "uuid": "12874c23-df88-4385-ad01-f75f5bf0b89e", "comment": "Malware payload (njrat)", "value": "2ce0f4fbd73b47f51a96c5cc02d44329d9414e346dbdf5dbd69f3ffb1599abd8", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784606408, "uuid": "baf7e706-e533-4c5e-8e34-735736df7655", "comment": "Malware payload (njrat)", "value": "98105abf04b0e76352962ec57e82ab48d28d7574", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784606408, "uuid": "4f6e6b66-2a84-4cde-a266-b2eeeeb84a36", "comment": "Malware payload (njrat)", "value": "7a80eab993b6c645341ad0f9567cf26dad6105d2259ab2ef4c26eeed638f4647ea86da19b0790cca1879b0e4bbef001a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784606408, "uuid": "0ef0802d-406c-4461-97e1-a5abda8cd9f2", "value": "T1E04574C50719F439EF7815B2747F270B17248BD9F3A669867F27DA00B108D212F92A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784606408, "uuid": "8e019a9c-550c-40eb-b53a-d2daa97be729", "value": "192:WkVkTu17j0oOBR8rtzpHagkdDbDohN0o8:WkiTu17jQBKrVpHahdgNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784606408, "uuid": "bee5ca62-c743-4322-a235-e5ae59cbac39", "value": 1215623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784606408, "uuid": "a7e3db9a-dcf4-4713-906c-c2c46de6cb88", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784606408, "uuid": "41d71fe7-896b-427d-a7a6-06437a6afd43", "value": "z1PURCHASEORDER-51720_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534f62e5-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784615282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615282, "uuid": "ef81f053-544a-4957-8c62-e81e830ebee8", "comment": "Malware payload (Mirai)", "value": "86264efb9f10f2ea52f19826e05bb2be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615282, "uuid": "1f21c1cc-fd08-45af-b7fe-41caed1c8c4d", "comment": "Malware payload (Mirai)", "value": "2d1e9c6afa3bcb327bdb9edaca055723e8b1f61f62d3f013d94c304aad396204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615282, "uuid": "b886ff1f-7c39-4913-a0a1-2b0b58c7e221", "comment": "Malware payload (Mirai)", "value": "ca3cafe8b879d616b2774fbf0405dda664b04bc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615282, "uuid": "7ae7cfd9-72b2-4532-a2ee-607d7c842f37", "comment": "Malware payload (Mirai)", "value": "6c7b2928d6650705e06b43a14a2908d9482103f4c5635d1da54852b989d37624f2063e2d6fb2ea9f840fe733950752dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615282, "uuid": "c1794e87-a1b7-4224-8f79-299a5a7949c1", "value": "T14E03F189C3F68E05D039517792FF35849600C81EB5B8D6E38DE8E44BA78EF4C2604B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615282, "uuid": "b93ede6d-b53a-4047-acbe-05e31f999123", "value": "768:qI6I+nUX57peFrXKnNoyBn7pkbrAaTPe1Sw0gsKqcpgE2n8pOt30xu+0nbcuyD78:59MUJ7pSjuQDy0gVnmbIiHnouy8Hy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615282, "uuid": "621be185-cf08-4d85-a769-33bed2469fe0", "value": 41312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615282, "uuid": "751b3c86-5b8c-46cc-9971-a4118bcf6934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615282, "uuid": "f38e71a4-c771-46af-b6f3-4c0ba4aff503", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714ae0bc-84c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611467, "uuid": "4dddd0b4-1d6f-4438-8885-91c343224d4f", "comment": "Malware payload (Mirai)", "value": "d5a6ccfabe47562746d6587a586c68ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611467, "uuid": "f79ed90e-cf7d-4fe2-b110-7b319f0fb623", "comment": "Malware payload (Mirai)", "value": "2d2446de86d08753e80b1ef973e803e88d4f314bcc053a82559950520da3ec8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611467, "uuid": "8eac48ed-2373-4867-888f-650c09013de2", "comment": "Malware payload (Mirai)", "value": "b377ada62ec5eaca8fb24f6398d677d5119d98af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611467, "uuid": "3a6a8e5c-641d-4000-8bdf-75b7dbced8d0", "comment": "Malware payload (Mirai)", "value": "a652ec87abd745a8f3cfb1c514b32085ea3bc6765dd3e5a1f5b81a29a9ffaf7515893d3b2cd66faff707db4fdaa48601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611467, "uuid": "5e012de4-97c6-4c54-8377-9126c245893f", "value": "T16FE30806771D0E03D1633DF0373B2BE1839BEE5229B5A680742EFEC95272DB22545E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611467, "uuid": "d88787ba-a204-4198-98e4-1ae070703b28", "value": "1536:A/DBHDz1e6lPr49bHxhvx6U72s418WT7M4bjTXAVTZ3MEvA/GXLMKC0WmA/Qqb2L:A/DZP1S9VhvxriJTo4bjTQVSZO5Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611467, "uuid": "c0684b51-0692-4436-9afb-e835bba12251", "value": 147124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611467, "uuid": "72e57005-0f4b-4d68-9593-042e0d15dfd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611467, "uuid": "fa5483a4-a8ba-4c2e-8aec-c1cbf2a39c7a", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f52aedc-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784672721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672721, "uuid": "01e67248-97a7-49f6-8dcc-a12e8c418119", "comment": "Malware payload (ValleyRAT)", "value": "de7490e3bc31ad29ece7a3e275588d18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672721, "uuid": "f922f534-e2e4-44e0-b715-6ea8ede4e280", "comment": "Malware payload (ValleyRAT)", "value": "310fcb28fd0a6616bea7db2a16414117507e449e0d7c27bf5fb1651b0e13ba7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672721, "uuid": "a42b2232-a7b2-4d79-86d3-6ddcad644e64", "comment": "Malware payload (ValleyRAT)", "value": "31ec4759a1e9fa2714eab2772a607fe36356fb7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672721, "uuid": "32d49434-7b46-4a21-b743-6d95add4fc26", "comment": "Malware payload (ValleyRAT)", "value": "6992f7dbbdb269f7f028f426a9003e5bf6b9756a8f8544f2f65d6d9bd33a06642470381018e3291900f349babd1dd49f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672721, "uuid": "2f1aebf1-df41-48bc-b3f0-70c052cb4f4f", "value": "T15C348C15B7A50CBAEDB78539C9530906DA737C4247A0EADF03900AA6DF2F7E0963E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672721, "uuid": "8bbaf01b-5f5f-4852-967e-662c182c41db", "value": "8e2d33ccc73ed51abd14b6951ffbefa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672721, "uuid": "ff340e3e-34e3-41c3-925f-a14845cdf775", "value": "3072:IjLFXq1GEfQw1ZWafRk0r+Ki/qs/ZFVIK5TTdp5nAzCgTXgKTgtuRghqSt:nfQw1ZWaJkp5i0nDTygogqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672721, "uuid": "42ddc6ab-ec6e-47d1-a85c-4007dd099ee5", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672721, "uuid": "505eedd8-57e7-4994-95b5-2d624c1c0007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672721, "uuid": "fafb6154-b9d4-4f9a-81ea-f19fed316aa3", "value": "310fcb28fd0a6616bea7db2a16414117507e449e0d7c2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a1ba93-84df-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784623280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623280, "uuid": "206ce588-5e46-4cbb-896c-07b7ad92e7b1", "comment": "Malware payload (OverlordRAT)", "value": "4a2a776bed68a7ac1fa2b07a8f6cd7ae", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623280, "uuid": "253141ef-5487-4fed-8669-aae3b3c38fdd", "comment": "Malware payload (OverlordRAT)", "value": "3148ffe9917d2aa33cf61f1f2858ae35d659fedcdc15a2dead0cb6e4792579cd", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623280, "uuid": "625359c1-1c45-43d4-8427-933a442190e0", "comment": "Malware payload (OverlordRAT)", "value": "fba32ab156d80533bd5941690df956492c40af8e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623280, "uuid": "19106859-90bc-4bae-9701-a69bcff0e24a", "comment": "Malware payload (OverlordRAT)", "value": "a2971f434de0213b2474c07e3e76762f36985f825b73e225115710a73a5e33c8ff254ef19dd08853f32acc30be92f7e9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623280, "uuid": "284ff8d1-4748-4e8e-8d9a-2d17ee9b6041", "value": "T12CC63328DAFE8E26EDF197710C66C23207B19D8F9250E3085AE8DDC3BD2D5B59645233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623280, "uuid": "ba28a34a-720f-4d03-a443-db32935461a4", "value": "196608:a7Aj+6Y+1fsKPuMMU7U7gHttex1UDOxlgQt6ZqXJTKQ8ayNH7oXiR6KpE+:d+12jRbteD2Oxl6ZqXNKPayNoQ66E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784623280, "uuid": "8e0979e0-2fae-4c6f-9e54-c269de50c771", "value": 12049408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784623280, "uuid": "97b7639c-3619-4406-b15b-23b044a7b00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623280, "uuid": "e257179f-e311-4cdb-9648-6b42d48f6bd4", "value": "FLStudio2025 Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd22579a-8543-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784666248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666248, "uuid": "b107ced8-b433-4a3f-aa4a-fe8f89d9fcd1", "comment": "Malware payload (Mirai)", "value": "821bedb0285cb46dea19d5c05c2b72c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666248, "uuid": "ffdabf8a-12a4-47bf-8d79-6afb2d3f82f8", "comment": "Malware payload (Mirai)", "value": "34dcd1d45a2d5021378d51deb542b6220cb203dd6711b369eeb4035c50f57016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666248, "uuid": "391dab2f-54a9-431c-ba0c-8dd43430c729", "comment": "Malware payload (Mirai)", "value": "36f30711d80e588b6d6fee2e8a67d31993cc4c4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666248, "uuid": "020e344b-4653-4583-a1c3-c2ff1f92a01b", "comment": "Malware payload (Mirai)", "value": "051a4ac17f129770ef130548443fb665e4ed9de62b0cb8c21e4563568b7aef289ea96eec8bf39287f8753bc9b985ca18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666248, "uuid": "a32d58f4-773d-4c7c-bf3a-bd73ee27a157", "value": "T17583196AB9419F05D4D526BAFF1E438933535BBCE3EE7112DE142F2527CA92B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666248, "uuid": "2235ca70-cebf-4f72-8f68-ebb5977b411c", "value": "1536:ZjnrtCAXuYuhkc5PynmMXeIhDIzLOPPbN/BsbpBuxZllKsiwlcrvOkbC0zS:FtCQWkSY7dwOPPbN/BsbpM8ilcygD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784666248, "uuid": "4b09a25f-a593-4f9a-8429-74ca7569c2c4", "value": 82488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784666248, "uuid": "8a636f03-1e7a-4578-af54-f89e12ad1d2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666248, "uuid": "7b219705-402c-4d93-8e11-824619dad40c", "value": "b7g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b800bf1d-84e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784627047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627047, "uuid": "df316f58-8afe-451d-bd93-15a98dea1b2c", "comment": "Malware payload (AsyncRAT)", "value": "83d9bf538d7809c98f331d469b48e083", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627047, "uuid": "129da88c-07d3-442c-99b5-de741bc2dc4b", "comment": "Malware payload (AsyncRAT)", "value": "3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627047, "uuid": "61601424-9081-4809-ae0e-2d4a26a58eb3", "comment": "Malware payload (AsyncRAT)", "value": "e22c05e7ec4147eddeab8abd5ac5a10d6e3efae9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627047, "uuid": "357253f3-30d0-41ae-aabf-2afd668032b2", "comment": "Malware payload (AsyncRAT)", "value": "2ca4de082a9e44077fec2f22df437fbaa72239eb82855b324b701dcdfe1555f51a5f211014c014f22ed5ec77d7ae9b38", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627047, "uuid": "78d0bb22-df49-43d4-ab92-b8c371ec65b6", "value": "T137614CEA743BE608E9551BB2416FE490B6853CB93DB57A79F4BB03028D7C454082F1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627047, "uuid": "dd640851-bcf4-44e6-8352-66679bda330a", "value": "48:Gzjb9HUQx3p1Djrg5CViZcqSKCCEhwT9AKgIsm5HfPVgg1RyG8juo+4Agj3Q:GzjJ0q574t6wJzXsm/PV9h8juo+4RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784627047, "uuid": "f84d38be-09e6-425c-83d6-07c6d3dfb3d4", "value": 3344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784627047, "uuid": "b55d0f59-8465-4975-840d-8b0fe4977f88", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627047, "uuid": "b02e28a5-8968-444b-8216-aef71f0997de", "value": "rar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e481a5-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784613159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613159, "uuid": "0c49da20-e00e-498b-9b93-07884e4d8619", "comment": "Malware payload (PureLogsStealer)", "value": "f1b774139010dc6ee790077d92bbb88c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613159, "uuid": "4950f10e-3e9a-4aca-b3a8-48f6194b96c3", "comment": "Malware payload (PureLogsStealer)", "value": "372d9cfbabe8c80e2b152739ea9ff7debe61b88360e3120c35832738400955df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613159, "uuid": "ce634006-6b1c-46e8-ba2f-c0e2c07231f7", "comment": "Malware payload (PureLogsStealer)", "value": "e3f0237a0f8738f2a13c119972001018a9f430e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613159, "uuid": "1344e449-23a3-4e59-8794-485e00f60c5b", "comment": "Malware payload (PureLogsStealer)", "value": "754f364b6c9d4412d838c07d3238097affb1287d3311c3469e8bd56a3f8be73123d3d09dc085d943754a645097ffeff2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613159, "uuid": "2b2fb7ba-6583-4188-bcc5-2c62b89b9e02", "value": "T17256A952A3F82248F2F34F58BD7A21658E7ABE166C38D12D11B4510E09F1A4DCD79BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613159, "uuid": "f8909c51-971a-40d1-8318-ef5c9986b9ab", "value": "6144:KOH2BIqXQvFQyiDTPiie59HWaRq9pIU3ts6wWs:KOHIIVvFQyi/Ze59HWaRq9pIU3tnwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613159, "uuid": "45feb5ee-2a9b-45d7-87ee-c7d588ad4357", "value": 6025038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613159, "uuid": "a0c74913-fd17-4154-af12-392d8cbbd7c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613159, "uuid": "e1e51172-49f7-4da4-893c-bc8e5373a0d6", "value": "Purchase Order Quote_Confirmation_November0026-2025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d906a4-84dc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784621809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621809, "uuid": "d2846486-6664-42ad-9a0f-260e6e17cc6c", "comment": "Malware payload", "value": "e6cb33b3a050c14d4eda1552a482c362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621809, "uuid": "09c0d72d-09d1-4ce9-aa6b-052f3785a41a", "comment": "Malware payload", "value": "37db8df2e4dc4767276ab5a7afc645a21c75d3e1b94d9ef25c69d99eacfe1729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621809, "uuid": "d2a4b53b-af85-475f-8712-4ab43989b0b9", "comment": "Malware payload", "value": "f8610a1c26081b549bcceb591fe0d35c5abd6b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621809, "uuid": "39d37d09-c686-48e2-a1a6-7fb2768cea86", "comment": "Malware payload", "value": "2b9efb2fa1905a81006a9dd78b8cd3186a0d9c30c92e1277c7b84263aebdd94bea80a844398538d42d30efa5268b783a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621809, "uuid": "9ca7a92f-b73b-4ac0-a120-99ee131fa4e9", "value": "T11583AC9A4E7EEF8CF691C7BBDF9DBF11B5E11CBA58789058D1AA184C402275C48EBC10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621809, "uuid": "606a0dc8-13f1-46aa-90e8-689f52a6da89", "value": "5d79c27709f823d77f8028442a671a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621809, "uuid": "6871ddba-c752-4aaa-a5b2-be749293debd", "value": "384:rEpnYWgtgYEQbWJyJeJ5ixJCJpXIJ4yJeJ4L+J7JaJe2yJIJpJlJEJ4yJvJaJ4yb:rMYf6WivWeT8fM8YLz/EznUMAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784621809, "uuid": "199a75bf-4a65-452d-bb30-15dd3e95d3b6", "value": 84580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784621809, "uuid": "84a623fe-60f0-43ab-a772-c288119d390c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621809, "uuid": "61a48ea7-2841-466e-bc59-376c0c3eca00", "value": "SecuriteInfo.com.Script.SNH-gen.19364466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ca9a32-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784615367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615367, "uuid": "329a56fa-2999-4107-8a2d-faa796a4899f", "comment": "Malware payload (Mirai)", "value": "c8d0980af7b426f2dc0a00026a42ce3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615367, "uuid": "6c900cb0-98fa-42aa-925a-a72b0e7ffb32", "comment": "Malware payload (Mirai)", "value": "38723d0aa32b06a25ec7dad992802a2cac4b06189888636c21350a94bad1de7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615367, "uuid": "ee2fb6e6-8144-4c5c-9ea4-76d192b4fac4", "comment": "Malware payload (Mirai)", "value": "ca78ce5e3ee574a332ae49f837065f1cec44c0b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615367, "uuid": "1a727e3b-2c11-415d-8458-f6e3499e3acc", "comment": "Malware payload (Mirai)", "value": "53c7d0aefc08270431069113220d174a83ab307de8470fa5629aa6d437755bfb4a73d770ca444bf3aa36111072d13204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615367, "uuid": "29b04b7d-15f0-497d-acea-ee4d7b88cbdd", "value": "T19E8329C1FA8BC0F1D91B89304067F63FDB31E9295061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615367, "uuid": "90fbcd8b-0c23-4517-b6d1-a38ecfe7494d", "value": "1536:LInlZzkj+0cO4xoPEw6HMAG5vpeIgWtyCKjfTsv4gz9F7E+:LIlySh9is7HMAYxTkCKjfTc4D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615367, "uuid": "fcb4f47c-32e1-4755-b583-fda06a410e19", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615367, "uuid": "9867f62e-270f-4a7d-bdac-1265941ecaeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615367, "uuid": "3e3496b9-b575-4369-8ca8-54f605a8b5f4", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bd8645-8507-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784640192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640192, "uuid": "f381779d-4343-4799-8371-a77244b5cca3", "comment": "Malware payload (AgentTesla)", "value": "ea0a35a42d684f14e584e8ea9c2dd4d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640192, "uuid": "8a120730-13d4-487f-a971-15230fd06d94", "comment": "Malware payload (AgentTesla)", "value": "3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640192, "uuid": "a9aa8d59-1b2d-4aef-ab27-29c915b4b5d9", "comment": "Malware payload (AgentTesla)", "value": "8d03201894a4357aa0b8d59c65cf6573b05eee1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640192, "uuid": "d2310cd4-e9fd-4bb4-a8ab-0a02dbe9fdc8", "comment": "Malware payload (AgentTesla)", "value": "9a32967a1c66ea61a85c5086a737203b8465f5023f21003464720959092cb93ed0678881bd467658b10b92e6917cabde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640192, "uuid": "21171037-c2e8-4f04-9870-8d468ff9caa5", "value": "T1475533E1174A34CFEB56DBA744D3F3C82662AEC82D1363C164E5FA994D1C9B588C7D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640192, "uuid": "6710df57-c3d4-4a45-8191-817d56a0b778", "value": "24576:a0l36DTiHoHZUrAu98lTiZa6j9IGzYwxTnVfAzwd9DKWfhuKP0SFQV:fcikyAuITiZaWqQYwx7VTzewPrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784640192, "uuid": "a41979e6-f62d-4f08-b69c-a098c0ee0373", "value": 1308684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784640192, "uuid": "c6b40f53-05d0-4e03-9fed-9ba01b82aef1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640192, "uuid": "35bf6a60-75dc-437a-806a-5c073ce9cdc3", "value": "INVOICE AND PL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254aef6b-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784614775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614775, "uuid": "e98d15f2-38fa-4dc7-82e1-9e6fd57edd8e", "comment": "Malware payload (Gafgyt)", "value": "b737b4f51bd6ae83f2c7ba34f963b9e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614775, "uuid": "99a02e61-f5ee-4011-83a4-7e26fef5299f", "comment": "Malware payload (Gafgyt)", "value": "3c276ecb15adeeb26adc07a10de271d18c40e5ef6835c60c36a129dfa081b3e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614775, "uuid": "f02c37be-fda5-4297-a3fc-b69cb0a4c9fd", "comment": "Malware payload (Gafgyt)", "value": "91e3c0bc5e0c86e8bbf7302c5e1f6b13df3b5c27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614775, "uuid": "548ab952-ce84-415e-9233-f6bcc9e5af97", "comment": "Malware payload (Gafgyt)", "value": "442d7c015a48e5aa7ed569f6aaf894f249b705ae11ff8c8a22415df25aea5d8504e7ea0e571ebfdc89d7f5db796383b7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614775, "uuid": "989bf24b-c152-410a-9e38-9ab7fc05ad28", "value": "T1B6018CC945509D0080E9995D22975164F821C3CF26874FB5BF6C2D3DEB98C04F076F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614775, "uuid": "a8987f8f-3808-4415-ab17-fb15b6692b78", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaFCmeUgQCS4i7C92eWC8vpC0DX:kXCKysE2hi0ziQvZohaF/esD4qRJHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614775, "uuid": "b85d877e-c79d-4d11-8223-2ef20cdd3aee", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614775, "uuid": "4194bae3-68ee-466a-a62b-5b682682af24", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614775, "uuid": "b55835cc-b401-48b0-a73b-bd88d86e0a5c", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3815a92b-8559-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784675366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675366, "uuid": "fea8447e-b74c-4cbf-b327-8db7614130c8", "comment": "Malware payload", "value": "ebb0df984c97baf6273edb4ccf75a328", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675366, "uuid": "72dc19f4-e784-4cb1-b658-dda2f531d622", "comment": "Malware payload", "value": "3cad6c354f21c3fc885fdb96f6f7d45fe25e66e0ee5ac435c54ad89fab93db70", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675366, "uuid": "5330d100-b9d6-43d7-bdba-618c23a61c16", "comment": "Malware payload", "value": "00557793ab3ca472c000084c37508e543e8b1704", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675366, "uuid": "1c2dcc5c-a35d-4ba0-be9e-0be247bd63dc", "comment": "Malware payload", "value": "4ebbe0e6938586fdee3563623965c236186baaeb2c23b1a0c56b98e9e0949cb1261576cd372f72d09372b2bb8a6ad7f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675366, "uuid": "ed283b8e-b293-4c03-a316-5005438124d8", "value": "T1BEC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675366, "uuid": "d4879d55-8bd6-4f1c-9721-7e9e6688a410", "value": "768:f78vCB+25j6es8Rq9FYpMSUpi+20qUpi+20YQX:f78l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784675366, "uuid": "290f189d-63ec-4a59-bd9d-94f04fc85659", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784675366, "uuid": "9351a28c-94b9-41ae-a4bc-b2cd76e64092", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675366, "uuid": "ef45638c-acc4-40c8-84e3-7c45dbd93a6c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a7fbcd-8534-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784659605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659605, "uuid": "b7380cfa-1da5-4d53-afb8-65985f948fb6", "comment": "Malware payload", "value": "52e333022d73503d408f485a5fe678df", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659605, "uuid": "cc90d9fd-7079-4caa-8ba0-73e2034b961d", "comment": "Malware payload", "value": "3d620693b4c7ba4a82a380843dc43953dcd091203f6cffb8f4160074c6a3ce3f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659605, "uuid": "34fe6574-6f3d-4d4a-8509-8423688fdc99", "comment": "Malware payload", "value": "244ddb9a7eabac6d878a83664d0e31c180eaaf4c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659605, "uuid": "74b6244a-98e8-438e-84ad-5ce08daf08fc", "comment": "Malware payload", "value": "77633863c591a82154c14a6d44c746830291aa0bb3d60f857ceb629ba928705d3acc9476528385b201c2c7dead31de37", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659605, "uuid": "2a9d7c8d-f808-4def-8737-a649b4d49646", "value": "T1F275239386F846B6F7F777B9AAF21267A2763C54477767EF0200469C09237C29131B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659605, "uuid": "6c079f5f-3370-45d9-8998-466dda1917e9", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659605, "uuid": "29d607f5-16c7-45a6-b1f0-f4903ca0cb12", "value": "24576:jH8MlODrEVSRTxQ3H+IQmNAqRLWFeM9Drx8CK0X+QA+Jv9hGVFpv6cuoV:7IDwaxCH/WmLWoi3xS0TASv9hiXScH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784659605, "uuid": "0b87901c-5800-4ab3-864a-1bb2557d514f", "value": 1581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784659605, "uuid": "53965735-2e50-443a-941c-66e2838c8f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659605, "uuid": "b5a93228-19c7-4711-88f0-d62639e6a1dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb8a8b1-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784611003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611003, "uuid": "28ce1182-2263-4d57-990b-585393014b8a", "comment": "Malware payload", "value": "60882f6a8a07ad6dba5852aee907909a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611003, "uuid": "d8fe8b87-f546-4efa-9617-b8e575108f65", "comment": "Malware payload", "value": "3d7e9c858993015c619fa5f744205704f8a3bf1f1bded3a403f876d4e405002a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611003, "uuid": "ead13099-6756-4249-a63a-e37c497a5f21", "comment": "Malware payload", "value": "de6db3276504c84ddf1763e409be7901af8404ed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611003, "uuid": "6485e94a-0875-42df-a45f-5028fbb11e0a", "comment": "Malware payload", "value": "5221dd940e20a7f3b543fd5c745564242a68d9117837a12dd572cc48603fb92aed02bea5786670295de46117909cb144", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611003, "uuid": "841fa060-9938-4c2d-ba5e-52bf8f456695", "value": "T142C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D4A3C71DC12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611003, "uuid": "68a34229-b679-4bd2-b7fd-4584e2f42173", "value": "768:n8vCB+25j6es8RG9FYpMSUpi+20qUpi+20YQX:n8l25Jwd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611003, "uuid": "a615be26-c575-4c9c-aca7-5db8a06a06ce", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611003, "uuid": "54ab2aea-4d5a-41df-94a7-b11fd199ad6e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611003, "uuid": "a7d64105-f02f-42d5-83a8-63498e9d0544", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e955c8d2-853b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784662778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662778, "uuid": "22041d7a-101b-48a6-80be-8475196419d1", "comment": "Malware payload", "value": "55695cb37497141280e7cd4f89bc62b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662778, "uuid": "2a051594-7c22-4676-a105-b2de347388f1", "comment": "Malware payload", "value": "3e23264ad27f2fc6efae4b9469b4b39b63abbad259232c4e2a9c88f675f321d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662778, "uuid": "0c36e0b5-01e7-4e08-95cb-5a9396df3b48", "comment": "Malware payload", "value": "919d4f4e4815a36e233c3b5dc2e5df3249c04908", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662778, "uuid": "11164421-f14e-4cb3-a43c-851fae7949b9", "comment": "Malware payload", "value": "f5b98412fb4c5f4de392a7725e7b2733db3d4470cf9249bd1074a5bbf4f60d7c401016dff628dd9c2fcc4aee62172760", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662778, "uuid": "373821cc-f6c0-43d9-9f33-58e36f234ffe", "value": "T1B1C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662778, "uuid": "0666d7df-e3c3-4940-aa31-f86a34b1a1b3", "value": "768:o8vCB+25j6es8RsQ9FYpMSUpi+20qUpi+20YQX:o8l25Jxd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784662778, "uuid": "3086a707-c886-49fc-983e-c5d092956906", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784662778, "uuid": "329a3603-59a9-4e7b-b85c-94c59fb584b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662778, "uuid": "acbb397c-51e0-4fa8-a175-c6b221fb7505", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35e7217-84dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784622315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622315, "uuid": "44606ac7-3e81-4a3e-a06d-6cfd85f4b100", "comment": "Malware payload", "value": "566a7b9ff79fee43f85dbc1988359ee2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622315, "uuid": "2d57cc67-e572-4aa9-ac27-00354fc2573e", "comment": "Malware payload", "value": "3e2808806c2495848c0f8ad6108b517cfc5c1d9a51347a58e0973a416dcf7102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622315, "uuid": "e965527d-8c73-4cdd-985e-6c745b596511", "comment": "Malware payload", "value": "3080d4ec3c218f89d1a7502079f7e7055c9a4d5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622315, "uuid": "f77c345d-1640-4d99-a524-42dea886cecf", "comment": "Malware payload", "value": "2affe7fe1045a3df52c5d26b4e63f326a6d7bc06883412cbfcb094f69ae9d51976b4cd2836a9927cb2033e09bc62ed3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622315, "uuid": "298bf6e3-a9b4-4cbd-9d03-729cc45204e9", "value": "T119A3E90AAF611DBBDC1BDD3709E90B0634CCA60B716937753538D928FA4A90B4AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622315, "uuid": "79387068-bf23-4205-b79f-701b6e2561ec", "value": "1536:48xu1/R0h4XErXS60hAlbl/a+uH/8HF+EC4Wsb0tiz0Z4G1tNz8:qpW4XErXT0ilbNWU+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784622315, "uuid": "8c76ae9a-345f-47b5-b5f9-3aef837a5bf8", "value": 101012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784622315, "uuid": "a5adf53b-d525-44a1-b6f6-648e44dfd051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622315, "uuid": "d452eb81-2b9d-4195-8643-ff1a2624ca4b", "value": "j25h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea4a93a-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593477, "uuid": "6af8190b-f5b5-49ef-bcfe-3a4bc449354b", "comment": "Malware payload (Mirai)", "value": "88050b361ee567b5f6ea2c5f879ae964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593477, "uuid": "5cd3fd81-79f3-4fb4-9f7d-df42adf769e8", "comment": "Malware payload (Mirai)", "value": "3e94cbf359f2bef4c8ef6dd71108455108c00c3b917aadb2015c176d60bbdd9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593477, "uuid": "3429ad68-ca4a-41c5-899b-cbf62432c2a0", "comment": "Malware payload (Mirai)", "value": "76b8eb6fd5cbdaa115b7ae5eb31c6535ccf97288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593477, "uuid": "36285fc5-77fd-4450-8858-06623893c7f8", "comment": "Malware payload (Mirai)", "value": "572837e2a3bab1147c008d0cc789fdc0f49220823c98cec57e2988b92deccadc3d2eab1b6f4db0c23822a24ff0d01242", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593477, "uuid": "3563d422-3fad-46f8-9956-93ccaaeea912", "value": "T10B23F143F66A825EC079997804DF7B07084AB24E30F0796C6F943275AEC5F562B392E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593477, "uuid": "ba1b0e94-33b9-42c5-9d2f-bebaa91c0197", "value": "768:rN6DL9KkxEBSt/Nsq8ZUjCMnltn6ZdEl6ZP6N1kwaDOtXvSDtL1WjlxFpfCtuf6r:pQBKkxEot/NsbZUTnL6pF64wcOtfGWL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593477, "uuid": "2c7391a6-0bf3-4b9d-8fac-fad23ea42dd0", "value": 47064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593477, "uuid": "e827a749-3a61-491b-a4c6-2147c062dc2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593477, "uuid": "6173d9b1-2820-467d-9d05-d97cac534e81", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981f3297-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611103, "uuid": "17546854-4da8-4b15-b206-103aff37ecfb", "comment": "Malware payload (Mirai)", "value": "5690722b8d5deaefc2b3a9d079f080da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611103, "uuid": "784d289f-eb36-44d4-a994-dc84cecb3211", "comment": "Malware payload (Mirai)", "value": "3ef74a47ba14e1b4a99c06a3af3baf35cef9129e80c8a1ccf7f4c82bacd6a11e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611103, "uuid": "d80394e7-93df-4ebf-b0a4-1e0ed6d996e7", "comment": "Malware payload (Mirai)", "value": "91f771bb91758482c56ac4f1693293e80f216141", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611103, "uuid": "9da431c3-b7a3-4650-b93f-6430a57c43c7", "comment": "Malware payload (Mirai)", "value": "b7a4853ee9f41ef3c4ce1b9c0417326f94e919e49ebe7ebf406f13b57f9c11c61f2c52eb949cc166ef7229e85884af36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611103, "uuid": "3c9ca388-8f30-449b-be48-f4891bf0dc65", "value": "T1ED53020798D53CA4FE9E1E7DE0CF195E8CC2B3A2E08E1B594218D1B45B1E2A9FB4D4C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611103, "uuid": "b7d6f190-dded-40a3-b07f-c3d627458ffc", "value": "1536:8hr4tRNDV9dzqhL9mTHzC9IBYobhQHxuyCKJCvonNX:8oRpAh8rzUyhvDoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611103, "uuid": "1c6276f2-8d8d-42be-9fac-b5ee2632fbeb", "value": 65424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611103, "uuid": "e9f72bb2-205f-44a6-b9a9-85523f1cbe1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611103, "uuid": "d7fff46f-d8c7-44ca-ac4a-84b7d5d504c2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2fb494-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784614950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614950, "uuid": "92c4c61f-8fe4-499f-9db4-c9eb826c28e6", "comment": "Malware payload", "value": "b90f8aa5d260094e3333928fadc743c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614950, "uuid": "2b5b27b9-8d04-4a02-a3cb-7c796e692a20", "comment": "Malware payload", "value": "3f953953eefc331763ba5b1976edd575225426bb37f75193f602ba8f2d67191e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614950, "uuid": "78767ada-2de3-48a4-9ebd-6748c1cd1f58", "comment": "Malware payload", "value": "d5d617866fd2f352f17e8f4ed7a50a71e48981cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614950, "uuid": "621e0098-b6b0-484d-8af9-19fac1d17c83", "comment": "Malware payload", "value": "99b6801a21b26cb25888e006d461f2ca7f8456dfed1b2047aa6a21f6586eb5c98063a8bb587d26b9a86e1bb34de7f9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614950, "uuid": "b2df1159-c546-452e-b50c-d34146c31a85", "value": "T1E7A35B03EBD980BDD198C9B1C34B793BE272B9C60E17B36E1B941E112D72944AF2DB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614950, "uuid": "2c2e5de9-9779-4915-ba12-7fc050cc1c65", "value": "cea383f818f01d4f3d607851305e1764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614950, "uuid": "8ed2a341-391c-4364-b0d8-0f506b1202b6", "value": "1536:bTZjpHG7r6KUgtSCIQbhTJsE1sS/mW/KRrvfherxKTaWk5UUAa93lj/qs9:fZjpHzUtSZMsgKBaWxUAgjCs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614950, "uuid": "ed45fa80-416e-4d91-81f1-52684d288397", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614950, "uuid": "1ad8aabf-3263-48bb-aafa-2a924bb1e45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614950, "uuid": "2d6f1e8b-7c4a-41dc-84db-df28c3401045", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c5252b-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784619314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619314, "uuid": "a1b67e1c-3766-4736-bd41-f614528a2cb5", "comment": "Malware payload (ConnectWise)", "value": "2b6ee837b845a2b6c93b4cf88ac28bf1", "object_relation": "md5", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619314, "uuid": "99123373-3a7f-4d1e-bf53-94618b9045e4", "comment": "Malware payload (ConnectWise)", "value": "40177ce3847b97d7a2619e0698ebe180938357149036bafa8787444707f25be8", "object_relation": "sha256", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619314, "uuid": "c91ae677-252f-439f-94fa-c9b0e3e056cc", "comment": "Malware payload (ConnectWise)", "value": "1cde310d13b508be768d84f304fcc6eb10206e72", "object_relation": "sha1", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619314, "uuid": "a1eea783-9560-43f3-a328-96689e71f9ef", "comment": "Malware payload (ConnectWise)", "value": "b54be4546d88c936887143cacfa2dbd3e61230a5255646ad7c676f4c9805ad9ab2458d4750def9b006f9e775d8b67fee", "object_relation": "sha3-384", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619314, "uuid": "289b18fd-79da-4812-820f-09abcb47207c", "value": "T158E5EF01B3A44136D5FF0635DDBA66229B75BC190364C7AF57C879A92E737C08A323A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619314, "uuid": "cef49a1a-6ec5-4b02-903c-006470c70242", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619314, "uuid": "26c48884-5763-42e7-92a5-e41f41622815", "value": "49152:HjET0+TL3Z0Mi963PSuArmh69eWbVypVCTgGu/aYmn1gO:Db16Co69eWb0pnGpYmn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619314, "uuid": "d08dc987-3814-40c2-98e9-6bea5af6e6d9", "value": 3134744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619314, "uuid": "a5a5fdcb-3e49-4d7e-9f33-a1c1b9ea3a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619314, "uuid": "f249165d-0297-4d41-b49e-677519012021", "value": "ConnectWiseControl.Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28406478-8531-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784658160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658160, "uuid": "7862dbbb-aae7-4714-b22e-abe05222803a", "comment": "Malware payload (Vidar)", "value": "f9f49c54ef5a103b4efdfba8fe7bc54e", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658160, "uuid": "0d75d940-0e0b-40b2-97a9-956622b81d24", "comment": "Malware payload (Vidar)", "value": "42b7109a719a560e98953125a7c9b2fa3c9167312414ad379d88998a8a74665f", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658160, "uuid": "1a077e8d-83f1-46b4-b34d-43b0b3de48b3", "comment": "Malware payload (Vidar)", "value": "f146650f0bc4339f236ef3cbbb98907223fe9890", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658160, "uuid": "e3576bb6-f39b-4917-98ae-f363e2f0a2a5", "comment": "Malware payload (Vidar)", "value": "fb651f7b722ed0ea4d26aff2cf18248a522b002648784b7fd13f9aadbc1069b8615300a53838764b92abb9dac598aea0", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658160, "uuid": "54870c5c-bb9c-421b-b40f-2400ef495890", "value": "T162F7334053558615D1CB9FFC217F1BF3AE2B0DE0A629A0AF07A68871F5D986BC68C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658160, "uuid": "98484b9b-93ab-419b-b06e-99c0166e421b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658160, "uuid": "40bed4ae-1ade-46c8-b0d7-e60580bc27fa", "value": "1572864:YLdknlwrm58/FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7f7:Y2nlJ8aABZVPArg/bXeB7f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784658160, "uuid": "b7db6ace-14ca-467b-b434-93976670ccff", "value": 71224467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784658160, "uuid": "5bfa7ceb-3356-4a53-9480-0a791e6164af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658160, "uuid": "a32de8ff-1d4a-4f4b-858a-d159f8f9b621", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067e6266-84fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784635340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784635340, "uuid": "8336e72a-292f-432a-950f-72d63db0481d", "comment": "Malware payload (Prometei)", "value": "5882acdf4b0ce93eae64c7a4bd26bbdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784635340, "uuid": "af30971a-d4f0-49d1-b23a-6d1c5fbfa615", "comment": "Malware payload (Prometei)", "value": "4393fc0ab83915631bb62243562a7d08e5314d4cdb4b0552acf7eba6af69aae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784635340, "uuid": "41f5b19d-9605-446a-abdb-af2f1e0ff57c", "comment": "Malware payload (Prometei)", "value": "f0c3200e97a643a8bc703dbbd6ec5745d6015d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784635340, "uuid": "4c924c60-8e43-4885-a642-4e172d038652", "comment": "Malware payload (Prometei)", "value": "46a00ccc75c35c24242cbee67a229a0c3421c9994709d57a03b97b8095c66ff2546954a5dcfae4972eea1454f610fbc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784635340, "uuid": "3861098d-a785-4d98-aefe-ee4fdf8c0d86", "value": "T1CEA423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784635340, "uuid": "ed4a8243-6040-4190-9b83-7779622c39c6", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdS:Fs6pyCC/Ya2hpi6T6N4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784635340, "uuid": "2465a776-1a14-4478-ac90-fd2f42d0d9ee", "value": 449086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784635340, "uuid": "923924ce-af79-465e-8826-c1796585f38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784635340, "uuid": "a2891833-5ff8-4e42-8b2e-5f322566e988", "value": "4393fc0ab83915631bb62243562a7d08e5314d4cdb4b0552acf7eba6af69aae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b84116a-849b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784593848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593848, "uuid": "8dda2903-e2f0-45d4-b17a-4ff07e4e5af6", "comment": "Malware payload", "value": "d34577be6469d3d8f366ad160bb57cf7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593848, "uuid": "25dbb7a7-bdf6-448d-a135-72144f1efb02", "comment": "Malware payload", "value": "4413558056659da02a67fb77b30fd223e090468899ba2714ebdf6e0a9b9ff9bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593848, "uuid": "7a9a4c35-ae73-4fb9-a6be-bf56d593ee92", "comment": "Malware payload", "value": "54ca801a8cc67ca810ac1556fe10d54771af4149", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593848, "uuid": "cdb84daa-c87d-4eed-8ddc-6f95845f6d51", "comment": "Malware payload", "value": "f65b806d49a9ae7d9a1a7543758da5319fced3b599ba4ce8e2687952a712c21c14e5bec51f2c30bb6058a80a28a4f525", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593848, "uuid": "c0ce116b-f9da-4e30-ba6b-91a9c4973288", "value": "T131236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593848, "uuid": "b21e7aaa-3a48-4547-a64c-8598ce0679e2", "value": "768:4r9NyXsZztCy29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:mHusZ5cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593848, "uuid": "5b22c52d-e8da-4fd7-930f-36ed9609c1ea", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593848, "uuid": "00a5e852-539a-4f04-91ff-158fe446318b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593848, "uuid": "d0432a83-49b8-48b6-8e87-3eae1aa1b48d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a57b1de-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784611106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611106, "uuid": "1ec5751e-12fb-4b7b-9a20-4fabf8ad821c", "comment": "Malware payload (Gafgyt)", "value": "160adda9861797b72895b367638e6fdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611106, "uuid": "88733de7-8682-441a-8177-836bdde80a46", "comment": "Malware payload (Gafgyt)", "value": "444ad63dcb4349c666ceb9a01c228a23c8f5f7c0ff7bfec8c87c8df3f7094fa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611106, "uuid": "0c979240-8961-434e-9252-df3ab8f78496", "comment": "Malware payload (Gafgyt)", "value": "69781e093250a9ff94f83caaeb09cd16fd8bdfdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611106, "uuid": "638f7956-2f67-43a9-a03b-7064c1b09abd", "comment": "Malware payload (Gafgyt)", "value": "6e49d56c08e9026a8776dd9b7002c18bbb50bf71057bfc98df228e9addf358fb869e9ff5c5322d39ca202f65e895e989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611106, "uuid": "e3af12eb-2a3a-4e73-97a0-7c0ceba54800", "value": "T1B953F271AB1B1BD4CC08307F86BF17590CD2BABAE082E9D53E77A170EBDA38650165D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611106, "uuid": "6742f1da-43bb-485d-a810-df916a80a92a", "value": "1536:m7j6mo+P93YLbwHalEXlhBxQeYPOaOwdTSCcQMnjAMnVEWT:a6m1IbxlEXlxQeYmaBYPnjAMnVEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611106, "uuid": "c78256e5-9c9b-4eb0-bb49-d438ad321dad", "value": 64184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611106, "uuid": "d7d78b90-2d8d-45ab-a2a9-6a995f1a9b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611106, "uuid": "630e47b6-def8-4bee-8edf-700b2b0ab63c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52046d29-84ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784600677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600677, "uuid": "8bb4e9ec-e050-437c-b0d5-45e2b151b5f4", "comment": "Malware payload (Mirai)", "value": "dcc38510f3241c82412f875c49cbd216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600677, "uuid": "c356083f-6ee0-4743-a4e9-344468648487", "comment": "Malware payload (Mirai)", "value": "44f4620c1f239c8abba7f0b04b63f2238ed917f1285ebc416d2c2d21adb3a6cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600677, "uuid": "487944e6-6a44-4e08-89ce-1b0d327613b0", "comment": "Malware payload (Mirai)", "value": "ad809e10528e0ac74b491f2a9f21c2853243b5b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600677, "uuid": "3985534c-f9b2-4d92-bb0e-6755255ae3f7", "comment": "Malware payload (Mirai)", "value": "c7c766df33d157dc19e3e17636c895fddad743b93bd699a91d4c8cb66e498c2400f885fb27e7ff129ff72d4c92138399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600677, "uuid": "abb97daa-f2e8-4571-8c19-97dc73316355", "value": "T1FD43F1324EB39C3181A12439F4358E2B3E6749B0A46B76B5229F997D84EC58532ED3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600677, "uuid": "22889d0e-a076-4099-bac7-71cf29972c58", "value": "1536:P92I0ScfFmRNzOy/WpzM//IoMjrIDKj0C:QI0duzOy/WpI/gBj8tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784600677, "uuid": "e82a94ea-3676-4c7e-b318-a8185a1064e8", "value": 56284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784600677, "uuid": "a6c7d710-fb6c-4eae-a26e-39d458cc9b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600677, "uuid": "03f569be-3f75-4edd-8f60-7aa89b58eb4f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8489838b-84cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784616224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616224, "uuid": "43dd09f4-8afb-4da3-86eb-ec5a5838e2d5", "comment": "Malware payload (Mirai)", "value": "ebe68ff0443d7dc82e599a728711fbe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616224, "uuid": "1f28e3f2-e7ce-48e5-97af-ba605ca1c635", "comment": "Malware payload (Mirai)", "value": "4567314381f574bcee9d4fc608cdd94eee362ca77ba49027c4c4a912e3b731f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616224, "uuid": "8409bc34-99d4-42bd-939c-d1d828c61a54", "comment": "Malware payload (Mirai)", "value": "08b4cd0d46592ebdfeb2f1b2f4e6d1230599365d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616224, "uuid": "7ef4091e-c58c-47fa-891d-8759c5fb27ff", "comment": "Malware payload (Mirai)", "value": "71c6881799b185365f88e049e3da30e2e0c479c92705018abf7bc5b288851975708dbf4d7eb747118e932d1746bb4b09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616224, "uuid": "c92357cc-75db-4d8d-a895-a4fc2691790e", "value": "T161040946B9826E26C6C74A7AFF0F014D33965BECD3DA73328D181B70368752B0E76916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616224, "uuid": "1923142a-ccf3-4e37-b944-ae985d371412", "value": "3072:B82AVjB6SJNT1/ZrietYyC33FRa/b/YWO8oOAMZpjBYVnQ9:BjAdpT1/Zrieu31RaT/YlOlnh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784616224, "uuid": "04185284-5d9d-486a-af65-f0f5a39a1d20", "value": 189556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784616224, "uuid": "dcb5b9ba-fc9a-4254-bd06-daec24cf6cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616224, "uuid": "93c2e95f-e198-43ef-95f0-291b35ed8af9", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dac6fe-84df-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784623262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623262, "uuid": "93a68492-9791-42d4-933d-92231d6f723c", "comment": "Malware payload (SilentNet)", "value": "ce4d2e6400e4a9ff87ab22a3bfbd25c0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623262, "uuid": "fa70a23f-3993-49cd-a628-dd27ac3843cb", "comment": "Malware payload (SilentNet)", "value": "468147b73b401b695241c10ac6777fb10194789dde88e0edd2019f22f97c2312", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623262, "uuid": "f9b0c797-92b0-444e-b8cf-e4876c63e64d", "comment": "Malware payload (SilentNet)", "value": "cab56dbef2a57992315a15b29ee4039b626326d5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623262, "uuid": "84fd7239-9b91-4b73-9cf2-97c9b49f4dd0", "comment": "Malware payload (SilentNet)", "value": "69377de663bfd2a89b44568a943f767bee4b921ec70ada6decd53352e912fc3033748c2f10447389917ccbab29096b53", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623262, "uuid": "36d0742f-8f81-431b-9cb1-85b0f4029205", "value": "T111F423246B135821F09497B8854B63FA3A3EE729C7742ED3BA0A768F3621C31D3057E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623262, "uuid": "1f8d88e0-d919-4827-bc46-60d10da35597", "value": "12288:ZTm40Pbczh8eWPtY4ENaCGhoa2FqtW/QpIgubNVVNmfknhcoitJMFyLpJSVqpwEP:ZobUu7P7E8UFqtIQ2gGV8AhcoitCepTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784623262, "uuid": "3bb1115d-0cec-412d-9c97-43ce81ce164a", "value": 743522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784623262, "uuid": "32ade2d4-2b54-4275-accd-efe6dab1ddaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623262, "uuid": "9ddc323c-3689-4a5c-883e-4bfe921c932a", "value": "GLAZEDCLIENTyx.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a1f220-8541-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784665025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665025, "uuid": "ebe45a62-03c9-46b3-85a8-77dee83cd9a8", "comment": "Malware payload", "value": "9feb502c7ec6907dd2adabd782b61b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665025, "uuid": "15b053a0-aa4f-4440-b3b1-774a736c9d6c", "comment": "Malware payload", "value": "46b426b6e25231d731d7cb2822f1435f65778f168c9d838568e9012d3507abda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665025, "uuid": "8b7c83b3-713c-47e7-92ec-716c249a0ca4", "comment": "Malware payload", "value": "d812878aba17e6fc8cc7fbc4ccaad2dc66b1624d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665025, "uuid": "3d9f03e1-ab49-4177-ba22-9c271208cb4c", "comment": "Malware payload", "value": "7a2952818f376863cb0b125af70f8123a30ca992647001c4d13daa187b7727dc109d30fe2c2677386afe6ec19733e037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665025, "uuid": "ac1cb701-e786-49fe-ae0c-4517824fe3a8", "value": "T12644EE6163EA1104F7FB5FB76EF6A084DAB579B10A76C21E5168C00F2C75F81E8A4732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665025, "uuid": "20f2b6a9-d13c-4d53-bfa0-650a8048d52c", "value": "f9e79734109d56f4dd73964feeaeffc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665025, "uuid": "486a5ad7-febf-4009-912e-b1104e57d6c2", "value": "3072:Dg8P+Xx+OOWToreKtPvSFl3WkFB1xTO7wm:DH+X1oqK5m0kFB12R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784665025, "uuid": "fecb6d91-e6d8-4f1f-81b6-d3f1bf1d1c63", "value": 267048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784665025, "uuid": "41c94769-39fc-4884-ad2e-a7aa60f6d1ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665025, "uuid": "489500fa-a95f-4122-bba5-7f8fb9634cd0", "value": "rnp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00433571-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593238, "uuid": "274b0d29-35d1-4545-b0a3-47dd49815b36", "comment": "Malware payload (Mirai)", "value": "04b8c0c727af81f5f1e5327fd8a6a1d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593238, "uuid": "00575c61-5ae7-4c24-9e9d-987a03773f5b", "comment": "Malware payload (Mirai)", "value": "488a3dc8fc944a607f365a5b609dfd285d0f881b6446be3553c254617579bac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593238, "uuid": "e9119aa0-482e-4de7-bdad-c13d2dfac817", "comment": "Malware payload (Mirai)", "value": "5a844dd6d2952241abf13ed967d386b5c8891958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593238, "uuid": "cbb09ad2-e47e-49c2-b330-416f083da03b", "comment": "Malware payload (Mirai)", "value": "acf3857dbab9a00eb9f020c7383083aceab24d65f9da058b38b10359af58d2c5f6eaeda88741f3afa4831d59ffc843d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593238, "uuid": "ad77db1e-905e-45fa-8a8a-a40ffd334714", "value": "T155835C0173644F0BE8AA0AF5282F17E483FEED9021F4F5856A0FDB5A4235E37155AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593238, "uuid": "c89fae82-3cb9-45dd-a61a-a73eba3704f4", "value": "1536:7QHQd18Vez/S1f+39FAwFKtMzXIeoGXxTq:7TdUXReo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593238, "uuid": "04335361-80da-4254-a396-19f5a5189f24", "value": 83040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593238, "uuid": "6d4c4873-ef89-4b32-a9a4-5199a2d44ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593238, "uuid": "93f941dc-23f6-4c52-b2df-cdc2fa45000a", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7e0fea-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615276, "uuid": "49757bfe-1934-44fb-9ad2-0b53c7a631fa", "comment": "Malware payload (PhantomStealer)", "value": "57633f38b3932c00ff7ad6e21dcda71a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xfolow--tourtrade-shop", "colour": "#DA7CC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615276, "uuid": "7c663044-c7b4-4588-855a-777a2493c980", "comment": "Malware payload (PhantomStealer)", "value": "492a93539066bbb570ec921614b09f21c4a3c509c0d35fb0f501b3ed4d05b24a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xfolow--tourtrade-shop", "colour": "#DA7CC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615276, "uuid": "6dfb28b4-9dfc-4779-8197-5620cf4ac984", "comment": "Malware payload (PhantomStealer)", "value": "183d27a26712a306a12af62fb5b4529f064f397f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xfolow--tourtrade-shop", "colour": "#DA7CC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615276, "uuid": "2708ac5e-d3f2-4ec1-b053-82f9063bad3a", "comment": "Malware payload (PhantomStealer)", "value": "19fa318398934468126f373e1b84a90c6b25e6457f5fb8c4b237ec2bcf36975b49bf0692ee8bbb56cf8fbc51d36a9cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xfolow--tourtrade-shop", "colour": "#DA7CC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615276, "uuid": "438dc9b5-291e-40bc-af95-4d694704b892", "value": "T16CF47C24B3F405A4F1FF9B75D4B18422CA71B84A9A34CB8F159882AE0E73791DD74B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615276, "uuid": "78da6e0d-d484-4054-be46-44ca4b25562a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615276, "uuid": "65ec6f33-3159-4110-b86f-3e72bda219c5", "value": "12288:/9C7vBAOwGMpgy3OzQdyBxjbCFroh3l+C6E0+:/9CjTMgy3OzQdyXbCFQl+CN0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615276, "uuid": "acecb297-843b-45f5-b277-27921105dbc1", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615276, "uuid": "3ba0d3ef-8d06-4ea2-bedb-b9cd7e2893f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615276, "uuid": "7f1d6772-75b8-44bc-bcdc-5b59bbcb6c6d", "value": "492a93539066bbb570ec921614b09f21c4a3c509c0d35fb0f501b3ed4d05b24a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff766f41-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593237, "uuid": "32706d62-70c9-4fe5-aec3-13cf649be10c", "comment": "Malware payload (Mirai)", "value": "a16681377a71e627cf125e28a208b07a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593237, "uuid": "942b95ca-580b-49f9-a61b-0d68c449b0d6", "comment": "Malware payload (Mirai)", "value": "49665430bea49701da165dbadd6b8f99bde4d804fcae784072d2460c3c7d5b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593237, "uuid": "d6c3bc5a-f665-4983-b041-8fcb661683a1", "comment": "Malware payload (Mirai)", "value": "4914237b1c8115e2e24aa4780b044bc570bc071d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593237, "uuid": "14d81811-a438-4cae-a312-56e2b5a59d88", "comment": "Malware payload (Mirai)", "value": "0ec6e2f9d97aa4fea3ed53c39637c43bdb5382509baf4f45c454402351708f8b0c2bf510aa561cd92cbe3d37eff2e7a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593237, "uuid": "b8ca3d0b-e0d8-4420-81c3-c6667f3a2193", "value": "T198A32A86BC819A11C6C51377FA2F108D330267ADF2DE7262CD151F647BCA81F0E6BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593237, "uuid": "7910b0b5-27ad-4315-9027-f29e48c7a8c3", "value": "1536:4Nnr0vpp/rFFSHs6h/d43AtnA78bPiqimKF/yqtBiJ70q5duUndOw7nizCIGiHmc:m0h9FEHztfNDbPf9waYq5MUnjghZmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593237, "uuid": "79143ec9-22a4-476e-b02d-559132f96d43", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593237, "uuid": "47a62f7f-e431-4c4d-a66a-e8b0524b61f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593237, "uuid": "97c33737-9e2b-4383-9e53-ee429ae24778", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f810468a-8502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638322, "uuid": "250b9a8f-d37f-42d8-bc1d-cf81f18d182e", "comment": "Malware payload", "value": "a31cb2106f80c5c1bde2d84ea2153686", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638322, "uuid": "2c26fed6-4131-41fe-8304-a65446b3ea6b", "comment": "Malware payload", "value": "496a13d6bdf0b9d81636a5cc68b21f7a6227e451a25af9347f25f7594b92b400", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638322, "uuid": "f89d120e-144a-4a0c-8e21-24e21d2d8389", "comment": "Malware payload", "value": "ebbaff3d2bc281608f4b0d15f1ff795d35b537df", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638322, "uuid": "8d98f93b-ce88-49d3-aceb-9a57cc890af7", "comment": "Malware payload", "value": "80b2231159d53dd8797a82b146513c8d1200ee83803e61d1ea6e1a91b6c15322e6a57057f565077128a4ab98727a8d0f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638322, "uuid": "a3955957-f477-4c17-8225-7208f8ef2bb3", "value": "T199A01240091063A88FD7480983C68230483E3004131183917930A104BD00A94E04A185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638322, "uuid": "164c7f74-7118-49b1-8396-e3a6a2b4a482", "value": "3:VSJJFFSoM3KbQqPJH0cVERvhPPFXsd/X:skR3KbQO0csPSFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638322, "uuid": "b54fa5e4-791c-499c-ba09-4730843e68cb", "value": 86, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638322, "uuid": "54c81342-d92c-4501-8e3c-7cae4909226d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638322, "uuid": "bdd40b36-65cd-4dfc-ad16-65af1cec1fe6", "value": "powershell WindowStyle Hidden Ex.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022dbdc2-8546-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784667115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667115, "uuid": "254b53e8-0ad5-4e39-bf3d-9101e0f73b5c", "comment": "Malware payload (Mirai)", "value": "68b31bfc398195439d15436e361dfcc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667115, "uuid": "2c54496f-1889-40d4-9faf-2bdce1bf5460", "comment": "Malware payload (Mirai)", "value": "4977440daf9c3c16cd86e641233a44c581c020ef538e7212e7b68eb4910ca7cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667115, "uuid": "321c9ac2-3a5a-4545-8f5b-baa578823fbe", "comment": "Malware payload (Mirai)", "value": "5bc4c220830cb29b6dc3767b6297c446bbeea118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667115, "uuid": "78ca0f9e-b9b0-483b-ae18-fd3dcd38a335", "comment": "Malware payload (Mirai)", "value": "aaaebc44b92862056f39e83ffc000617761d170a40f550fb862ca53ed3cefa8ed03c20f832ea960a965b2f89c7550e53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667115, "uuid": "98125ce0-462f-4b4c-b146-fb8897c45d91", "value": "T1EBA3C70ABF611DBBD81BDD3705AD0B0234CCA6177264377A3538D918BB4A54B8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667115, "uuid": "879e49fc-efa6-4fb0-aa41-212eda7747a6", "value": "1536:eK3Qe607xFVKLXz6XQAbSZKoubxW2q7l7df9w0fP13gvkSLcxr/pfj7:Z9zVKLXGXnboEbiD1nRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667115, "uuid": "bc147a21-82b1-4dfc-8f44-f039c1af1ef3", "value": 101236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667115, "uuid": "2864d62b-471c-4373-9be4-39c1ec236692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667115, "uuid": "c893abf8-dbff-4ac2-9951-bbd84d71e9f5", "value": "30HR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7db1b81-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784615048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615048, "uuid": "8e6b70fa-6c1a-4cc9-8136-61e12d9fd8c0", "comment": "Malware payload", "value": "1e9fcedae714eb681345b95ff622f965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615048, "uuid": "9cef1fb3-ca51-4506-9bd2-c73968595071", "comment": "Malware payload", "value": "4ac6d32ebd212187db9d252c0963bc1614a8be2629584f12a75311e36c3d24df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615048, "uuid": "65a21107-496a-482a-8b9c-89922e731e14", "comment": "Malware payload", "value": "4c25f9fad05864dbacc36d8bb89673c3c076916e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615048, "uuid": "7c9857c0-46e8-4b2f-bd95-eb83004fdec3", "comment": "Malware payload", "value": "9abba9e65308c41fc50bce5858a84baddc156b92a67c6ccef66cf83844db3059700c096f4d81ba1c91787d1ea0f9b8b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615048, "uuid": "36a1021c-8c82-44e5-ae6d-198d484deaf8", "value": "T1D9354B1BE2B354E8C92BD0748B739772BA30B82945247D2E5EA4EB321F31E505F5E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615048, "uuid": "4bd49dcd-ba2d-4782-8384-cdcb6154a517", "value": "1809c666d81defee394347c24f878e70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615048, "uuid": "4ff1873a-67d3-47cb-997a-d11dfca81816", "value": "24576:WsyBPRagzRZVxMGF0cBXVKpsq9AVPEQv:JyBPR1FZVxMGF5BXVKmHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615048, "uuid": "848e951e-a3cf-467c-af87-fac1903343c1", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615048, "uuid": "a00d49c8-d1af-459b-b29e-bfc51d498123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615048, "uuid": "d30d2bfc-3fdc-486a-91f0-49ffc859b5aa", "value": "WinService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701aaf7a-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784615330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615330, "uuid": "bf27aeab-274c-4775-be77-66ef73ab137a", "comment": "Malware payload (AgentTesla)", "value": "08efacb4a1f581c64491a4fffe439103", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615330, "uuid": "eae49742-2d17-4720-b3e3-2050f1ff33e5", "comment": "Malware payload (AgentTesla)", "value": "4b09baa2ab153ae99d5de536b3b2c7a0e9e67f4a656694cfcbd12403cba6e01d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615330, "uuid": "7051e16e-cec5-4d4f-b3ec-8c522b2ddf11", "comment": "Malware payload (AgentTesla)", "value": "d291d31dc95bb3ebe374c28fc61a64a892b022bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615330, "uuid": "de1b19d3-627a-4974-b194-36d6a96e99ae", "comment": "Malware payload (AgentTesla)", "value": "1448f0473a01a95df0fc82e14287fd6af88254a29f2bf92a519035086f72ffffa42ad2854a92fec68af12dd1ee331757", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615330, "uuid": "9b2b3eb6-12ba-437f-8b9b-473beea7c9aa", "value": "T1E52456C5A6E8AC4403976F7B375FB0E9FF6B0AD978444607C598F860B0A4A03F9E1935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615330, "uuid": "f06b8b27-85de-491d-b504-8fb1ccf1a7b2", "value": "3072:pgm3bwz1rfq4UgOfujKKvn0JGg7R29oz8Ep2bv:0q45rjKKvn4Gg7uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615330, "uuid": "1b7c9797-d261-44e0-8b39-066c618f02e7", "value": 210615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615330, "uuid": "e9f6b5a5-f37d-4c9f-a2bb-417c9da59a0e", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615330, "uuid": "3e75ac4d-900b-4764-960c-e27662f0afa6", "value": "Solicitud Actualizacion Datos_Bancarios_Pago_Devuelto 2026-07-13.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717d4439-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784618339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618339, "uuid": "cfac65bf-2e24-4341-b91f-8421e4655054", "comment": "Malware payload (CoinMiner)", "value": "4200322e65b8e871f859a11c3bc60600", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618339, "uuid": "057e415f-8e24-4e78-899c-ae290a03d60e", "comment": "Malware payload (CoinMiner)", "value": "4b8a2fdaad0f3e6e6325d3deef163526e470c9a88a23f73e491bd228f3548641", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618339, "uuid": "b7b01f43-65d8-470a-acef-15b7621d27c1", "comment": "Malware payload (CoinMiner)", "value": "1b5a32e61c9de6744a7472e3d4e7590b3d9974a4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618339, "uuid": "00ad20e9-113b-449f-9e7e-796064585ffc", "comment": "Malware payload (CoinMiner)", "value": "9dab4776a2d9560dba254edb887d1b356d7974c8bdf8f63b008023ecb50d2d63f73ad40604d7aa14873c230355d0bde0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618339, "uuid": "7f25b9c8-7f80-4852-852e-814bbb184852", "value": "T1E2372397F7A49D1FC87700F2896E9272521B8D128A839F836D54362C387B6D42F5DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618339, "uuid": "9740926c-5f83-4d80-a81f-39a4e3144426", "value": "393216:f7GCXr8pSEGvgfsaxgd52kU5Ux9aXYUx9aXfwVR:TGLHGvoOe6x9aHx9au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618339, "uuid": "db114de1-8c23-441e-9c34-483e0030aa2a", "value": 24067230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618339, "uuid": "3d17ed5f-c9c1-4ee0-a167-810fc94bb70c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618339, "uuid": "70f0d496-479f-41ef-a7f9-e0692a8986ae", "value": "UPminer2.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e86ac8-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784619320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619320, "uuid": "8d096bfe-d683-4cad-a375-45b4afb65d75", "comment": "Malware payload (ConnectWise)", "value": "0312c304bea5c62ddd358d04e271335f", "object_relation": "md5", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619320, "uuid": "2d66646d-c2e4-4948-9c2c-ecdc7fa95df8", "comment": "Malware payload (ConnectWise)", "value": "4ba932debe01cddd0d98d129daf08a947b34e82caae7541ad27dec15109ee3be", "object_relation": "sha256", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619320, "uuid": "fb10a896-2c02-4c9e-ae94-e62035e2a877", "comment": "Malware payload (ConnectWise)", "value": "1356d8165f3ca82b6940c5e3a52c4a1a9bcdc779", "object_relation": "sha1", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619320, "uuid": "704cc46a-d1f0-486e-a4aa-4057403d5562", "comment": "Malware payload (ConnectWise)", "value": "51c5b4ee03cae4c4ceb55b7d010845722dca4cb9c0287653bdcb9528f0435a14389d9492fbe7cf6cbd6fdf52d8c603de", "object_relation": "sha3-384", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619320, "uuid": "db46592b-ec6a-408b-886f-16db3af0ae91", "value": "T1E5650220B6E5883DEAF61A36FF7A92615F39FD251B20C15E8394381D0D70A919BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619320, "uuid": "52d0b3fc-d4ee-42fd-ac4a-6ca00cdbed76", "value": "24576:DZPlmF0uwTKh56Z5vePu/DVeL1pVjeOxnUUGGu/aYmQurhwQUv:Dmh69eWbVypVC6gGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619320, "uuid": "9bf115fe-409b-4b9d-978a-069cb23ed00b", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619320, "uuid": "1e68baa6-b672-4382-ad19-8936f8018e71", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619320, "uuid": "a8ffa0fb-16f5-499d-945f-25bcfaa7e3c8", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71258ad6-8520-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784650980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650980, "uuid": "fbbd60fd-1268-466e-89c0-9844743ca22f", "comment": "Malware payload", "value": "0c35253abda0682248ba04267fd302d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650980, "uuid": "9ddd3e96-dba7-415e-9966-53def3aa33a1", "comment": "Malware payload", "value": "4c595bd7a2114ae3cc937203e4569d98d90bdcfccdec6ff6b4fafbda8899fdbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650980, "uuid": "1128c5b1-a0e2-4669-b34c-3833e5f98a75", "comment": "Malware payload", "value": "207c5c6561483eb48e9c49df5a47911e7454ca30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650980, "uuid": "97014a60-7092-4b80-9f67-1c4144922467", "comment": "Malware payload", "value": "f94d709bce8184dfd473fc431ab625bde6d1525e2762630cd435580d851cacc35eaaec8e91d934ca2a7e43ba5850daae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650980, "uuid": "83706fe9-5d44-4b4c-b6a7-c2657a09639f", "value": "T181C30845F8519B17CAC652BBFF4E428D7B261758E3EE72039D256F21378B85B0E3A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650980, "uuid": "7246b191-810e-45b3-a374-68840457901d", "value": "1536:k5VFsQCCUJ1jMpF+2IXp4Vuc8eTuXh+RRalOHerCiXMJ2lKnwywmBcP8k5/HBg/+:k5VgjrgF+/43x8h+Twd8Atb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784650980, "uuid": "cfc64a9f-0d3e-437b-b3a8-80261a07b7c1", "value": 125292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784650980, "uuid": "66cf3719-b657-4a12-8ea4-c8991b36b433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650980, "uuid": "57395a9e-c0ba-464d-a419-6195c97c23a2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da0517b-8528-11f1-bd95-42010a9c0009", "comment": "Malware payload (RevStealer)", "timestamp": 1784654410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654410, "uuid": "a4cb4ae5-7f2f-45eb-9fea-586df869e88f", "comment": "Malware payload (RevStealer)", "value": "face4acb042c323fca0ead3463d0e896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654410, "uuid": "5b671f18-75c5-4fa9-9707-a62185609bdf", "comment": "Malware payload (RevStealer)", "value": "4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654410, "uuid": "8510bfcb-0f82-413b-9a80-9978db88ea87", "comment": "Malware payload (RevStealer)", "value": "b3f6efdbac7547ee988417c636a9eea999e8eebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654410, "uuid": "5e5c9010-0722-4ac8-9f46-a081d0f5f683", "comment": "Malware payload (RevStealer)", "value": "63d93289cc4aca24d9c4b6a433a3e0790831fb5c2e826f964d32f3ebb902a15598b58a9561d10fb63b82fe47a70145c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654410, "uuid": "74960c86-9002-4c08-9c65-a108db318a30", "value": "T1CA66C63B225691FAC11FC9FAC0528E1CB4F360751722CDEB31910B6B9A55CC6CE3A5DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654410, "uuid": "f85d874f-f8df-4942-9efe-27d687efbccf", "value": "d26a7be9d89fa8b31648728fb1689c48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654410, "uuid": "dfa285a5-96c9-46bc-bd12-6bb290177212", "value": "49152:aQ5wKyD/UzzobuH1twKVR6Se6gawYOz5ZqPmxtzh1g:hGxtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784654410, "uuid": "0bb0f04a-38fe-49a3-9672-c758fbe50fc7", "value": 7080056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784654410, "uuid": "6fccff33-82cd-49d7-a305-577c6ed27540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654410, "uuid": "c973cb4b-77ee-4820-b86d-508da0835ec9", "value": "resightloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8769b735-8500-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784637274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637274, "uuid": "7b1ac65c-bbf5-4470-a994-9b1446140a8d", "comment": "Malware payload", "value": "edccfe8a0e9ac1dcb1e77f04d529b1c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637274, "uuid": "27d41ebc-b101-4723-8bd0-beb4fb06db4c", "comment": "Malware payload", "value": "4cc12514dd30b4ad77ac7336f5a7c8ac113147c1d8f3bfcb41b4cc8856f97f55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637274, "uuid": "9e36d497-e248-4897-a556-9a34f1934df6", "comment": "Malware payload", "value": "9e6603ee1bc04da2b86e361585f3280bf53e7000", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637274, "uuid": "b90584d1-563d-4a5b-80ef-0d492f00217f", "comment": "Malware payload", "value": "cb726d15d6bade346bc91813a60254fbaa8cfff6e02204d79c360b2ded8a306caedf9d14be4f1603047cac74345ac181", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637274, "uuid": "7d5f3d64-a3bf-436f-a5fd-2a84f5c11013", "value": "T149C26C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637274, "uuid": "8f799afa-1a88-45e7-a10b-62d26a81fe21", "value": "768:G8vCB+25j6es8R29FYpMSUpi+20qUpi+20YQX:G8l25Jgd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637274, "uuid": "c257a4be-c0cb-41aa-a06d-1379988ba2b4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637274, "uuid": "56304fea-4bf8-46fd-b8c8-d7891380b9b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637274, "uuid": "abd2dcbf-b63d-4168-996b-39a03725baee", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d802c8fa-84e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784627531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627531, "uuid": "47c0f325-1114-485a-ab42-d1d270c53f9e", "comment": "Malware payload (Efimer)", "value": "bc7bb25fa0775ce8e62629819c081e70", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627531, "uuid": "de0c234e-eed6-49ed-997d-5ead1718619f", "comment": "Malware payload (Efimer)", "value": "4ceeb2fb03ca0e8006037b953aa3b46e5f82555313b6ea583a660661442bd669", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627531, "uuid": "e619b36c-0800-4792-8177-714d1cfdc5b5", "comment": "Malware payload (Efimer)", "value": "00784db51153964648885ff6ec5534c5d6715514", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784627531, "uuid": "c6b054db-56eb-496d-93ce-d2297670ab64", "comment": "Malware payload (Efimer)", "value": "9fb4f0c2030c65f1ed7baae300b76a9fd7a906f520d6892c76c9b797303499811375cf5b3fd6974afe3a5a2e2434622f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627531, "uuid": "1d5f248a-f2a4-42ab-9d32-3b3375538f44", "value": "T15EE6334CA9E801EEE9B3413CEDE251D2D0A574964BB6CD9F07A08360BE471D54D3CAAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627531, "uuid": "a0c03da7-dcbb-488d-9d4a-ba68e4a64395", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627531, "uuid": "13e223d5-4871-4caa-bf1a-4ecf170c3bc2", "value": "393216:TCnKpwnhu3XWmrJ/GFOVXkXMCHWUjXMcuI3/PGTAI:TsKpCOmueFYXkXMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784627531, "uuid": "53a6b413-a16a-4371-ac9e-fcd2a375492a", "value": 14298975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784627531, "uuid": "3873ec66-08c1-4342-b2f7-684d60638afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784627531, "uuid": "c0b01b02-4750-44b1-8b32-2c02fea54f34", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea5d609-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593236, "uuid": "db3b70c4-509d-4e92-b3aa-77831542d880", "comment": "Malware payload (Mirai)", "value": "b48d13e472c468a22b04cb63e685da67", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593236, "uuid": "41e12a5e-bd41-4124-8b98-05f8783895ae", "comment": "Malware payload (Mirai)", "value": "4e92f1931a87c22e5544e6dae88a71ecdeb4e30251d71826df991fa3bbcf76f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593236, "uuid": "ad5b0df7-9c1f-4aa7-b449-a9b6f9f68b45", "comment": "Malware payload (Mirai)", "value": "bf1962f1c31e4994ae1d0f58b41b2be1d78034d8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593236, "uuid": "e76d98ab-0ea3-4aed-af0b-e7212a9afa0c", "comment": "Malware payload (Mirai)", "value": "9348196944aba08eabaa9f4fd4293e1ef0df2598818453eec149f3606f567df4e4525b4c471a7c3868d1e76c667cf6ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593236, "uuid": "790f838f-2bcc-4384-b0ef-4c13436cee2f", "value": "T1243183C62B9756D43B7CAE11A98AC70C634C5ED864207BC8B5CFCCB16DC05D77D09A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593236, "uuid": "c259818d-1bcd-4f9e-9127-e48c7e311d08", "value": "24:ijCWCaNIdCEKECvvCgCEACACwlChCcgC2HR:CdO5B8rTAh/lwmnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593236, "uuid": "a1b6f2b8-8814-498d-821c-c3999f573201", "value": 1870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593236, "uuid": "6cf4c1a1-9955-401d-9921-7832ca53db57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593236, "uuid": "27373064-2b14-4aa7-84cf-55faa600d7be", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18dbd8d-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613400, "uuid": "597decc0-2838-4242-8bb5-0f1d3e6d88b1", "comment": "Malware payload", "value": "a7e6a2633d3e11972419a34e6d9ea964", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613400, "uuid": "5dbf7cbd-280c-4e77-ba27-54ae9c53e2a1", "comment": "Malware payload", "value": "4f67f0d5242704c105336abf4b42b08e25afd1a26256d66f676d0164c5f3433e", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613400, "uuid": "024f3622-5e42-4c7b-9c2a-2e4805bd01cd", "comment": "Malware payload", "value": "a7fa1f3c85f2bba67c0573d8fb34b506ca19229e", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613400, "uuid": "5d043bcf-4055-497c-b136-e76d679391f1", "comment": "Malware payload", "value": "69813e485ed6d09ddb0764eabc9a6f3ac31d7aa3363c4e04a3d1f728b61e6a5ca61180647e5a5d3cd2b4fc5f0c6219d8", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613400, "uuid": "1fc0b755-8e7d-443a-8e8b-743469d4ef41", "value": "T1F8412F12215BC50E9AE74025F9968F45E91C92679400A440B1EE5DF88FF4ABCE2FCBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613400, "uuid": "ea80efbb-ee30-4e5b-85b1-485f1649bca5", "value": "48:SUiPgn5hHoc19pt1dkYZhJXM3Rffj5VoSbCVoSRtWf:8k9p1zvdkYZhJXMhTboRtWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613400, "uuid": "06bcd7d0-3262-4d7e-9362-d09a8ac0aecd", "value": 1948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613400, "uuid": "1d28caee-9c21-4c52-8529-49301782de8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613400, "uuid": "7416b405-9ca7-4343-b1f1-9943fa513397", "value": "4f67f0d5242704c105336abf4b42b08e25afd1a26256d66f676d0164c5f3433e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b8b42f-855d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784677409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677409, "uuid": "487e7427-972c-4e71-911c-194fb48da0fd", "comment": "Malware payload", "value": "84163301bc3d9ddd85644e17db5073b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677409, "uuid": "4aefff2e-9067-4b20-9de1-c2548b54847f", "comment": "Malware payload", "value": "4ff527e0d8fc36a99a491bc69a9cabeb055a4be470e22ec3da8e8bb741be9efc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677409, "uuid": "4ed031f5-bcc2-4510-88c7-1438531b19df", "comment": "Malware payload", "value": "6c699c8797e9cd9f5b7214ac79d1f8518141169e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677409, "uuid": "00c6bf12-b70f-4155-966f-5463b7df78f1", "comment": "Malware payload", "value": "758104b4703f7ebaf5771cdbf71d447c90f650805ac7b089d8bde1c573cc7d1d39660608b1033e2062768a2ca017cbf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677409, "uuid": "77a5ed7a-0ccf-4a80-960f-f4e58aea8dc9", "value": "T12AD512B98821F087C065195BB8489D24C682A9F955057F31040B97B23FFDBDE6FFA60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677409, "uuid": "c11564f9-b6c8-4bbe-ba83-bc1bff2c6ab4", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677409, "uuid": "65732fb3-3aca-4a9c-8382-68c7f9dc3f26", "value": "49152:g4D7pqqOeyEkEJxH6t685JLRxULe8G8qGtH+rRdCaN0DOS9wue5p:g4gqOeDkEbG6CJNcFJHqdCa666ve5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784677409, "uuid": "c1921217-72f7-4641-954f-99dea85c91df", "value": 2781696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784677409, "uuid": "660b73fb-6608-492d-83c0-c0db0a61a0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677409, "uuid": "9c9e43c2-7467-4681-8835-c0498352b8be", "value": "agent_windows_amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8abb5e1-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784646000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646000, "uuid": "2c238d3b-9be1-413b-9ad5-0f6144dc5a86", "comment": "Malware payload (Mirai)", "value": "b7f8b2bfb7b1e62622d217c4d52ba122", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646000, "uuid": "9a677154-ecf6-4882-9c62-5d817f6ebe00", "comment": "Malware payload (Mirai)", "value": "50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646000, "uuid": "b0641160-e922-4402-9ed4-11fb0fdc2831", "comment": "Malware payload (Mirai)", "value": "1356b1db6e1965c092cc4b28849ce7150d1ca4e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646000, "uuid": "51da94a3-a0c0-475a-a7ef-6885f818c639", "comment": "Malware payload (Mirai)", "value": "759a26c968192d27552889602880fa9c589223112d141b32caca49d0f6f9612b0a9d49f4b2a7aafafea9146c7cd65c3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646000, "uuid": "3053ba49-762c-4e2c-8fc6-faf7fd2fe778", "value": "T185116DC532906F72FC95AB2B76A6441870C795E651CF4FD458DD3DE4898DE04F443642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646000, "uuid": "89995f70-1774-469e-a6ed-cc176630f804", "value": "12:JCkp0Fi7Y00FFht0Fcd0FjT0FfDX0FcIeZ+F:ItiqaLELs3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646000, "uuid": "893ee9b6-4064-4173-a650-410a9080c299", "value": 1044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646000, "uuid": "b91e3f0e-0faf-4afc-9030-32b1cef03362", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646000, "uuid": "871c6c30-2cfd-4b74-9d19-ab155a156a88", "value": "50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e165a7-84fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784636595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636595, "uuid": "41eee197-1ed6-4d29-9634-bb5e8e100895", "comment": "Malware payload", "value": "e29029ca669f6890b76bfd3225e60087", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636595, "uuid": "54c544f4-3478-42c2-ac56-020b4fba1da3", "comment": "Malware payload", "value": "512547dbc95da7132813f4d2d624779410a862356601ed56e5f677be5bc7c3dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636595, "uuid": "9cce1029-64b2-4f73-b0cc-8ca5ed696546", "comment": "Malware payload", "value": "0b08f1f2af97e674b2866f1144e5aeec953475d3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636595, "uuid": "dc0fd66d-1f7e-4132-ac2d-44f34096e78d", "comment": "Malware payload", "value": "522476c718dd3263bc0b4bdb967f2124669ca74c3d9dad3ae4d10ee1216bfba01ce2d28cab8d9afaf8b5c66d72a84d4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636595, "uuid": "37e13c75-bdae-4195-98d3-a96c24469271", "value": "T11E54948423C0B4844B8B6B7B7A2FB5E1F55E2CDD768A584AF214FC90F478B06E9D0671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636595, "uuid": "8ab0701d-01a8-4f47-8114-634f94134a1d", "value": "6144:yElJxFiqvWjVlarqbQeuf8z7Sv9zr7S2ebIf:yE5FiJV5bQeuHt/Hrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784636595, "uuid": "cf31ff73-1902-4fb1-8661-28160e76d4c9", "value": 302020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784636595, "uuid": "f1e8b4e5-f24c-488d-8372-653dfdcd311b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636595, "uuid": "e3b6ab6a-40d1-43b2-ba54-67d66b5bca09", "value": "swift copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01774d4a-8546-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784667114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667114, "uuid": "92fdccfa-8ba5-4289-bbdd-3043b57b7ca7", "comment": "Malware payload (Mirai)", "value": "ba81c87fd2b15a7dc9e0c70c3e4c40cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667114, "uuid": "fe7e2225-0c63-477f-b400-5ef250a1586a", "comment": "Malware payload (Mirai)", "value": "522f6221c4e04ddffafba732722abba1b5000736d380bd779c67e6fe69f743e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667114, "uuid": "bedbde7c-3fcc-4a54-a407-7f8261bc4c3c", "comment": "Malware payload (Mirai)", "value": "1ff3160cbee2e440ca7c648e4f4814ee297a90a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667114, "uuid": "231abc30-044f-4d06-8bd3-694ce6baaedd", "comment": "Malware payload (Mirai)", "value": "2bd910c2faa06b7ed12ac719ea7b695de56eac1a6688194ff8476cd6e63bc259e93483ca3aac035628517d5dc9b03116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667114, "uuid": "1c0ba6ee-bb9b-4a0b-b4e4-d63a070004de", "value": "T1AD83072ABD419F05D4D526BAFF1E538933531BBCE3EE7112EE142B25278A95B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667114, "uuid": "c5c31504-f332-469a-bfb4-23ac2abf9175", "value": "1536:+4nT+Q1E/AuMUIlkvkCSd3cXqDdGgHZHR6NM+fQBzuqRll2LivtlEkZ+xXy:95EItgGYClHZHR6NM+fQBVY6tlf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667114, "uuid": "cdadcc7b-d223-4a66-b7b3-285b295cf695", "value": 83692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667114, "uuid": "bdca4463-a47e-416d-81a6-095c86652ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667114, "uuid": "2db55038-4049-4275-8eb7-ed068794b600", "value": "Qlz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b95e09-84c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784612575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612575, "uuid": "c8750719-98a6-419d-bc2f-601acabb765d", "comment": "Malware payload (Mirai)", "value": "13c8b6ae6f57bbe59f798a7647697a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612575, "uuid": "0083f8be-43cb-4cf3-ba67-31fec16ebdbc", "comment": "Malware payload (Mirai)", "value": "52c961e385e594f54b32cdcfc8819ef0e08f5bf576d33c7768486e05887bc614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612575, "uuid": "e91af18a-809d-479f-ba3d-bc956a8bb76c", "comment": "Malware payload (Mirai)", "value": "4fc0dc4f41ca5d80cd6fa14cd1ae98f6a7ba0af1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612575, "uuid": "82730757-c5b5-49ea-906e-a93ed244d811", "comment": "Malware payload (Mirai)", "value": "21a2c709428783fc95ea386b9d92decd643e8012a7badca43cae6a9cb9f96f324a3833f6424d8f6bf4a6a445e0326340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612575, "uuid": "a40ef248-9ba1-43a7-bec7-c45409293647", "value": "T102737DC5E983C4F6EC130A351176BB3799B3E53E2169DB83C3A8A525DC125C2DA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612575, "uuid": "25e74718-f9a9-4e99-85b0-b7c45a5d057b", "value": "1536:BsXS6v5iRSKtoQ5iRVVW9Z3J8h3qaccSJZB:BsXX4btoEiR69zs3sZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612575, "uuid": "edd9a5c6-3b6b-4482-809d-7b5d42f9c6a5", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612575, "uuid": "716d2948-d182-4d83-b5f3-3ad8b5b632b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612575, "uuid": "e634abb0-f082-4850-acaf-2986ef0287d8", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b302cc-851f-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784650523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650523, "uuid": "353fa38f-443a-4917-902a-38b8426156f6", "comment": "Malware payload (WannaCry)", "value": "547e4f0b604d523f716239ec9d88c822", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650523, "uuid": "adbc7def-f017-446e-b14c-6a2966907083", "comment": "Malware payload (WannaCry)", "value": "545bf734fc18a564c334aaf0894295c1e7d123bb4ff274f3ed66f2a16f3bbbab", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650523, "uuid": "a3172ded-3390-456f-a6f8-8b009f209b7f", "comment": "Malware payload (WannaCry)", "value": "d59f407cedb8ebb6d180e134900c9d03fb11a6df", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784650523, "uuid": "d06a997d-4157-4e0b-9425-73382c02fb9d", "comment": "Malware payload (WannaCry)", "value": "ad052b1d2d7d1d127a6c152c41765fcbc3c59a00de467783b0f05112847415c91ab18238a35e7b1edc3c0903a16c9d76", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650523, "uuid": "68b9e29e-dc17-4581-bbae-36781ed6288b", "value": "T1EB363368726CD1BCE10619B444B38D26E7733C6557FE5B0F879086A70E13B9BBB90B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650523, "uuid": "8aa683b1-ac84-4982-841f-87a72864dd5d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650523, "uuid": "fb171b7b-850f-4917-a74f-aef56d540771", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R:DXDqPe1Cxcxk3ZAEUadzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784650523, "uuid": "d1b27cbd-05c2-4e94-a066-e59c6031b3a6", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784650523, "uuid": "6cedab1f-3016-4c56-82a0-ed85c6593a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784650523, "uuid": "c2798ace-9e39-4dfd-96e1-da611583f560", "value": "545bf734fc18a564c334aaf0894295c1e7d123bb4ff274f3ed66f2a16f3bbbab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5d77fc-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784613336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613336, "uuid": "64711f87-1f75-4039-a282-b4ce94bc34d1", "comment": "Malware payload (AgentTesla)", "value": "feb9a8ce4a6c9bf75a6b514ef2438ced", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613336, "uuid": "5094fb49-b55a-41bc-9046-abbaddd9e8de", "comment": "Malware payload (AgentTesla)", "value": "55c8115641754b94a8ad055eecf5bf808e24de267f84d8da4b18112c40b71176", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613336, "uuid": "b70c059c-9440-4481-a7e2-d0ecc58d9a65", "comment": "Malware payload (AgentTesla)", "value": "2ff8fd59ce479b264698082c2386e9b59516acbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613336, "uuid": "9dd1f33b-c92d-402e-bf84-7d6d36ad2262", "comment": "Malware payload (AgentTesla)", "value": "eec46323332dedbf15a7a6fb058c0e60265de22ab57ad94e1b55f36349f66a80aa909639e6725c1b6b6b53182314627e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613336, "uuid": "eb17b96e-4488-4ae0-94b6-0ca8931e89f0", "value": "T1F1F53B449AE47347A49CC375890D6FDC6C9DD403BD36ADC6BAA9583C864CFB2B280B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613336, "uuid": "5bb5dc6d-feae-4def-94d5-9d0e67a38cc4", "value": "98304:4OE0Ak0bGbr46BQaQTopC5v+uvMPfn/wdd56pEOL25bbO43g/mnGU/m3S8dsw:45XzGb06BQaIopC5WC4chnWBdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613336, "uuid": "839918d3-5821-433b-b317-99cdc2a3ff4c", "value": 3591147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613336, "uuid": "f0571189-f6d1-4ff3-afbf-f48bf2996000", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613336, "uuid": "2e9cfa14-2eaa-4c67-8a63-f36981dcafb2", "value": "SWIFT C\u00d3PIA n\u00ba 53668 PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79a2cf9-8547-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784667876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667876, "uuid": "05d27abb-c0ee-411e-8a7f-222f1ca14cb0", "comment": "Malware payload", "value": "a89e0dc6a7ef9d934e3e0a9657c57cec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667876, "uuid": "bbbd7f92-bf70-4c9d-9aa1-1c49297b6c50", "comment": "Malware payload", "value": "5606abbe1c7877225704f709f95854ded5d384cbc06dc1a55230f31c26e485bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667876, "uuid": "c0eae621-22a3-44f1-b17c-8b40b14da528", "comment": "Malware payload", "value": "4c165f70ed5340ab643a114890d0682faac88900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667876, "uuid": "2c16bd49-97e8-402c-b921-e93112b004c4", "comment": "Malware payload", "value": "021af737f1f4c6006f70dea38cebae1164f03c88da6f41ea5790fcec167f5f68f60719363dbb857753ed4e4ff4d36582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667876, "uuid": "3bf940f3-e8f6-47d3-9f0c-75347320feaa", "value": "T1EBA3E81AAF611DBBDC1BDD3709E8070638CCA60771A937753538D92CBA4A90B4AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667876, "uuid": "d03aa6c0-1405-4fc1-a0f5-464a468301e7", "value": "1536:veVMSEoURBnxCLfaXD6KHALGSqMuC4AGxmVFalyZLsSEttz0sf9bEEq:gSfnxCLSX2KgLLYC4htm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667876, "uuid": "f387974f-4eb9-4f0f-b04f-9f8395e9180f", "value": 101060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667876, "uuid": "620e48ca-e447-4874-bd6a-10a5976e25e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667876, "uuid": "97f62c93-384c-4c65-8512-ec3d4a731376", "value": "K6U", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c32152-84c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Sliver)", "timestamp": 1784612228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612228, "uuid": "f3cb6dcb-8a95-48f3-9c21-0f4bf6ac3156", "comment": "Malware payload (Sliver)", "value": "22f4f1f439e0fbf006f50644b2dae994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612228, "uuid": "8a8db1e2-f602-4679-b81c-f3cede4a709f", "comment": "Malware payload (Sliver)", "value": "5666f35c1033e019aa4d31dc7c123e39777909e2833e14135f9a3f3642551059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612228, "uuid": "38f20fae-e4a1-4809-a6e8-24452a99c58c", "comment": "Malware payload (Sliver)", "value": "04bcc67646c437219fc62c561179413b40aa9fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612228, "uuid": "d89730cb-8ce5-454a-a62e-4b7c24f3dca3", "comment": "Malware payload (Sliver)", "value": "2c03c38b15ca4d656c21a718f2847c4065937c43c3448d60fbf0debf9ff20b279711e8c1a6507aea00326b5b6af93899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612228, "uuid": "b2847285-3bee-43ed-b4ce-5d4f76f216a9", "value": "T139774D47F8E11ED4C4AAC570D525815BBAB23C291B3C27EB16A0F7301F3ABD0AA76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612228, "uuid": "5da22c26-8ce3-485f-85f5-0962c781dc45", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612228, "uuid": "5406aa91-8fa5-4538-b060-81bc9dbf724f", "value": "393216:EaM7ooEJSmD8/s7GodYZY27X/l/PACmfYFf6DpDd:EN7oqECodg7X/1PABfYFfYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612228, "uuid": "5484a954-84e0-4aa8-bed5-ddd508686cb7", "value": 35782144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612228, "uuid": "025c4bbc-7cb2-4d9e-9b3c-d7eb0c88d9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612228, "uuid": "879967cb-4bef-49e8-bcfa-bfffc4f635f9", "value": "22f4f1f439e0fbf006f50644b2dae994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9167cb-84f6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784632803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632803, "uuid": "2c08ce4f-679f-404e-af45-deb029602cf1", "comment": "Malware payload", "value": "2223880c91c3339059d6c641ffd5c0e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632803, "uuid": "639be08a-2fac-418a-ba52-623a56484957", "comment": "Malware payload", "value": "56767dd22ca1e988bc1514e3f308edc3d4d4a6852da79fd8ef91b1ff1e22a8da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632803, "uuid": "aae8f660-0637-4769-98af-4e845ae7ccf0", "comment": "Malware payload", "value": "d6858d541c8bb3fbee07adc58be03f638c768f4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632803, "uuid": "39efe04d-7a56-4f52-8391-960e4f4a4b05", "comment": "Malware payload", "value": "4b7cc7d55ad0a07458f07ecd07b0e81209d5e36673d357264256762ea23439fe3f04b439320c8c6abe44c9fe1f2af3af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632803, "uuid": "4036fb12-10ce-4270-8121-de4047095a4a", "value": "T1CEB1E70297E84A2BE06A07700EF397D0B7B4E9169E67E7AF3EC4036E3C1166404637B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632803, "uuid": "b491f27f-5589-484d-966a-fa5539019adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632803, "uuid": "ad5a0776-5844-4d79-8f36-53f3c6d82d79", "value": "48:6UanYx/v+6vEnADy2ImOLeTKAdJYtQ78Yj0e2KnhpSOulOb7q8pfbNtm:aGzEnADhWKthoO0eWgbpzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784632803, "uuid": "4f5e5cbb-630e-4c4f-a33d-b6ffd46e9913", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784632803, "uuid": "85892d91-b99f-4860-90ed-ea0d10242d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632803, "uuid": "030a0719-a881-4b31-99fc-6cca108e2671", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c37598-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1784614798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614798, "uuid": "ec5bb325-a1b2-4fcc-b436-578c7f22463e", "comment": "Malware payload (Amadey)", "value": "e13e7a543d58ef7e32242308a5d05a22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614798, "uuid": "5fac40ea-d4d8-4aa4-9c4f-958062b4d2e2", "comment": "Malware payload (Amadey)", "value": "573e68608bbbf05cd7364eb791141deb3daba35b3098d23a047ac66979c75be1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614798, "uuid": "ba9aa98e-08a4-4d43-9404-395009b52df3", "comment": "Malware payload (Amadey)", "value": "351fd3e3f4dc7e8569c1efdac1f6776f0aa8e621", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614798, "uuid": "31d2a744-5e65-4969-bff5-2817fa178277", "comment": "Malware payload (Amadey)", "value": "042b91b7ae9c8fdafd1835347b941946293acdef5dc202b1082fc0ad443be885c4eef66ab3012a5d73f79a84ae3989e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614798, "uuid": "958cce89-96c4-40bb-94e4-7c3ec2ab3361", "value": "T1E5740257FBE034F9E5369A38C4A04624D772F67D1790AE6F0768425B2F262C49C3AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614798, "uuid": "d4d6fc9b-14c5-435b-9ae7-29dea88e1131", "value": "4297a474b14e3cad25d81fc08ef8b7c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614798, "uuid": "358b6898-93fd-4374-9358-3c36651c3335", "value": "6144:OVzk6qoefRnZqo5yf5vlNmwH8BmOeyXJWvT9/LRZr3V3HdZ:Ouz3yBvl8wcXovB/Lj3bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614798, "uuid": "a345e192-284a-4134-9c0f-b0dbedc256e7", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614798, "uuid": "75383b5d-5f5b-439e-846e-12e4aa9bbfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614798, "uuid": "334ae6ac-52d0-45ee-8ad5-871b38da7040", "value": "e13e7a543d58ef7e32242308a5d05a22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750e0d0a-8512-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784644974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784644974, "uuid": "36f4aa99-1260-4bb5-85a0-c9e07b723ecd", "comment": "Malware payload", "value": "05cd3835bbd922f81d7c460282defa8c", "object_relation": "md5", "Tag": [ { "name": "33-224-205-92-host-secureserver-net", "colour": "#1DCB15", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784644974, "uuid": "c4d6f224-728c-4e13-ade4-cd48b11d1445", "comment": "Malware payload", "value": "579b8d0e88983ef08a2db7ff531b66b4f71b72e86d6ef6557dcab11c145e9643", "object_relation": "sha256", "Tag": [ { "name": "33-224-205-92-host-secureserver-net", "colour": "#1DCB15", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784644974, "uuid": "a51dae24-54b6-4081-9319-dac6f05c9db1", "comment": "Malware payload", "value": "352505b1ead415b4391d7244d09f22773ee43fe5", "object_relation": "sha1", "Tag": [ { "name": "33-224-205-92-host-secureserver-net", "colour": "#1DCB15", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784644974, "uuid": "edbcf986-2d85-4e1f-b8e3-be6889aba0fd", "comment": "Malware payload", "value": "2510345085561d758c53fb01d1988154057b1407b9350dd4d78cac74e123841e2ebdefd6c8c4dfb889539c42c8d15468", "object_relation": "sha3-384", "Tag": [ { "name": "33-224-205-92-host-secureserver-net", "colour": "#1DCB15", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784644974, "uuid": "f54601fd-fa7f-4ee1-97ee-65de1a1bd909", "value": "T1EB33F9F7B280BDF9987901F48EFA8F8A11542D164579D888DC2AD5FB4F22A94ED3044F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784644974, "uuid": "16caea2b-d787-44d2-90d6-0611af116198", "value": "1536:jpGyf7WOnScGDvBoyPGGSxygAORe9ei86c0yOiK1VyRvT:j8tOnSRvBoyP9S4q6VnylT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784644974, "uuid": "8738017a-f0d7-4581-ba25-c57beace7bf2", "value": 51896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784644974, "uuid": "e445a428-13ad-4e33-97d0-6d1ee3753cc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784644974, "uuid": "4618dfa9-77d1-44fb-a24c-a5417c5b94a5", "value": "579b8d0e88983ef08a2db7ff531b66b4f71b72e86d6ef6557dcab11c145e9643.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28190a57-8497-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784592017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592017, "uuid": "04314295-ea5e-4c88-b546-f7f6d4e8c011", "comment": "Malware payload (MassLogger)", "value": "b0a9121f18db49f79524cac34f85a20c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592017, "uuid": "bd256ade-28d2-4a3f-9169-f524c1f76d5d", "comment": "Malware payload (MassLogger)", "value": "584bd68a9102cbaa179b916832ad5827c9e9d5b1af17f8570e54134c7a3db0d7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592017, "uuid": "199cd38c-f12e-4203-a766-281c19dd3410", "comment": "Malware payload (MassLogger)", "value": "4bdc6fc196cb7dbb0e5f43e5b8e4ee3d585cdf81", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592017, "uuid": "320eb01c-6cd3-401c-8011-8949e68e97d0", "comment": "Malware payload (MassLogger)", "value": "2db2f727f58f6796e0065fb11dbd4759c15d21c6f8334823454059722836413f8d1ac66eea8c99cea9de4d5baa38c4cc", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592017, "uuid": "0d9383bf-81a4-48f1-8caf-a936059ec863", "value": "T17D551F4536C0E494CBD7DB7B3A1AA0E5F63A0CD962C40A6AF3A4FB54F5E0606F991730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592017, "uuid": "65a5e3a9-569b-4972-9c8c-bd14f7142de1", "value": "12288:hsGXUInZl5Zma47QVBP6zUCgdhSlNgm07qH+A+gOZ:3UIZl5ZmhQVBP6zULhSlXW1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784592017, "uuid": "b25dff6f-b069-4d6d-bd5d-3213af0e318e", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784592017, "uuid": "46ad5b99-023e-4c40-bedf-bc07cd5a0691", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592017, "uuid": "5468ac0f-ae79-471c-bdf7-5a8e3fde94cb", "value": "nFedex_G68389B54.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b861b8a0-84f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784633061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633061, "uuid": "3c3e23bb-d56e-40ab-ab22-b4e69e21d5f2", "comment": "Malware payload (Formbook)", "value": "cfb42cd7448eb96bd2c588b5a3ff040b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633061, "uuid": "de08dee0-ae29-4398-8d23-aa452003f20b", "comment": "Malware payload (Formbook)", "value": "597c8a5c0453c7e6c9c150e5a66ebe4e311ef28cb567ce44d1430189a642a01e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633061, "uuid": "c10c9cdc-0baf-44a5-9117-09ae3c512a54", "comment": "Malware payload (Formbook)", "value": "f19bace94252784b5cfaed1553f3d1646002e1a2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784633061, "uuid": "75e419c7-4d8e-44d4-b759-b6c7e782bb24", "comment": "Malware payload (Formbook)", "value": "1697cf9840e2b49a71bd90cadfd6131bf22bf08efe1baeb0ff53c0193950240fd38a36b9f768058141e8e2688efa9129", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633061, "uuid": "a9b0499e-a2da-4055-adb8-000004a27df4", "value": "T1B3561B6233CE7E02AA05BBADA94E9D88879FC1604FA779D8D48F06CC914B4DD7D1058F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633061, "uuid": "b3a994e5-7cd2-45cf-be11-f56d5aa6f532", "value": "24576:m7Q3kwXDxU/3UdxWLh45RZ0HV6WhlDAUPxDzO2iQl1Qjl/bqKr/0HEIUzVSUTwes:m72C726", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784633061, "uuid": "7d36b119-4413-4741-94b7-158325c6eaff", "value": 6117871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784633061, "uuid": "39420d58-5cb6-4ef8-8ac4-ea9d27f3809b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784633061, "uuid": "a760e3bf-300c-42fe-9a07-abed5608c869", "value": "HSBC PAYMENT CONFIRMATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f22ebc-84c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784612822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612822, "uuid": "9a316694-6e4b-4a66-9347-4bdff5348a09", "comment": "Malware payload (PureLogsStealer)", "value": "17eee438996d227e05b969b7fd6b86ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612822, "uuid": "008b142e-5e58-4d8a-b2ed-9d29cf2a2581", "comment": "Malware payload (PureLogsStealer)", "value": "5a9ed64a27630a5a35e02d4659efab2e6485b394377a3ae7df4b556959f63fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612822, "uuid": "08b651ca-09ed-457e-abb8-ec0765e87848", "comment": "Malware payload (PureLogsStealer)", "value": "f41b74db5e7d16dc87f4b608d0310b57376fed33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612822, "uuid": "6e179977-e578-4397-8a44-a423578d1193", "comment": "Malware payload (PureLogsStealer)", "value": "8d641ac35ae6009f653e12fec04793c2d23c698838f692718c9b3f8757514e994501708c16ce0e543faa0d7e1d72989b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612822, "uuid": "b59d4253-e8e3-487f-ac3a-dbf7536fd0d4", "value": "T1A8752204BAE7ED11C2B917B149E1D03443744E5EA6A3E68B8EE9BDCB3211BE20DD1753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612822, "uuid": "40a18611-8fcc-436d-b1bd-f93854dc11f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612822, "uuid": "335d0278-b2db-4d30-b943-578e92613fd6", "value": "49152:2PvM5vH4NHPEQLjm9wHCytg/n8/WtMPl:2PvM5UPE0S2HCy6vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612822, "uuid": "80fa9104-44ee-4743-9d69-155d5169b955", "value": 1650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612822, "uuid": "67ea97ac-5297-44a5-a133-6430490874c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612822, "uuid": "0081cf28-c1e0-4360-bf4b-06c8d51dd5d6", "value": "3108369310.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bca6ee6-8559-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784675426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675426, "uuid": "ab9695e7-9597-4371-b57e-a0f3c60481c8", "comment": "Malware payload", "value": "742e2171bb80e2aeed2f74a50d018cc3", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675426, "uuid": "6b7a563a-8d3a-4b55-a31d-0a9f3562d0e1", "comment": "Malware payload", "value": "5bcc88a01ec83f5fb45d0c329e6e16e8b6e74ffbb9b59d739507244604f16b53", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675426, "uuid": "bfe1ee13-ca49-4180-b86f-17966cc3591d", "comment": "Malware payload", "value": "99d8a43baa68071ce5a0e5977b38bd346d5a87ba", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784675426, "uuid": "4ea23e01-37d6-4672-a494-32624bb92ba0", "comment": "Malware payload", "value": "81fca0eadcd8f93150bbfe48c01b79561669d127409b087bdbbc02bd1e2a035716c070b37c0ca9cfd252a098d6d76a37", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675426, "uuid": "857e435f-6771-49e7-a225-8bd5f610a63e", "value": "T172350147BA95947CC11AC034D30AA673EA32BC8A0631BDBF17E596703F66E512F1CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675426, "uuid": "980800fc-d12c-42ce-86ad-cf546f06b574", "value": "ca5fe54375b88153a623494bcd8bdfd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675426, "uuid": "dbba94d9-4774-49b7-ab3c-c7272418450c", "value": "24576:sfmr7Byb3Oghde+uNaEoJ/5rc9kPaRcpGlspXleJAYJiqFYqH:0mrtycaEoZ9cAScpyspXlezt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784675426, "uuid": "3c72c1bb-2b9f-42d8-a462-b2310f830882", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784675426, "uuid": "089f3ff2-65d3-446e-94db-8ae56d242031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784675426, "uuid": "38b3e407-f2f9-473e-93fd-73f716e9cd65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df25c327-8518-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784647729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647729, "uuid": "523dbe11-22a4-44d3-8bad-f961b0e1b8ef", "comment": "Malware payload (Mirai)", "value": "0d769a0246ddf4518b2d1ed3dc6c8750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647729, "uuid": "f64922f5-f562-4ed2-8190-ed72a8a10f48", "comment": "Malware payload (Mirai)", "value": "5cb66e406686baad686a0aefc1a722b240563d9018b8000a86adfed4137945e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647729, "uuid": "f66ab4b1-b857-47bc-bc6d-b76efe4ff2cb", "comment": "Malware payload (Mirai)", "value": "c99c78819585278350cc955b3016470ce8a967ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647729, "uuid": "fb0ada20-b016-4ff2-ab1c-cf41b2906088", "comment": "Malware payload (Mirai)", "value": "61d509bce32f91c9103d737359fc1d4f28941cbf74ce0d49d2a22f67d4e592076a2351a8add8f8db514e31fafe9a27e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647729, "uuid": "1b0876e3-b58f-4f0b-96b0-1b9b5c642fe2", "value": "T1AB243A0775C08DFBC4C68BB50BDB91328933F8291B26664BB7A8FD951F4DED86A1C604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647729, "uuid": "8d81f441-c5f8-40a2-9b50-8351f2d3ad6e", "value": "6144:6tnnzv+YCUqeslTprFTxpkvKHg+heN9KAM7pNNle:6JnjCzfkvKHg+heN9KAM7pNNle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784647729, "uuid": "96b7dcb0-2a13-4164-a726-bdcc2ca4e4f9", "value": 221204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784647729, "uuid": "9e475ae5-6b0f-4020-a51e-194be98c531c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647729, "uuid": "ff01f2e3-b187-46d9-8745-e8dc970864ad", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fc6614-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784672705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672705, "uuid": "41bd9643-44d2-4cc0-b60c-b30e3957b8ba", "comment": "Malware payload (AsyncRAT)", "value": "47e1b3a9fe7bd09242acbcbd0d515ded", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672705, "uuid": "3288bb7e-594c-4332-8a55-11ecb4b865c0", "comment": "Malware payload (AsyncRAT)", "value": "5fd493615b731c767be670d33a4e48ec89ad264bf583c2b087d7645a4727986b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672705, "uuid": "193590a3-b5b8-4bf8-a050-7d0c8fd69ba9", "comment": "Malware payload (AsyncRAT)", "value": "311cad9a898b4f64dfdeae1c5128fb81f2fb34cc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672705, "uuid": "7e6c221c-06c7-40d5-ae21-887a480e0447", "comment": "Malware payload (AsyncRAT)", "value": "95a87d71caa76af3f2018f351498fec7450e532d77d7ba403822bacc36b486963d96a673be69194c71cfbcb4adff3963", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672705, "uuid": "81d09373-efab-4edf-8354-f681b7c13545", "value": "T1C7C3E12D13A3A9F6C243C8348AE748F0BD71F8255B20997D1750DD312E16E316F997AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672705, "uuid": "b53456fc-41ea-4d19-96af-7d16dd05220d", "value": "86c440bbb7b36db9c31512e18ca8b5b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672705, "uuid": "1c378e46-19ab-4f15-8900-b88ac1a24501", "value": "3072:wFGj7BWSYC/u2S1frUxLoFnFeplfdMtJbbBkCSV:wFMHYJ1AxfytJb6NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672705, "uuid": "2090b2c2-5a4d-4673-a935-32d6aee658f8", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672705, "uuid": "2342aca6-3f49-4c0d-ba13-9a9929b603a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672705, "uuid": "9aa86715-ade4-48a8-bf1a-a6b2215be3ff", "value": "47E1B3A9FE7BD09242ACBCBD0D515DED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7ba745-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784611162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611162, "uuid": "ae8419fb-7428-4b66-9899-66b842ac0d44", "comment": "Malware payload (Gafgyt)", "value": "e629486157cd29fe4b3e4f146e297406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611162, "uuid": "9f3ab907-27a6-4cc4-bc49-0f80e5b6f65d", "comment": "Malware payload (Gafgyt)", "value": "611af2289c3a8b46585d324da8ebbdb1a8a5765d6c56f7084c670adbce4b28b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611162, "uuid": "add3e1eb-fe38-48b9-91e5-9d1be1257b68", "comment": "Malware payload (Gafgyt)", "value": "0d6fcdf21b559e4b7c29701814b8374cd8550388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611162, "uuid": "dc8f4523-5649-498e-91bc-a0571d2dfd1e", "comment": "Malware payload (Gafgyt)", "value": "d3f2e687d85587bb1ea56bab82c69e2a5f5c995fb51fbb5cab0ea51f218b4d111285f496bfcac9eca287af6e90b95bb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611162, "uuid": "30ad6b62-2bf5-40bd-b5ce-dd26e0a51af2", "value": "T1CA14B75E6E228F7EF76C873047B78A34976923D627E0D684D1ACC2115F2029E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611162, "uuid": "eee28eee-a669-4085-aa2a-0b931c305af4", "value": "3072:Oktb3i7DuZkneQnZTnXKOlcafuJbPyvEtrxbY+GPkoWw:Oktb3qSZkneQnZ22yFPpt9BGM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611162, "uuid": "07814f75-fde4-4d4d-89e5-511122364a5a", "value": 203616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611162, "uuid": "e0e58508-5445-4dfc-b22b-dc19a0f8e6b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611162, "uuid": "76a5308e-4505-4aae-9695-71efe0a2c6df", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34d143f-84f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Kimsuky)", "timestamp": 1784631415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631415, "uuid": "d4b9f007-56aa-49c8-a670-23c320bcbf69", "comment": "Malware payload (Kimsuky)", "value": "d555e46e36e34da5779145fa8ae8bed9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631415, "uuid": "b44f5385-62a6-42b2-a25c-0fec1f87cb35", "comment": "Malware payload (Kimsuky)", "value": "625f912f4bdb5df0f2584f6b162c8602e5bb756b4853b94a12b9b9dadc25b915", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631415, "uuid": "75c54135-3002-49b2-b6d5-66ff99c5ca0f", "comment": "Malware payload (Kimsuky)", "value": "5b03dd1ece961e28febcfcb582ca58edd39da526", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631415, "uuid": "76791545-1b6e-450f-8376-fa8bb3a3bdc9", "comment": "Malware payload (Kimsuky)", "value": "128b8a945a37ce5a9d1d801e2b2ef88bff9767cea7049018a4438bbeece67c7d237617b5ef51cfc216657478ff9265cc", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631415, "uuid": "e49a38f7-0a69-499d-a934-d35374866208", "value": "T14B63BF21AFEA0E48FD53CE3125F871EB483F714249E0A8590C6B4D5A4091CADE977F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631415, "uuid": "8dff2f92-09df-4ec9-ba39-3578fa333c48", "value": "1536:Q0SfF2p88+94VV8FFOvwhnpmAhi/ldSjXvU:QFfF2n+94oFovw9DhLbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784631415, "uuid": "9779fdc2-9b97-44e9-a102-a814bde713da", "value": 68502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784631415, "uuid": "713826ae-1a9e-4ff3-b929-2ffae39ba9a1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631415, "uuid": "5dfa697a-d060-4c76-8a12-e2922327ad41", "value": "\uc791\ubb3c\ubcf4\ud638\uc81c \uacf5\uae09 \uac80\ud1a0 \ud488\ubaa9 \uc81c\uc548\uc11c.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7fd205-84af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784602329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784602329, "uuid": "792546ab-56f6-48a7-847b-73f25e4e337c", "comment": "Malware payload (Efimer)", "value": "34692b5f1b71ecaa289c1c152999ad17", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784602329, "uuid": "54ca32cf-edff-486a-bc37-ba7a73d56443", "comment": "Malware payload (Efimer)", "value": "628293254de28ceb33d8905f928da292d0e31897a8825bbccaefed10536b0a9e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784602329, "uuid": "6648b2c2-f2f7-483e-9c4a-fadff669cabf", "comment": "Malware payload (Efimer)", "value": "337219a925626b7d61994a8a17905bb30e288ebd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784602329, "uuid": "cf586265-08ce-4efc-9c8b-704ac77946d2", "comment": "Malware payload (Efimer)", "value": "1b367231348b89a5709db9f7b4ad21287ceb6439c1f95e90c90e242760c7be3dc0173bd07f5082dcba10e5158cd877a1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784602329, "uuid": "c4449f15-fa92-4c71-8128-5a2171447cfb", "value": "T1FCE633281BD4527ED673007CAD9622EBD8AE74700B71C9EF0BA887659C571B14E3E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784602329, "uuid": "ae3d3c1a-f05f-406e-9c77-093f0821309f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784602329, "uuid": "d1c9a11c-a8f8-4995-81ab-57d9834c7980", "value": "393216:IaY+eHEzv5Ej3AhjoMH6uFm7UXtgxNhXMCHWUjXvcuI3/PGTAI:fYxEt23AddauFGUXtg3hXMb8XkH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784602329, "uuid": "2ba72cb8-4ff4-4f73-a8e4-0d4851481635", "value": 14265272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784602329, "uuid": "4f53fb3f-88f5-4033-8b79-624b61a5f655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784602329, "uuid": "42c51554-b679-45b9-a978-8670c127619d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714ec358-8555-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784673744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673744, "uuid": "63a445b9-d513-4090-b4ce-d4bb82aa1847", "comment": "Malware payload (Mirai)", "value": "ccae8419704f93b631f7f3db0d0e5d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673744, "uuid": "33e6700c-7c42-48d5-97db-b32df9c9326a", "comment": "Malware payload (Mirai)", "value": "62e51ed3f589dc4463b830e736a7c161e33af159fe79a338affb20caaf548735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673744, "uuid": "a93d44c6-d08a-4740-9d73-0645fe0a0d0e", "comment": "Malware payload (Mirai)", "value": "6bcd0b92ab7afdc79d7cd8dd9def63530e2d1e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673744, "uuid": "b9855c50-dff1-496e-b8a5-ea28486f9206", "comment": "Malware payload (Mirai)", "value": "fbeec72dbedd5d03f42b56d5ce8ed7e4441679be97d4bc88ac04c66ce6861aa8a65d504c075cfc45ce9d93af1fd13db6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673744, "uuid": "489bf8e8-e7f2-4db2-9fc3-e20a95bf14e7", "value": "T1EBA3E80AAF611DBBD81BDC3305AC0B0278CCA61771643B797538D528BB8A54F8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673744, "uuid": "a5b05632-833d-4d10-8929-aa91be07a994", "value": "1536:AiB3QerROySqoXT6sqQA7yZKoubeyKioFbx6oa0fvxugBE1UQyVp:L91OySqoXmXn7IEbepxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673744, "uuid": "1b72b8d4-d853-41e6-89b9-a4ee9b847c15", "value": 101204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673744, "uuid": "460f2044-7f86-44c2-80bc-21f1448bf26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673744, "uuid": "0523a5a2-2d2b-4e7f-bc33-5bfa8acb87db", "value": "6zq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148384bd-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784620331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620331, "uuid": "08eb7caa-11a8-42f3-afb2-73acc3825b86", "comment": "Malware payload (Efimer)", "value": "738a6a3d62ae8ae5d65c56540d525d4f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620331, "uuid": "5b274740-37a7-49f5-8cc1-d97a11ce361f", "comment": "Malware payload (Efimer)", "value": "62f4d71d497b2a2ff2eeb84167ff099caea661980ac57af43c4c9996d2549358", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620331, "uuid": "c5eb5ddf-60eb-455f-bdf1-84cc31915b95", "comment": "Malware payload (Efimer)", "value": "b54eec2dab57e5c408e3b94a102b1a50d2da71ca", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620331, "uuid": "bdb4bc2f-b462-4090-af1c-3b25656fb096", "comment": "Malware payload (Efimer)", "value": "4bfec5d9ddbc54a12ecb670897a2c861ce5ab706e038cded30465c4763595b868f3aae6f46a70a9d244ba0cafb27735c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620331, "uuid": "9128fe4c-bb33-4934-8773-9cd0d0df58e5", "value": "T173E6334C55C112EEF9B3863CFCA1568CD139B87A0B72C5AB4B9C87A56E6B1D00C3D61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620331, "uuid": "dba2d0ad-f0c0-4f47-9af9-bcfed8c6c86a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620331, "uuid": "9b1b8968-5e77-4c66-ad73-6bae477f8ec3", "value": "393216:NC9F9bkvjH3Zhd//c5ZuaRUYDo8ZoEXMCHWUjXacuI3/PGTAI:NykvT3ZzESmUYk8ZoEXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620331, "uuid": "598f6c0b-ddcc-477a-93d9-dec02b492230", "value": 14329721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620331, "uuid": "bcd11c79-507c-4995-ad16-c992e7ae55cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620331, "uuid": "e74682b1-4f09-4b1b-8d96-9420917bcfb0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b548fc5-84d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784617067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617067, "uuid": "7efe843f-72ca-44f4-9e41-c2963740f0c4", "comment": "Malware payload (Mirai)", "value": "7abd9153efa56caf57cc234d4dee1110", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617067, "uuid": "8e24b4fe-d097-49f9-8328-cf6704c16609", "comment": "Malware payload (Mirai)", "value": "63952f1d3a85ae646317fd592027e258e1dbbba8c7bd4822e2551b9f0a4f8315", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617067, "uuid": "816f0acc-6a37-4af2-a0a3-876a13043348", "comment": "Malware payload (Mirai)", "value": "8f31c52ef670372a01f6ad5bf41bf8369284f8f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617067, "uuid": "67a45bb8-7926-45d3-af9d-cda6e1ec07fa", "comment": "Malware payload (Mirai)", "value": "cfdeb820dd109620b860e97d084d260cf9e7df19f477cf69525c5c61233520fc09d4ae37f443e55597a446eabbe3c5c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617067, "uuid": "1c2164a2-05cc-43cf-9a33-ef9001d3f18b", "value": "T1750144CD41539A308E83CCE7B5638A7890C1EDC46B924F9CFDCE56B1518C9D4F461E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617067, "uuid": "5c6db358-d6a6-4c30-bac6-27e877a031cf", "value": "12:my+KWK4GqQEeVfEe53vEe7mEePEeAvEeL:mjbHiEqEYE8mE8E7vEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784617067, "uuid": "8e5d0135-f318-4a0a-9583-10a645c239e5", "value": 691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784617067, "uuid": "7f0dce34-a759-42f5-8088-efb7b0655860", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617067, "uuid": "90bf1f70-0a7d-4949-8f93-254443fa3d0d", "value": "twget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2d9af1-8502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638116, "uuid": "3a917c19-037b-443b-a090-5a675b7026e7", "comment": "Malware payload", "value": "c0bf6af926c2fe4e7371318fc377b33d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638116, "uuid": "db34ef93-d7cc-41d1-90ea-838779c12f21", "comment": "Malware payload", "value": "647b468259bfe966445ccd0275a64dbc5a78908fe231331193bffb020e3719f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638116, "uuid": "9c7680a9-08e0-43ae-9189-e66f5df0ec14", "comment": "Malware payload", "value": "c2b36aed08c93b773e57c8547c2bcfbe80629038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638116, "uuid": "e9c7fbb1-e548-43c9-8f38-357749fa3d9d", "comment": "Malware payload", "value": "9b762b03e584a371c045ceab7eb7105d054a38a2d0c652be1bcdfcf5aeeebcc98be5b932b6a36d91610fb45c95e33f58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638116, "uuid": "7677896d-3952-4267-a282-34cad2ef5347", "value": "T1E9457C5AB2F370FCD067C030439BDB62A835F46911222E7B65C4DA352D66EB01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638116, "uuid": "569dbe9b-2c0d-486b-acc9-bc6e8a99ad8a", "value": "24576:AbKFkD/1EHPPxRkUNWZOETDQ9MX++TYQ:uLD/1EvPxmUNWZOETDQ2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638116, "uuid": "1fd452c6-1022-4ad9-b803-af2cbbb0042e", "value": 1169352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638116, "uuid": "97f895c1-4fab-40e2-9d78-2b44accd1880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638116, "uuid": "5b0aedeb-cd7e-49ac-830d-2dcdf964d4a5", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01da8d84-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593241, "uuid": "c530b8e5-2a55-4613-aaf3-102bbb5b4eca", "comment": "Malware payload (Mirai)", "value": "ef3bb4565b24327d3cab1d043736f1d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593241, "uuid": "e116cb92-07d6-47f7-8e9d-abfa995c281c", "comment": "Malware payload (Mirai)", "value": "6497eed5be632771c4022363b485c448a55912ca75d08ba5213581b4811f7e43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593241, "uuid": "d79264c9-6321-4930-bd15-63d5ea4dd018", "comment": "Malware payload (Mirai)", "value": "f5cc56c6f5a538a08b19b5d10bfd10916056374f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593241, "uuid": "d66021bf-2a80-4b28-9762-53f71b002952", "comment": "Malware payload (Mirai)", "value": "9cdcbbbcde23922e8c2b5c86ae4909dbf6a58fc5979ba270791189896cccabaeb15706e462ecafb7d243dc991eeb044a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593241, "uuid": "b5058527-03d2-4b1f-9d86-2a896c465f84", "value": "T1B7934A25687A2E17C8D4A23E11F78752F2F5370E24B0C66E7D760F8EFF15680A5462B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593241, "uuid": "3da84634-4070-4e97-913a-ef64bb2756b9", "value": "1536:1KFdSaiZ2vPhnKORFS5P+lSMrhJ3HWwJnV6WO7HauvAx8:WNrZKl1NM9J32wJnV6WO7DvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593241, "uuid": "80512d7f-5504-4b0a-998c-8389b4427835", "value": 92664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593241, "uuid": "39ecc7b4-d413-434d-8e73-1beed535982a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593241, "uuid": "fde1eb4a-877d-4fa1-8f1c-d6dce67fb71a", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10421066-8548-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784667998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667998, "uuid": "68ebb376-803a-4a1a-b564-7f5b59d25996", "comment": "Malware payload (Mirai)", "value": "a9eaf56040489437d2e8460d3563ca11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667998, "uuid": "8cc38f1a-e37b-4e8d-b63b-aee75ceeda08", "comment": "Malware payload (Mirai)", "value": "65600a05592216cdef98173f4202b141dec19b2955e59dc518b2efc46f5969fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667998, "uuid": "9edf1809-7c15-499b-80f4-a703b7d66c6e", "comment": "Malware payload (Mirai)", "value": "a8cea764ae279f4ec291eb523fd42532adf2a293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667998, "uuid": "0592b14b-966d-43b5-bae5-ef83b07575f4", "comment": "Malware payload (Mirai)", "value": "1c34526341cb8aaea24a2f42fd22af5ccebf114d3ada743c44e1e73b41339112db35d2cbb6bd8ae741a29412af2e4761", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667998, "uuid": "2e95667e-767d-47c5-b3b1-32a0e39c8fd1", "value": "T1BD83096ABD809F05D4D526BAFF1E538933535BBCE3EE7112DE142B25278A91B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667998, "uuid": "1a4e33db-9f09-4c2c-9a84-8dc21d76bc4b", "value": "1536:4SnJNQaEmXBaYUIlkvkCod3cZqDdGgp6Hj8Nq4x+7juqxlla+iNqzHkZUc:jBEgBNgcOClp6Hj8Nq4x+7dENqzsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667998, "uuid": "2099a1d6-5ead-4419-a6bf-788491c4e39a", "value": 84156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667998, "uuid": "a92b70a7-441d-4b80-b5a8-69c1885a90d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667998, "uuid": "164ccc5d-e70a-456f-b4e2-31cecf6ddec4", "value": "Z31w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1abe67-84b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784605928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605928, "uuid": "fa268725-15a8-44b9-b0c1-de5bd84d27a6", "comment": "Malware payload (Efimer)", "value": "ee2b57565c612eb5153a90e16d2e4bdc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605928, "uuid": "eba7bc78-b93e-4433-9b02-18472592adb9", "comment": "Malware payload (Efimer)", "value": "65dc2da8e1dc43bcbe782754a06f03f144b490781f94ff07c37a12e0e66e6844", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605928, "uuid": "e5409ad2-4d3a-4857-8608-c6c14c27c6b2", "comment": "Malware payload (Efimer)", "value": "8da1744012c8ff14697a804f58b7a7eac43e18ae", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605928, "uuid": "b69d64da-9fd7-4b35-b4f9-5592c6f4eb8a", "comment": "Malware payload (Efimer)", "value": "b3b36174069b0e5a1f636005bfdd7df2ddadd4d08c944b5dbcca5cf3fb681a96ad693e71f9d8ad96bd1f227e696cd22e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605928, "uuid": "501c077f-872a-48d8-87f5-ba9c131be4c0", "value": "T1EAE63308FAE022FFE477013DED515B999999B822AB35C5DF13B487316D971F08A39223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605928, "uuid": "8437c844-5172-4809-b78c-5da239f8c4dc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605928, "uuid": "f98789f6-cd53-4541-bd96-a77c2977d337", "value": "393216:2z1Czkz/uEdht3XyuF/iIY8fw3Qt8p4VXMCHWUjX5cuI3/PGTAI:2IzkzvnyuFI8V8IXMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784605928, "uuid": "b36212ab-6d2e-4bab-b57a-168355a0fb59", "value": 14298487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784605928, "uuid": "41d4a861-3c1f-42cd-be71-423f1a366421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605928, "uuid": "301642fb-7e0c-428f-aff5-6a0e5e4ac05c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b393439-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615269, "uuid": "4f6fa490-dd61-4228-88d5-6f8fd0e0172d", "comment": "Malware payload (PhantomStealer)", "value": "0d8c2d896f3a6bc8c9de054d0d9fe998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615269, "uuid": "d6523463-11f1-4949-943c-dc25ef2a6628", "comment": "Malware payload (PhantomStealer)", "value": "68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615269, "uuid": "e4d3c7dc-eb7b-4862-9f12-4473d5280af6", "comment": "Malware payload (PhantomStealer)", "value": "82e531868171dc4834ed68d547732b9c9586fa27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615269, "uuid": "5f1d3f28-a268-4f6a-ac3e-e887f2f944df", "comment": "Malware payload (PhantomStealer)", "value": "e41502a3d839560392ec7c275db1ff90e9485f7201348bb5a86700a54ffa5fa54c435b3c4f666377762cc31098d62404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615269, "uuid": "515dafca-1b37-4582-9acf-11c341999566", "value": "T130F47C24B3F409A4F1FF9B75D4B18522CA71B84B9A34CB8F1598829E0E337919D74B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615269, "uuid": "f3a27bea-a4aa-4b7c-b136-08bdb2df39c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615269, "uuid": "9058b9c8-44eb-4984-86ae-0bed885515cc", "value": "12288:p9CTvBAyx0Mpky3OzQdyBxjbCFroh3l+C6E0+:p9CrOMky3OzQdyXbCFQl+CN0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615269, "uuid": "cff93a3a-6748-4308-877d-85dd65a33fa2", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615269, "uuid": "b93aef64-bf4a-4fee-8bc6-71b6d2674732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615269, "uuid": "675c7cc4-5e34-4d47-8bdc-d2149361ccd5", "value": "68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0d2836-8540-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784664875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664875, "uuid": "3c62a9bb-fbfa-4501-9436-9d5b775785b8", "comment": "Malware payload (Mirai)", "value": "6c43cff623cec4b02e503a0fcbddbe70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664875, "uuid": "397af3b5-221b-454c-9fed-3b713c9ac93f", "comment": "Malware payload (Mirai)", "value": "692757b81ed8e5c17634d5c95e91d6201a9329e232281e8eda98d502ea821837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664875, "uuid": "af4dbeb0-2c22-457e-8a0c-d812af1802d8", "comment": "Malware payload (Mirai)", "value": "7bd96d8f6a8720ebb3eaae6a4fe43a26494e4af4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664875, "uuid": "97aa6b82-0afa-452e-beb7-77433d916f4f", "comment": "Malware payload (Mirai)", "value": "a71973482941f3433cb5757e9261a03a98528e42383df5ff8b2497f6d5e3d83630ec676cf5c419d8775f2dddd9a710b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664875, "uuid": "59fdc0ac-2109-470f-8164-80307dfb3b71", "value": "T166A3FB1AAF611DBBD81BDD3305AC070235CCA60772693B793534D528FB8A54B8AD3CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664875, "uuid": "0b951af1-70b5-4cfa-894c-d2159d4dd93e", "value": "1536:zKARGLVAMtCde3xXi60QAzVm7qauTKN810g5lU02kxXBgz04EoN7:cL+ywe3xXD0nzVyioYxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784664875, "uuid": "b88b8751-91ce-4e6e-914f-fedf0c31468e", "value": 101156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784664875, "uuid": "03993e11-106e-4ee6-ba80-5044197cd626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664875, "uuid": "a27cb3ed-d765-4e24-b70b-12972887e999", "value": "KXV", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a39a4d-84ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784636971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636971, "uuid": "9d0ca800-4ca6-4f59-8b1e-621f23bf15ad", "comment": "Malware payload", "value": "009c17e5d8e3eddea894ff5e6462bcef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636971, "uuid": "cc7657a1-667d-4f81-bf58-ce79f519700f", "comment": "Malware payload", "value": "6996186506d78d9d7fc9a48185faad6e3b188e05ca664bf9481b8429c0f593e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636971, "uuid": "3c373c44-5691-47a9-8cb4-303aced82647", "comment": "Malware payload", "value": "acca524fc9ca774765e5c3fb76a3ebba2bf8c993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636971, "uuid": "fbf2e95c-e6ac-4366-bd18-6fab603db690", "comment": "Malware payload", "value": "1a18134122dd08fff18ff8aafc111506dff7bb6aeb0635c873ec6fffb3c58b73114ed2ed952068e89b866733ac19392a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636971, "uuid": "45f44168-6910-4389-8c81-0ae24ca846bb", "value": "T104D3F702B70D4E43D1633DF0277B2BE093DBFD5228A4A680752EBEC992719B22545EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636971, "uuid": "537ae950-c321-4f67-b8c7-ec744b8f4a02", "value": "1536:NRI002K8o5DqJ4v3Y2TxIPiHAzxtVto0XKT4/aOxno/VvAcV9Enq5SCRBxZq8gpk:NRI0cD1g2TxXH6do0XC4/ahKcDWpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784636971, "uuid": "9ad71c08-543e-44ff-a0fc-9dccb5a28192", "value": 135072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784636971, "uuid": "ca4d4050-2229-4c83-84cc-3a89c09c0bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636971, "uuid": "73d8762e-e04b-4c90-a518-377f3cfca0ea", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a663f25-850c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784642299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642299, "uuid": "17205150-425b-4e99-b8e6-fc61d1954a65", "comment": "Malware payload", "value": "a5616ae3c253f0d93f66085969499efa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl-shell-teal-vercel-app", "colour": "#78DFD9", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642299, "uuid": "2767ddc1-de50-4bcb-a4b0-e3e76cd30847", "comment": "Malware payload", "value": "6c469190922ed04804ba7561a8f61b90448432098b756eb2e4d31e884f81399d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl-shell-teal-vercel-app", "colour": "#78DFD9", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642299, "uuid": "dd934240-c79c-4889-9cca-6ed6ddb05327", "comment": "Malware payload", "value": "9c016a65ac1337488bb55e76c15e3bf21fb65a25", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl-shell-teal-vercel-app", "colour": "#78DFD9", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642299, "uuid": "96d893b8-2e1c-464a-b595-dbff36add470", "comment": "Malware payload", "value": "7477a0563c1518c1c938cd682bdeeff19ef2ed6d6beabaa199a6b8c8a27479358cec04b5805d30259528c60857b63a64", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "curl-shell-teal-vercel-app", "colour": "#78DFD9", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642299, "uuid": "d5e0d60d-3e93-472c-b442-e902b2f47138", "value": "T16A7164062D991273299EC97EAC4450C2F34786AF0E8C6DE5346CE4993F1C8D14EFD2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642299, "uuid": "337203f6-38d0-4776-8912-253c548a335a", "value": "48:icDeD/4aBqygepfBGm+hOBO0OyO6aCEYigByTPnXXKI9f6i+ARedYkVA:icD3aBqy/pfBLcOBO0O9CESByzPth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784642299, "uuid": "9c6e6d0c-1ddb-4175-9568-3934bc8156e7", "value": 3694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784642299, "uuid": "e44b2d14-fe36-4b01-8e05-a60116ab6ee0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642299, "uuid": "2c81d341-7cdd-4002-b9ac-264130f579ee", "value": "windows", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053295b6-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784613433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613433, "uuid": "7453f690-8842-4a0c-9f76-0f1ecb7ca570", "comment": "Malware payload (PhantomStealer)", "value": "051581ff6c5a94b86269983bf268e426", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613433, "uuid": "ecb1c4d0-e401-4160-90ec-9f675106aeb7", "comment": "Malware payload (PhantomStealer)", "value": "6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613433, "uuid": "b12d1d74-0ebb-43f4-8186-70e1de323514", "comment": "Malware payload (PhantomStealer)", "value": "9e8bea470528f45eb9a2c97a935364ccf2b0f884", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613433, "uuid": "c6f3d0b1-94f0-4387-9d1d-4ae025b13c8d", "comment": "Malware payload (PhantomStealer)", "value": "b19419113d579015ec9d251673735344d32450f2187223883267ea7ecbf326a9089138e99525d4efb863fa006a1c92cc", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613433, "uuid": "fbaf2bfb-7619-4f64-ad47-5ec5071c5ea9", "value": "T1B43165317063869C5F8F40567DA99A84D82851974008EC20FECF56F4AFC9738D7BB6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613433, "uuid": "087e00e5-371c-4fba-8935-b6ae9c6a02d9", "value": "24:PEU6iR9NIgCSxfiQzNb4Z/1Z0kPLw1QZSdhs2UKC2U2xJ3oifgSczjICm:P5vZh5iQzNo1uL1QZSdhsx3ukjBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613433, "uuid": "916b4a55-0ff2-4ed7-8e66-fb23eff68b5f", "value": 1638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613433, "uuid": "e6cebcad-8655-41b2-965b-af03b052ec93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613433, "uuid": "5ff5760f-e2db-46e5-ad96-51c41c2f7a52", "value": "6d6e02dc790807383c54cca2cc0fbf1e9ff785c3557d903fc3be5197d01eeb8f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36fc06c-853a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784662339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662339, "uuid": "3678b69b-00cd-490e-b7b9-b3b27fcd3d91", "comment": "Malware payload", "value": "151c86f4e9b8987763745d411a1b8892", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662339, "uuid": "9d355d20-cd78-4804-a2cf-d3f4fe0d3ad8", "comment": "Malware payload", "value": "6dba2863b6bed92250804e7e550cd2c99ead12a76ce7757faf4d7a9587652ecb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662339, "uuid": "37143f2b-194f-4a5c-804b-8384104a2955", "comment": "Malware payload", "value": "0da3b3abcf308af94a3837632d8ed6efb38d1e13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662339, "uuid": "9aaea702-04f1-47fc-9f87-95727fd1d825", "comment": "Malware payload", "value": "bf3c4cd4c19b84e90655804d799a8ac388fab593dfe01df654da9f20c7ffab2eeb02dfe316c7647c97732668c2f15e2b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662339, "uuid": "432485db-2413-45c1-bce2-8df87265d067", "value": "T119236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662339, "uuid": "af61001b-fb02-4941-90b1-b62b9a8d99e3", "value": "768:Yr9NyXsZztCw9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:GHusZQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784662339, "uuid": "914664cc-b988-4429-81ef-7403d0f47770", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784662339, "uuid": "41227ae4-8de2-4148-8585-4fddf5fcaa0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662339, "uuid": "58338fdc-46cf-4174-bc05-9b90c361826c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57922aa5-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784614860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614860, "uuid": "43ee2432-2701-4fc4-9778-66b0554ae61a", "comment": "Malware payload", "value": "93e0bd85c3d869bc2e72cbd6d6b904e1", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614860, "uuid": "6cb61fa8-e257-4e0b-b951-6ab67d0cfabe", "comment": "Malware payload", "value": "6e737f6b3c022b310bba23af89fb85e29f40e009f803ac95811648c757f07ee0", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614860, "uuid": "a44de911-9d6b-4aba-9d34-ea13a3b2851a", "comment": "Malware payload", "value": "32e3cdad0434965e54ee00a3991741702881394b", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614860, "uuid": "7a7b8891-7835-4275-893d-6ae044ab288b", "comment": "Malware payload", "value": "4dcef9297edf7d591723cbb9377ab86f5dcb47c0a226e8a98a94e5f89387639954d1a4d0b1ea13a7f14c8757837c6d29", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614860, "uuid": "f23d2592-9f34-4e5b-ba3e-7b3309287825", "value": "T170256CFB13179E8F9A1E1E50F4080349EC7CEC9B61DC81F9AF468DA649B545888B4E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614860, "uuid": "1684e9a6-96d2-4086-9670-2dba4c922486", "value": "24576:jKulHLKcdLhWtuUYx6OM4ojEdWn/LoyFHzVczi21xP4HW:+G0hOM4ojEdW/dzN2xP42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614860, "uuid": "7ebecaae-67c6-4d40-ac1c-7133a0d0c8e3", "value": 1019482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614860, "uuid": "c90c3a6b-1232-4e51-a964-922c4a3b14d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614860, "uuid": "22e4f5e6-bd85-4d19-b004-38d5d9850ed9", "value": "6e737f6b3c022b310bba23af89fb85e29f40e009f803ac95811648c757f07ee0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9d37ed-8541-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784664982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664982, "uuid": "df14f094-f0a9-4390-9d26-4200530f58e4", "comment": "Malware payload", "value": "4665b8ab81ab6fc0de7e431d930224be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664982, "uuid": "07f97c05-4594-482d-812b-ce6be83bc003", "comment": "Malware payload", "value": "6e94135ab277c29528467561e79cbacf505d6fe36808757b88a6449950614e64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664982, "uuid": "c55b878d-917e-43fb-972d-924a7065d592", "comment": "Malware payload", "value": "d5c837081b0f5cdd42440d48079fa85e1221e43a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664982, "uuid": "02e90a64-d954-4350-ae30-007e31c81c56", "comment": "Malware payload", "value": "ed2024bdabfbbdf64221673d7f8c055e8331999db4b967355367b5accd068ae09c15ac8daefa18ab2d43f3988f33638c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664982, "uuid": "7d58d43b-c29f-4fb2-896d-3d26a4bd63cc", "value": "T1C8630976B9819B16C5C52277FF2D8388331723B8E3EE7113EA156F6537CB52A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664982, "uuid": "120f93a1-cca1-491e-a6ba-56507847af3f", "value": "1536:yfjOrmV6Lyw1zAyKsY6JNPSbAb1SPA/S7n8WPpZc7oMlLFG1UnzxsF:yfjOrm0yI8o1Nu+1So/SD8ITjMlLFG1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784664982, "uuid": "1cac3550-e643-4bf0-a173-8ac88291c676", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784664982, "uuid": "50a0c5bf-53aa-4033-9531-44e28ec0154d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664982, "uuid": "457bcc7d-1fbb-4eb4-bfd7-33c36c5e1a4f", "value": "ssJw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b63541-853a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784662235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662235, "uuid": "cfa9f206-9d71-437c-bef6-285cb2b78b3a", "comment": "Malware payload", "value": "fb70a4163c08089a6518e9947a93ff8e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662235, "uuid": "414e874f-1299-4c6a-9e8f-2e5127819bff", "comment": "Malware payload", "value": "6ebfabcd22e55264ba426eb848e2b6e9f3def9df184ffc2724c5d585c54269cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662235, "uuid": "3c115301-8511-4127-a5ed-68e1f81d7cf8", "comment": "Malware payload", "value": "38a235b1ac98c88fd9c5a9ace037c515b10f7640", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662235, "uuid": "26b4b832-3bae-4c00-a6e5-1637f2c5bb56", "comment": "Malware payload", "value": "9152f0dfea2de2a2913ff5763723fe3d9a6ab5484926ace61167d3effbfb692801174ca428a7797c46fa28b68ea71db9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662235, "uuid": "ffe44712-e251-43d9-bb7c-c45d1587d123", "value": "T194C28D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662235, "uuid": "698c620c-647d-40d4-b753-c82374c20cb0", "value": "768:Y8vCB+25j6es8Rnqd9FYpMSUpi+20qUpi+20YQX:Y8l25JqLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784662235, "uuid": "23669330-7f70-42f1-85c8-1cd89f58426c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784662235, "uuid": "85b8fc88-8c6c-4141-b953-f1af4a2ec9cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662235, "uuid": "a986290b-b8ab-4384-8463-dcce55999455", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507637aa-8503-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638470, "uuid": "267be78c-dfeb-44fd-ba81-da664a9d4756", "comment": "Malware payload", "value": "744cfff3b8162191f9b24866ee172757", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638470, "uuid": "77edc22c-e820-4746-8718-7265f33472c1", "comment": "Malware payload", "value": "6ec47a67ccca5c2254f8034bc6f7ddbdd299097de2028f637f24fbeb8879674f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638470, "uuid": "4f1bf7cf-9bc3-4907-91a9-9e334014849e", "comment": "Malware payload", "value": "fc8ae58937a1b2847130bed7348e8349dcfbf6ca", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638470, "uuid": "ae075c45-4843-4f98-bec4-4a23027add51", "comment": "Malware payload", "value": "fb13ec0d38cfceb6c588619156d9c057ef304ea2df52f2ba3b04e1e42a0d2349ced0cfa8765dac30a3eb81717b67789b", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638470, "uuid": "229f5276-ab7e-4feb-a12d-52876bafa214", "value": "T1B3B5BE14E3E901B9D57BDA34CA569233D7B078965730A58F0699C3462F73EA09B3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638470, "uuid": "600d2766-3187-400d-bfe3-4695528e0d88", "value": "bc3dc3de1f0cff256fd0a8f89b497b53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638470, "uuid": "cc405a44-5c96-45b5-82d7-8b03b96c6078", "value": "49152:iWbFk2an44/Jt+LPl7an3fwv3d8Nsh1F1jdGunPQTUPX:9j7V3vhDPQTUPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638470, "uuid": "52eda881-b092-4877-b0f0-193e82104c74", "value": 2468864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638470, "uuid": "b61af00b-1687-4d6a-b068-580572663c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638470, "uuid": "8c1df89d-07a9-4dce-89e7-dd0e4b6dd55f", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f41c25-84c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784610017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610017, "uuid": "eacdb598-91fb-489b-9122-97dbc544e025", "comment": "Malware payload", "value": "34aed639852364552418799d4be6f87a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610017, "uuid": "a23a9532-d11b-48ab-a50e-b3fc10591064", "comment": "Malware payload", "value": "6fedd7ebd8d2d2866bab86049f61c8800816d2dec34ac1456dc7d1c183785d6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610017, "uuid": "b5e51005-d61c-4d49-9d89-afb1376ce7e9", "comment": "Malware payload", "value": "c93ba2a69c9ab6d478f0e4d92bc705247820720e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610017, "uuid": "47eb383a-dbb7-4652-ba2b-128f59d32b06", "comment": "Malware payload", "value": "c0ac3477fe9f303061040aac4e7274317367d2ba2d5c15cd4051bf3fa7a6a5bb517ef0b91586a684c3de5740dec055af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610017, "uuid": "288d7b87-5bd0-4390-8e39-cd434563f97f", "value": "T137E68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610017, "uuid": "40ed3278-b919-4420-a438-b9d2b0df6b40", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQk:cqYUQuVDt0TZEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784610017, "uuid": "383a4700-bba7-4969-a0da-4a6931471e6d", "value": 14024704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784610017, "uuid": "f13f2f32-8934-4281-a228-4797788636d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610017, "uuid": "34e0136f-d40d-4560-bf5e-3f7ca84e879a", "value": "6fedd7ebd8d2d2866bab86049f61c8800816d2dec34ac1456dc7d1c183785d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fe6cb7-84ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784629512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629512, "uuid": "6479cc07-457c-4c82-9ccd-1214eb77e592", "comment": "Malware payload", "value": "20623d16298db1789cd0320aded1e2bc", "object_relation": "md5", "Tag": [ { "name": "attackclient", "colour": "#E20656", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "launcher", "colour": "#82D700", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629512, "uuid": "4f952ebb-fcd2-4b02-96f7-404a30b09824", "comment": "Malware payload", "value": "7000f235cc7f2b035646fe2e989a4a3b80befce04bb14ec0224818df62b32b5f", "object_relation": "sha256", "Tag": [ { "name": "attackclient", "colour": "#E20656", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "launcher", "colour": "#82D700", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629512, "uuid": "118ab6f9-684f-4b0c-87f7-280ed31b9b5d", "comment": "Malware payload", "value": "e5685e3fec5bf08180f04f581e0647d09b52af8f", "object_relation": "sha1", "Tag": [ { "name": "attackclient", "colour": "#E20656", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "launcher", "colour": "#82D700", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629512, "uuid": "5a8b6f0b-b5f7-4313-8759-24c1dc0529e0", "comment": "Malware payload", "value": "76b10799e1ea0b2cfda0e6ae77a6a377e9171b2980c5441af3185e3354ece681368d24a3dead4a7b4f52d134a76bea41", "object_relation": "sha3-384", "Tag": [ { "name": "attackclient", "colour": "#E20656", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "launcher", "colour": "#82D700", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629512, "uuid": "20d30b0c-0702-4ce6-99f8-e7228b027e95", "value": "T1CBF5124A69D700B2D4A7CF34EC35310AE9BCEFA844168236135972DC6473B2E68AF7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629512, "uuid": "1faef5aa-41a2-4bf1-97df-9d803b4d9d01", "value": "1f3f8c789c301c932b0a390350ccbaa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629512, "uuid": "5d19936d-10ed-459c-9622-2773315de4ad", "value": "98304:557uecMYq77nQRxdNXZVC3A95gQZui51AVNs:557h7jYNX7C3AsyuuAVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784629512, "uuid": "50fa1d50-2bff-44f6-aec7-8946930100ef", "value": 3622912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784629512, "uuid": "8e4fac9e-03f6-413f-a5ad-115d70d29696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629512, "uuid": "b37bc490-6ebf-40a5-8801-d92e1a77135f", "value": "AttackClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc39669b-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593232, "uuid": "2dd3469c-9c7c-4192-9b57-c0815d567954", "comment": "Malware payload (Mirai)", "value": "17b2434e4236d50867f2074ac2a8cc28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593232, "uuid": "b3c29218-8997-4ab2-ab1b-719e7b2ee4db", "comment": "Malware payload (Mirai)", "value": "7011eceba8cf057f0103c1d44515be4211c1a56da468ac2ee3e0c12719c555b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593232, "uuid": "998ce51a-ee5c-4b33-9341-2689c535d3a5", "comment": "Malware payload (Mirai)", "value": "e232fa3662504aa60d19e6f5a7b6bb5779c94000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593232, "uuid": "bf2b2afa-d6c6-4517-8013-bca3226225be", "comment": "Malware payload (Mirai)", "value": "7c8d103c83e4a5ab2f0d783979d0c38fd0b8d42f1c4ca80f0dcb8b45002ebb5ac7d7a14f3aa9b6a8288e9b99af19a4a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593232, "uuid": "d0412bac-1b98-453d-b87b-547edcd079f9", "value": "T1F8B3950E6E319F7DFBAC823857B78B119209379626E1D584D09CED025E7038E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593232, "uuid": "f30fa5eb-d274-4e5c-8e65-8e34641052f3", "value": "3072:er3x+xpNAsh+JySL/BjtfLdkPlx8eNEGwR:ex+xpCshOyS/LdkPlx8YwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593232, "uuid": "a85ef798-d378-48c3-bbc6-506715062688", "value": 112980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593232, "uuid": "65f77590-e8fd-4956-8314-71fef067b92a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593232, "uuid": "e526a21d-a952-4b74-bc30-a32ed3986201", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd04356-8543-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784666140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666140, "uuid": "6fd4df70-c1c1-4e96-82d3-fca1e80d14bc", "comment": "Malware payload (Mirai)", "value": "a5abac9febd4263d94af3e174a75f933", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666140, "uuid": "234505e5-b04d-4835-9881-2d7b0a269211", "comment": "Malware payload (Mirai)", "value": "70e4229a67b7459a9e361ac0e855130902239517766b2d0001277eb8d62d5a85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666140, "uuid": "fd1b961c-ab7f-467f-bdb2-ded64d0cc414", "comment": "Malware payload (Mirai)", "value": "e334f0aebb9463e5bad266975cfe7c6b137d2a02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666140, "uuid": "fcfd9903-5512-4586-b4db-fdbd12b12724", "comment": "Malware payload (Mirai)", "value": "13fd97fa56ba6b8ec43b0e9c86c39755f8c75ddd615f7659674fc6c04f4bf7e768859a8dd48e8dc5d2391b2f8b378c63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666140, "uuid": "b74c02ef-c5d0-4937-9623-30838da8cf7e", "value": "T1CEA3E91ABF611EBBD81BDD3705AC070234CCA617726837793534D928BB8A54B8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666140, "uuid": "e3895ee8-5213-4f26-a65e-8afdaf51d100", "value": "1536:AKcmxw2l0btQnXRXC60QAz1J7qau3+4uVfRZFU02ExCg2f5kybC0iP:lAhQnXRXj0nz1FiOBx+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784666140, "uuid": "ed688179-6c66-46e0-86f8-c6106c2667b8", "value": 101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784666140, "uuid": "238afa2f-b906-4d2d-853b-4c6996581c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666140, "uuid": "bf8eba5e-a595-4126-aeeb-07a6b183ba3d", "value": "hXz8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1d6b91-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611108, "uuid": "6dc8f493-43f3-452f-b43e-b2ac9790cd67", "comment": "Malware payload (Mirai)", "value": "00e4fa176ec8e8b36c4ededfbb9b87ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611108, "uuid": "7694d050-7f9c-4e59-9dcb-b48afba9de18", "comment": "Malware payload (Mirai)", "value": "70fe647e54eccc83e7b33a1b9433fc21a2cd89ac5734d29c55f8f262f6f67451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611108, "uuid": "74251dba-3ae5-473e-bcc4-3f16dd828325", "comment": "Malware payload (Mirai)", "value": "f43c19d6c3cc65124583a0ab476cbb06fb3d24f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611108, "uuid": "277d4278-8ff2-4129-9b7d-70c0849d53d8", "comment": "Malware payload (Mirai)", "value": "aa9f7f0a442a365f3e79fa1607a91ca152485baf524fb094c365a5f3617620300331d467136e7054a02de66ba3a9b6d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611108, "uuid": "a1d2c582-1d6d-4446-ae0f-1b81e9f745fd", "value": "T1814302A0C09C5561D2E05DF1ED7C9A839E587A29DA4B2E33461E09BEFDD0A015BFC1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611108, "uuid": "f3a52bd7-278e-4e6a-81ee-2b200cb6324f", "value": "1536:GhVm5PJPxUhxvu5UF09noFPQZlMBUuAK+dqytzoEXHfvix:aMPJ5qxWSWnoFYMdAK+cyzvXHfvix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611108, "uuid": "075f9f56-d0a5-4364-92fb-7bc5c202ba20", "value": 58024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611108, "uuid": "f719879b-bb1f-4b52-a988-8a7ab93d76e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611108, "uuid": "37a5df4b-c965-4581-a5e2-30a1a3de2d30", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd57fae-853f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784664319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664319, "uuid": "ce63ee30-d1d2-4431-9361-4901e4f74f1f", "comment": "Malware payload (Mirai)", "value": "695ea7aa314c4478a06aa48945bfd561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664319, "uuid": "d387109d-df9f-450b-9192-4d73f5da7175", "comment": "Malware payload (Mirai)", "value": "721d764d2d1985eefb42fee9e1e2f05d4f4f35bbec216b952cdad74b0ac90cd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664319, "uuid": "10943107-8cc4-4366-af6d-8782814f0baf", "comment": "Malware payload (Mirai)", "value": "b2ca1aebb0c04a794ccc69397b59f1bfb4d4109e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664319, "uuid": "ce0ab3d0-4cc0-41a0-8c74-b471f6f8c2a7", "comment": "Malware payload (Mirai)", "value": "e13a9ed68ddaa77e9b649bc930635dbbe3620354cc977d25fe2a959478ca6f554c001affd338e053a66d492cf80cadf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664319, "uuid": "bfe3f4c7-412b-4f62-881b-6104529bcdd1", "value": "T136C30845FC509B12C6C255BBFF4E828D7B261758E3EE72039D256F64378B86B0E3A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664319, "uuid": "26f1f8f3-4603-49a0-acb9-5420013a3360", "value": "1536:dqtcHkQ2uce3J5M2rj74VSfqTaHBQK4ayOqONdESzFppluZwywYZMLttj6D+3tlg:dqtchDZ5MO44qsBQ14+SZpVr7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784664319, "uuid": "9fd1a3b2-9aed-4d4c-92cb-711aaec06c11", "value": 121196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784664319, "uuid": "73697a83-99f3-453b-bb09-346931845719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664319, "uuid": "fd4be115-c6db-416e-916b-70e3a4f83d13", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e543681d-852b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784655900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784655900, "uuid": "2cbb31bc-4f50-45ac-9477-ee5a1984ae80", "comment": "Malware payload (Mirai)", "value": "88a5d8101cffa7aea41819d59ae2826f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784655900, "uuid": "e1c922e3-c308-4390-a853-d310ff8e7621", "comment": "Malware payload (Mirai)", "value": "7247db5cefb311a3315946beb72f6f4469fef639d80541322d7b5f96b940d2ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784655900, "uuid": "e3a3ad97-45e0-479b-9272-d1cd484d4ea1", "comment": "Malware payload (Mirai)", "value": "f13ed01e17fdd05e855118ff1ffa4a0605a80958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784655900, "uuid": "ea8d826a-ffc0-4096-b57c-0e32eac8ac0c", "comment": "Malware payload (Mirai)", "value": "5788a79616e72480fba0680a19ec991471ee937b35807b4f2beddf50a9893781e6d146090df68f61c2115b59ab8fe754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784655900, "uuid": "9b3e7574-77a9-425a-8c56-c142ed8865ee", "value": "T137C30845FC509B13CAC652BBFF4E428D7B261758E3EE720399256F65378B85B0E3A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784655900, "uuid": "071e4f34-4d37-42c9-b948-5ddbef1c0f60", "value": "1536:vhEcYGQZClzTn9pFb2Ye94VSDbZTqyA5UayOGkENiFcRHlKnwywFB8jRldLxohqT:vhEcQaP/FbO40deyAS/MS4tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784655900, "uuid": "f6b23629-2fa0-496b-801e-4b6525e840f4", "value": 125292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784655900, "uuid": "5cded870-6159-4b9d-82cd-4db77cc82b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784655900, "uuid": "f7991999-65f0-4f17-98dd-77f8b8027c3f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1778d09-8528-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784654632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654632, "uuid": "8a60f457-eab0-43df-bd19-0c7d78dc7028", "comment": "Malware payload (RemusStealer)", "value": "512bb4a122568ab91f86b9bb716739a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654632, "uuid": "5c819c6d-b374-4450-8baf-927ab2019af2", "comment": "Malware payload (RemusStealer)", "value": "72935b04a5ab38bfd9240514cd205935f7ffe921ae5a61d0b389495235feaeb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654632, "uuid": "8a84d5d4-539a-4978-b454-e4c1aa5adae4", "comment": "Malware payload (RemusStealer)", "value": "bd6c7efbdd13e521de1f00c22b2bc8104e2c10c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654632, "uuid": "e73e2ba2-c8b4-432e-adef-de1cde0c8719", "comment": "Malware payload (RemusStealer)", "value": "0c41163d23004cac4335afb048cf5df1b47437df8c26b980ccb738e908356ebd9a5f6715fc366d0bc969e887643e9cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654632, "uuid": "c34bd185-643f-4e49-8155-aff895f1d0d7", "value": "T148B64A03BD9148E6C09AA63189B652567B74BC0D1B3233DB2E90BBB82F737D05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654632, "uuid": "8dbb1943-166a-45bb-bebb-3ad783a20d83", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654632, "uuid": "c8154130-8735-4cd6-a712-d6068db58b65", "value": "49152:VqBFd8CTIhkGRarZdT5W8OJLaZAeo3BSw6F2YxpjceVofpcJZJ:VevrvLceVM+JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784654632, "uuid": "5f1d10d7-3d2a-460f-98e5-1d21e2d3ade7", "value": 10578248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784654632, "uuid": "2f39e383-4aad-474f-afc3-3927743a6c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654632, "uuid": "43d644df-4a52-44e1-85fa-5bfe5b74ccb9", "value": "Phantom Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df46741c-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784618523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618523, "uuid": "ded52484-920d-4a88-a510-bb1514f6e8e3", "comment": "Malware payload (Formbook)", "value": "2291539ead4fb1f64fe9b16ff00e86fe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618523, "uuid": "d1cf32e0-a036-46bc-ae14-44d314174a5e", "comment": "Malware payload (Formbook)", "value": "72c5259286ef8e5e2173b3fd798015767709d8a60d84d195bba3440d197d5efb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618523, "uuid": "43659159-00ee-4890-9f3e-f50567a362dc", "comment": "Malware payload (Formbook)", "value": "ac903b037de395cc8b1c86b9baa1bbacfd508b75", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618523, "uuid": "30d8593d-bb06-47b9-a6ee-3aff70300c9a", "comment": "Malware payload (Formbook)", "value": "f8ff61ba78f401b1a4bd618d2b6da8ecc75340c8c3a2424e811a5b2ae420bd7ad3de7ad4cce1f54114149b2da875727d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618523, "uuid": "11d892f2-c161-4050-bb96-cbc4a15c976a", "value": "T195E519E720DF790F1949BA3A849D2D594FBEE0192BC3BDF1E0D60D84104E89726199EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618523, "uuid": "b3813b71-af1a-4050-b3c5-f52a84616a53", "value": "12288:jyztysqcmd41OtJuw6af8GBotduf6cdUX2hXt0jLoP34nWWvHHdS:2ztysRmdyXrtdK6c6Mt0j/WWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618523, "uuid": "615df312-ed72-4fb6-bd64-100205bdc905", "value": 3219702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618523, "uuid": "b0016925-b20b-4480-9651-49924ef1de25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618523, "uuid": "5966462b-d8ed-4f57-a8a2-eb6839ed4d3b", "value": "PO_N0_2026_ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b558f53-84fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784634730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784634730, "uuid": "0993f68d-96e6-4d6a-84fd-f0bf4b4ec72a", "comment": "Malware payload (Efimer)", "value": "ec6e991bfb6ae2817941f18f66730373", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784634730, "uuid": "acab060b-a570-46dd-a840-cd0fc94f77e1", "comment": "Malware payload (Efimer)", "value": "7320e51dad1607f61cdc2c4a9df2a6d057e95e8617af091ddb97ddc7e1ce243a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784634730, "uuid": "dea45317-4f39-48ef-b74f-34b8e05d6cee", "comment": "Malware payload (Efimer)", "value": "2697d2f606ce791e2338489262666da9b58bccd2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784634730, "uuid": "fb05960f-6137-4f28-b3b8-5aa13888ca31", "comment": "Malware payload (Efimer)", "value": "3174b3c045cc307d63664f9baed20e7d70674b835265a863482a8fa4ef491f6cdc631a69a944c3f08363cf84d9a66008", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784634730, "uuid": "8742969d-8253-4600-9b6c-3c4afb426c09", "value": "T11EE63308A7E012F9E963903DDD6342A5E66A783B5B31CADB179883E19C331F14D39B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784634730, "uuid": "7bb8531a-a142-4e05-b462-650cf4089cec", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784634730, "uuid": "f44659fb-8ff5-4b99-affa-9ca64b48fa80", "value": "196608:CDawdX86LQPdxJdCuzmtERZ24/QGW1j7XMCHGLLc54i1wN+MCsPIcu9KYK39sI3h:aV5L6dCtqCVHXMCHWUjXTcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784634730, "uuid": "b021c101-5cbf-4f13-b083-08bd29d8852a", "value": 14296652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784634730, "uuid": "1b00a9b5-caef-467a-a6ec-ecef105b478a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784634730, "uuid": "0347c4db-7687-42e7-ba17-23f27ceb287f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649ce482-849e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784595125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595125, "uuid": "49bec7bf-0fa9-4486-9f78-3eba34555cae", "comment": "Malware payload", "value": "6e1959009b0d2e19f3e7f567a42cb3ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595125, "uuid": "2a705d3f-42bd-4d9e-abfc-e60380093a3b", "comment": "Malware payload", "value": "748f3c2705750d776056a58fff76a54251d252f537b5000d54aab46ab4f56db2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595125, "uuid": "fd6eff3f-40ae-4535-b764-f21e6c2e1e21", "comment": "Malware payload", "value": "796437e39ca0032afe6c7d61371eddcdf217d8f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595125, "uuid": "ad362a64-fcfd-44e0-85e0-2beb23384398", "comment": "Malware payload", "value": "bdd56bbb0cea01ee5e77549687a406f641e40f92c9229dfabbc773aecd5c81cbf4c3dcf3a65e61541b7e8e929f742feb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595125, "uuid": "9e52f6d7-97f8-4232-bf1c-a0a5c95cab1f", "value": "T171C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC15F9CC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595125, "uuid": "89fe4a7c-15f9-454c-abcc-8926efae28f8", "value": "768:vQ8vCB+25j6es8RWYxi9FYpMSUpi+20qUpi+20YQX:vQ8l25JRxEd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784595125, "uuid": "9f17bcd2-f6ca-4677-8342-63a665f4f254", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784595125, "uuid": "ced706d0-97c2-4f77-bac8-ad5eec7d30af", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595125, "uuid": "46e13604-29dd-4c84-98ed-191df058a2e6", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee30bea-84ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784615758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615758, "uuid": "9183bdd3-060f-48c1-930c-b91848ba43d6", "comment": "Malware payload", "value": "1868b81a612192bd877cfb062d6a9a6d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615758, "uuid": "921e2860-8e7c-4224-8dd2-e94c9bf844ee", "comment": "Malware payload", "value": "74c1bf2fa35117d4dded64cda9e44617dc441d4dff3315c986604ff329b3138a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615758, "uuid": "6fa846ac-40f3-4090-be19-e90653bf0477", "comment": "Malware payload", "value": "2837fe576fa7bbb3f1b6710b6001a5bd69860ebc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615758, "uuid": "b02264b2-f4e7-4454-90e0-cf094a924cd6", "comment": "Malware payload", "value": "2cc303e00d7bce4d3945460f78064a2cdb274510752069e978d9bc8c5cba2b74ac6f7cf56e7f96ea60886f2d39a48a04", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615758, "uuid": "7753eb35-d523-4fb2-aa5f-8026a1eb137a", "value": "T104B512428BB30A613837FF1899F331DAFDAC6459BE3445EF692946E9C204173F4D8968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615758, "uuid": "6bc47320-8c1e-486f-9148-2d60a987f059", "value": "768:kzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSzSl:4R2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615758, "uuid": "fe84541c-9977-44a2-8784-75b8ae8d8507", "value": 2474448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615758, "uuid": "8e61c654-310f-4148-a7dc-15528c08828d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615758, "uuid": "1625dc8e-1d81-4ab7-802b-b29e6e817f36", "value": "SIP 103.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43b58f2-84dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784622317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622317, "uuid": "01fdd1e1-e21b-41fd-8bd6-7a14c3b865fe", "comment": "Malware payload (Mirai)", "value": "995b82b077729b2bf10a09675c21e2df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622317, "uuid": "b1d41abe-c6e6-4861-997d-a79908839c64", "comment": "Malware payload (Mirai)", "value": "7547e39f78aaff70368f71fa99679b6e66a5edb7cd03e7c557a121f6cbf86008", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622317, "uuid": "4d5b756f-d161-40bf-ad72-5928663be509", "comment": "Malware payload (Mirai)", "value": "c90cc5950f85c455d776c1436762fb4ba3a2419b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622317, "uuid": "91f1b506-dc92-4b5b-bc08-98aaac96b021", "comment": "Malware payload (Mirai)", "value": "94128274b68b4583170a5f982a26d549ba8d60d7626f30179e8deb0daf3fbd1ffd23eaff50e7d4d69df3b960f8fa3301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622317, "uuid": "a6b9510c-651c-468d-8286-b371452f7f92", "value": "T122631975BC819B1AC5D52677FF2D8388335723B8E3EA7113DA196F6133CB8660E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622317, "uuid": "ac060e13-81f8-4cc1-8101-82197c76584a", "value": "1536:qfjOTmjlKLow1zAyKsYQ3NPSbAb1ShO/at7NYWdbZcFBFa1Utp+DF:qfjOTmooI8odNu+1S0/GRYG9CBFa1Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784622317, "uuid": "98fca829-dc17-4111-83d2-8a2346b322dc", "value": 71468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784622317, "uuid": "00f0ab1e-ab83-4e93-ad4f-09fc77eebf27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622317, "uuid": "7df61dea-7597-489f-83a1-1420421fe9e5", "value": "TGb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04f515c-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784611170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611170, "uuid": "381d4c72-6623-473e-bb63-72c4847d513e", "comment": "Malware payload (Gafgyt)", "value": "f3a251a7cbd2386b8aa9379070b1ae1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611170, "uuid": "64cc669d-e55b-4dff-8299-e9aec5e3a5d3", "comment": "Malware payload (Gafgyt)", "value": "755cb7b80df420a587c876957a78541370ee422b4c2b6a7c8cf8a6372c6a121c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611170, "uuid": "52560adb-831f-4c60-9e30-def5c15ed022", "comment": "Malware payload (Gafgyt)", "value": "133fb416ae287eb6d26eefb1b7d588809c085573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611170, "uuid": "d97394d2-5329-434c-a022-63ac32dcdc4c", "comment": "Malware payload (Gafgyt)", "value": "7ecce83f4f66f007b0a75bf9fc9f569431101ced9e661e1e389cbc5f2ae270392f6dc1be21578a50274401ffbf2998fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611170, "uuid": "bb36c86b-0b28-4d9e-9526-33cd2ea2b493", "value": "T17FE3F945FC909F26C6D722BBFF4E428D372A1768D3EE720399255F20378A95B0E76142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611170, "uuid": "0296823b-fc40-421d-afd0-7477a791ffef", "value": "1536:PsdfSkpileOJGBGrJTcUX+NoUU7EfPQSaZADcjTTxkZD4bPZuOF2Q1pSjJPlf9wf:PsppiD4WFd7ukA0TtcD4jBHwHsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611170, "uuid": "9194929d-2108-4b59-bf4e-80b4e0a8379a", "value": 154320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611170, "uuid": "1213f2fa-b79f-4629-82a7-0731613c2807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611170, "uuid": "15249422-243a-4ea4-81ec-5548c52f1f43", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66308de-8528-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784654533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654533, "uuid": "14b47cb1-2a17-43fb-9503-772d4bf11488", "comment": "Malware payload (Vidar)", "value": "9460a4fc5ef4a5f6a8a3b851398c0b44", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654533, "uuid": "b3ca5746-fb7c-499d-bcd9-573140a56996", "comment": "Malware payload (Vidar)", "value": "75a0d2b32af70bcbffb8ed27215b60c924efd460a85cd21013fc1b83e1d2fdc8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654533, "uuid": "ce42776a-c667-4b9d-a86c-963f9e169718", "comment": "Malware payload (Vidar)", "value": "4b21892cf36b9e75f7ce2ee7e42227187a79f5e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784654533, "uuid": "b97b1d42-d57d-4fb5-82a0-c16c8630089c", "comment": "Malware payload (Vidar)", "value": "11b923b46eb4f51c0b5ef4cbeffe3c4339a35c4a007f70f3f96ff8acdadcc16141458a5ec9d3b6742d43d4cd4097d1cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654533, "uuid": "26379e9e-f11a-4f1d-97f9-354590bc06e3", "value": "T16557D015E3D801A8E767DA74CB625332DE7178564332A58F0689C2152F33AB39B7B3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654533, "uuid": "b8c533a4-a87b-467f-b824-0c83bd2bd69c", "value": "bfe3f355664e8880810d94ffb6a6da17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654533, "uuid": "71aa8ff4-6439-4e4d-a299-1ee64b143b56", "value": "49152:/eR6pxvI0OLVbv0XJ9/WsE0m4kIBBsCrnWMzuopvLOvoD1oy8/XPQTUH:2h6E0mzcssnWFOLZKPQTUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784654533, "uuid": "80008c50-1e13-4676-919e-522e95524089", "value": 28101120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784654533, "uuid": "a551d676-94da-4d4e-8286-63b2d8b819c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784654533, "uuid": "a0009b99-6863-4abd-bd64-6101e6f4fd21", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e518ced-8503-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638386, "uuid": "f30ba2f1-6581-4cd4-b5ab-a8b7dbd196e5", "comment": "Malware payload", "value": "91a875e292ff2a819321e4eab0e55979", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638386, "uuid": "f062c9da-1379-4ea0-8b5f-1cb3193a6f93", "comment": "Malware payload", "value": "75a40f58bbd3320032766f0f34e7c9e640754c831e6e323e49e3bcd186ed6e8a", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638386, "uuid": "f41a650e-ce27-47b2-93fd-07a9a2142955", "comment": "Malware payload", "value": "0213e73af78d251c9093ca29a89bf30bf11504d6", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638386, "uuid": "c75f1ac9-ceaf-4de5-8e4d-9c2b81504820", "comment": "Malware payload", "value": "f667b6184e53088dcd357bfd5b7ec80e478a4ae5a78bb1638eeaa5b82c8f8da5a931becd679ac911c2d32f88167e7d74", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638386, "uuid": "e0c38da3-4c1a-4596-b425-c62391956c27", "value": "T19246338BC27CD484E491783E527F6CEAAD541A81D4256F3F1F1647A90CAACCC726A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638386, "uuid": "2c4fce8c-a977-4f04-88b1-a4e60bffd4e7", "value": "98304:eBga41Z19K6rwG4dVhi7qs8K0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mx:cgaMs99i7FnjbCxETKQd3RDh9jTu40F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638386, "uuid": "aa5527e5-e2cd-416a-ab6f-2e0ff41eb2f2", "value": 5802562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638386, "uuid": "fc8a139c-cecd-4a32-a28a-06ea52143bfe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638386, "uuid": "82d4f3a8-7dec-44dc-bd49-26113939824d", "value": "futurebuilders4c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f390fea-853a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784662064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662064, "uuid": "4a59118e-e052-4a77-94f4-423ef7d64ef9", "comment": "Malware payload (Formbook)", "value": "470113d5421bc42ade9214abcafb4eb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662064, "uuid": "2c5a5db0-7e5a-410e-8676-2e391ab47dba", "comment": "Malware payload (Formbook)", "value": "764432a2592954ad4cf70f8c62b46ee81e55457b66b972e77de3e51017c02b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662064, "uuid": "aa641f1a-d853-4da7-ae90-67fc320f6471", "comment": "Malware payload (Formbook)", "value": "aa96729683ceab996103be5b55ea022e88330ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662064, "uuid": "5dbd5f1c-89d6-478c-8b4a-bb1d2bec7658", "comment": "Malware payload (Formbook)", "value": "ad65a772d26ce1d129eb6fe7539f8f63edc345aaba3a7864c9019c39724f5ce2c742fe03ea1c4d0e76e0d0f7a97f68ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662064, "uuid": "c998c7df-736c-4a56-86e1-11ece431de0d", "value": "T1C23501101316D942E0E68BF6B8A0D77433784CCF79D1C3D29EEAAFEB79293C15568192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662064, "uuid": "dc41a247-8edc-4a1d-b78b-e7693eb87733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662064, "uuid": "4b7f1d72-635e-446e-a8cc-71385b159350", "value": "24576:0p50fJiQFvuOKRCgGks8os8N4edWA3mSTMAB6v:0pGiQFmkg338ND3zMAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784662064, "uuid": "4078bfe1-dc3e-4e9c-bc41-0511cc4b8445", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784662064, "uuid": "7115148a-108a-423e-9a3f-910c42601b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662064, "uuid": "4eb32ecc-cce9-4f3f-a9ee-55a56fb94656", "value": "RFQ-EQUIPMENT#00155890.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0548c8-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593126, "uuid": "4e6b5ed0-dbd7-43c4-8b35-edff12e6532f", "comment": "Malware payload (Mirai)", "value": "7c0db1eeb051d0e4d59bf713292112d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593126, "uuid": "e507a786-87fd-4ffd-b530-eeb84c37b718", "comment": "Malware payload (Mirai)", "value": "7694570bd0ddd16c6e60fbadd1d32a78c29944a1fa0cc19eacaa819d65654c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593126, "uuid": "75648ea7-96bf-46a2-b020-ee08cfb49f35", "comment": "Malware payload (Mirai)", "value": "f0dea7628c77cdeebdecd1fbff7ba6d7890d2256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593126, "uuid": "de38a285-4bc4-4ab7-83a4-026cd0540577", "comment": "Malware payload (Mirai)", "value": "88a5dcabd3cabfa281a17edc26924d3a0f869992bc08485719c26e3289c1bc6fad3491e274174a2a0d1dd808ea872bda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593126, "uuid": "51eeb320-086f-4522-852a-b0d2566fc47f", "value": "T1E9A3520B7F606EF7E82BDD3745F15B04248CB41621993B76BA34E958FA0A18F45E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593126, "uuid": "4e479ae8-cb88-45d8-b350-56a7f3868f6d", "value": "1536:DhIvVaMEpKOHpisY27JkrbOsCU9rACpHyT2YAFZofQQp4x:AjMKOJisvdkrFCUNIAFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593126, "uuid": "ecc3cb5d-ec4d-4861-a495-e7e6500f7663", "value": 104756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593126, "uuid": "39c10e9d-9654-4eb6-90c1-bb372d154127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593126, "uuid": "95891a84-05f4-4b47-a78b-ca96aca20489", "value": "nullnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c08cac-8546-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784667113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667113, "uuid": "dedecafe-27ab-4106-8446-e4e02d14f200", "comment": "Malware payload", "value": "b3fef8301e1992952d5a8b7ac41f4054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667113, "uuid": "cc38ee19-fb7d-4439-a930-64353f433349", "comment": "Malware payload", "value": "773fc40e2f9d7576f597d501744e4397da0da71d4cbf1c05aeccf0b0e7048492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667113, "uuid": "05f048a3-714a-46cc-ac3f-c773b3472206", "comment": "Malware payload", "value": "6f82a6fcd1496e32360e5e1d154f27aba2885b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667113, "uuid": "2e13cbab-707b-48c8-b336-cf8aa7a99dcd", "comment": "Malware payload", "value": "9f078a1892f7e4cec6cb30ab676208d4ac3acb96c8d4b28935b41120139764f1ac26c0f441e3f1dfcf2e5643310b23fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667113, "uuid": "5d69c4c1-9b43-40eb-9e9b-3ea73d7b82c6", "value": "T1D8631975BD819F16C5C56677FF1E4388331B23A8E3EA7113EA156F6137CB82A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667113, "uuid": "d3046696-5395-46f1-a857-fa716cb2ffe3", "value": "1536:PVb27rujdQNy3b5pPCbmeT1yj3y0IcfZqWlZcSUFy1UbL3x39S:P1KruZZ3Om81yj39IcfZBflUFy1Ubz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667113, "uuid": "3c2e5d40-72d2-49ab-8bd1-bfd3c7079d3e", "value": 71056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667113, "uuid": "aa8942a1-b755-4ac8-bf90-3eb036242af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667113, "uuid": "860bcb8c-129c-4c6d-8661-936f87c6b9e5", "value": "cHz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd82eb1-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593234, "uuid": "af02c3ea-a3ef-4846-b965-5b0fcf872a48", "comment": "Malware payload (Mirai)", "value": "6497824583422cf1d6f524d614e918cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593234, "uuid": "b3d66687-9898-4f01-8aa6-faad157c6b8d", "comment": "Malware payload (Mirai)", "value": "790788c47dd14f4f25ab7befca04cdccf78b3071ac706f9ec3333e2faaebeeef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593234, "uuid": "348098fd-9fdf-4521-ab33-8bc3b03b1381", "comment": "Malware payload (Mirai)", "value": "f02d6c5c070e58766ca19ffba4858b25a543be40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593234, "uuid": "fd29d512-a5a7-44b9-9d98-08e12f58da84", "comment": "Malware payload (Mirai)", "value": "50729369bb03046c73846cb21322899d59d7e86daf67c7788e28cd4577904034603fd30facfc11e28caa1e3971394904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593234, "uuid": "3e9db59a-d7ac-4a06-9270-07af316ab1bc", "value": "T177832A02B9C085ECC189E138077F763AC425F1BD627AB2D73BD5BF1A2C19E501B1EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593234, "uuid": "eb8d8e5e-b52d-4254-a7c0-48bee1725dc6", "value": "1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQEDdiqYRKROEMMgU:cHBePDNnlNub63gbyL/Y2hMs5DdiqdRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593234, "uuid": "deda361d-8fb7-4773-9a64-26b8c5c9e3e9", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593234, "uuid": "61d375e3-5a19-4db6-afdc-4826d518ab78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593234, "uuid": "2f9b981d-467d-4521-bf4a-b7c1782b27df", "value": "MMaaRRiiOisecTanee.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3de737f-8524-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784652783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652783, "uuid": "c59acc5a-4502-4911-adce-a7fe1f99c466", "comment": "Malware payload", "value": "8adebbbe8157cf36a1b8ff833852ee5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652783, "uuid": "6b1ca266-55d2-4ee5-8fe1-fac62bbb63de", "comment": "Malware payload", "value": "79a027cb89883df418cdc5be342dff415c59ce091b0602cc86342d1e0edc4c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652783, "uuid": "f05a15c3-b933-4392-93f0-fdfc23b28ec1", "comment": "Malware payload", "value": "e07a512e2cd92b406873558c34d295c5c2c44bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652783, "uuid": "acbf341e-1f09-4a25-a77f-790cd5e0af77", "comment": "Malware payload", "value": "8142f0cda5bef941c556d25726b44352e70ce9779e2aeeee728249d585ee53562988c1f9d25945884c2f2e617908f9a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652783, "uuid": "96adc0ce-1c82-4bbe-ba16-2225bbdc3e9a", "value": "T1F2E69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652783, "uuid": "f7d28687-4222-42ae-959f-29420a8e0198", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQP:cqYUQuVDt0TZEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784652783, "uuid": "04b8b99f-3fdd-4ffa-ad9a-cacf76fa0800", "value": 14811136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784652783, "uuid": "172ff4e6-1847-4312-a796-7506abef79c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652783, "uuid": "b08fa521-39dc-463a-8ddf-3e212eca91aa", "value": "79a027cb89883df418cdc5be342dff415c59ce091b0602cc86342d1e0edc4c6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fccd1c0-84fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784636322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636322, "uuid": "9baccb00-493a-4be6-89b0-bb46030ce581", "comment": "Malware payload", "value": "f7d689b779f09e367683f3ed2fd3d7b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636322, "uuid": "d73d909e-7ff9-4b16-a80a-2444268a867b", "comment": "Malware payload", "value": "7ba835589664264dc0c63d23f76e433feddacac4e9fa3a9855c5abb0213e7d18", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636322, "uuid": "8cc1bed3-7370-4fa5-84b8-99cb26b5a5a2", "comment": "Malware payload", "value": "2e2791ef1fe38a146446d462c92b2e8cc85d02a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636322, "uuid": "10adcb2f-c8b0-4db4-bf8d-161e0c7852b6", "comment": "Malware payload", "value": "9f58a149b89c083d9fb2c1cf048e7d8d5c1eae717c6859073650e86865cb4dcb6d1fdd71f4234c4fb312edf9da5d7d7b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636322, "uuid": "d6c514a0-c9e7-4a9d-b592-d8707ae1445a", "value": "T154C28D956A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636322, "uuid": "0aa30a6d-8c63-4c85-8bb1-bed041385e76", "value": "768:bV8vCB+25j6es8RC9FYpMSUpi+20qUpi+20YQX:J8l25Jkd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784636322, "uuid": "0a3babe9-2681-4c2a-86e5-8a5402da0299", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784636322, "uuid": "c073dc71-3afc-412a-b832-b126183deee6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636322, "uuid": "ae36153a-091f-4360-a0b5-ecd19f87c600", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f3ff9b-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611955, "uuid": "a2fca666-22d5-4e91-9bdd-4d84fec6bc77", "comment": "Malware payload (Mirai)", "value": "d3fd5fe759370f5840559d477919d5c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611955, "uuid": "56cbabd0-1a30-4682-9755-f75ae6c34e2d", "comment": "Malware payload (Mirai)", "value": "7d508780d6cd25bf3a38c85e3c1b08e1e375e229905f5c946f0a59f8ae4fa250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611955, "uuid": "6e66daac-6081-4934-8300-f3541b11ac08", "comment": "Malware payload (Mirai)", "value": "64ffcda178a02cfe344883928f2b8fbd463f563c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611955, "uuid": "8562170b-1aba-43a9-a735-374a6bc92d92", "comment": "Malware payload (Mirai)", "value": "fca1f9421779f5ef34366cfd73dd53d16ae1e83988756805b50cb2eda71cb6151b73d43166c510204db3c73972bd869e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611955, "uuid": "f37a0745-7d70-4bd4-82b5-13620306aea9", "value": "T1DE836DC5EAC3C8F5E92209301172FB675AB3D13E2268EA83C3A9D975EC125C0F55679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611955, "uuid": "d3985880-ec91-45e4-885f-186abc96c89e", "value": "1536:+ZtH7MIlsW4yoARFnmfWz3tAjw19KHVd1YQRJBP:+vHzlsW5b3nIWbti+9oYQPBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611955, "uuid": "b33a25e9-02a5-4a12-879e-dc3f0996660a", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611955, "uuid": "04b4d959-985e-4f59-8b95-66e308a186d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611955, "uuid": "a150b07f-8287-4529-a7fc-75c925614d04", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a29b56-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784613306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613306, "uuid": "0a367491-b579-4998-8fb6-2aa7118785be", "comment": "Malware payload (RemcosRAT)", "value": "88da31dbd8b04462289f500baf2b5ac9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613306, "uuid": "1fa058e3-a0fb-4cb2-a02c-636d029770fb", "comment": "Malware payload (RemcosRAT)", "value": "7e62ba061fe69c4040f7dd3b859e3fee15fa6092cf4f1e4b5a1cdb739f6bb87d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613306, "uuid": "bea81bef-718d-4209-b887-4b83748031a8", "comment": "Malware payload (RemcosRAT)", "value": "1afd1e708f885f6cf664e9ff4e5a91e52953ccd3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613306, "uuid": "190793fa-cf66-485d-92c9-3d921e26ce29", "comment": "Malware payload (RemcosRAT)", "value": "5e2c0fbfd1aede058e4c031457b7f21558a4c018c463aa887f4e297fc319bc20e02dd8dcef7db9331a2da02e2fc8152d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613306, "uuid": "9f0a9547-9a95-4fb6-89e2-2397123b4a7e", "value": "T128A32A51D9D50B7A8E030BBDBE505610C5FC8218473780EDF69E132E641B4ADEBBF6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613306, "uuid": "4946b543-15b7-4508-9fdd-1193e37e02d3", "value": "3072:q70+twcf4F6bEVokRa8DlB7UI7yaIocp1:qkcfe6ORa/IdIocL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613306, "uuid": "a7041d91-e0c8-431c-8f51-24e8aafb88ae", "value": 102553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613306, "uuid": "472c5e4e-f103-4808-8898-ea7bef5a3c10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613306, "uuid": "b7a243c7-3ef8-4989-8e3b-9130e6af31b9", "value": "Formskaaret.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8118a3-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615187, "uuid": "50bab0a5-7cbe-4817-8af3-4a87916b34f6", "comment": "Malware payload (PhantomStealer)", "value": "06a2e8ed1093aa0d0e10e68ed870d0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615187, "uuid": "d63ba72f-5ef5-49ff-b886-1730ccc8edb2", "comment": "Malware payload (PhantomStealer)", "value": "801906d53d973d68367754281a9aba78bbd0de99b35bfa34f63baafa49eb179a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615187, "uuid": "350f7069-c63b-4f64-a1dd-f1341efd85ad", "comment": "Malware payload (PhantomStealer)", "value": "a15c0dbbf069da7b4d605af46212695f3c60da90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615187, "uuid": "2a2f156d-4407-42ba-b5ec-9436566670e7", "comment": "Malware payload (PhantomStealer)", "value": "848892bc946429d41147e00bedbadc33c0d89a163915061a0eb47825d75a018d382ad7266f14bb33f47d21874f31ba14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xtudsq--tourtrade-shop", "colour": "#E5AC30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615187, "uuid": "2541b377-b348-4f59-8d64-91e597077347", "value": "T17E84186433F44604F2FFAFB5E8B045118A72F88BEA39D75E0AC9449E0D71B50AE50B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615187, "uuid": "85f29781-8fa2-4814-a5c1-9516cad7cd4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615187, "uuid": "5a379288-588c-4ad5-9069-d7d81718768a", "value": "6144:HP4l5PwaVZrmb9TPFoCH55tFK/KYAabdZgvkwUsAdPz:HP4l5PwWrmbXoCH9s/KqAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615187, "uuid": "0ea4bbc0-320c-496d-a787-c4b6456c5608", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615187, "uuid": "afc2c8e6-d664-48fd-9f88-38f2156fda77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615187, "uuid": "b4f51436-d554-42ea-80c3-2af5ebd87135", "value": "801906d53d973d68367754281a9aba78bbd0de99b35bfa34f63baafa49eb179a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e9d6dc-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784620581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620581, "uuid": "b465d3ef-10ba-4309-a169-0d9d2dcafa6a", "comment": "Malware payload", "value": "ce75f4fa74fd9a21538c231240ae60dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620581, "uuid": "104cae44-c980-4401-ba61-c235a000b2c1", "comment": "Malware payload", "value": "81995034a2f8070992ba1c48586b303ac89ca2a8b71db414a4bd83c79148ff0f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620581, "uuid": "864aacaa-23be-467f-96c3-feb7f4834ad2", "comment": "Malware payload", "value": "8c92234c3f022b755e9bbacee997d0bc69f72e36", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620581, "uuid": "110d6e62-1e19-4376-8614-4efc0a98065b", "comment": "Malware payload", "value": "9836b473a288b4938eeca2afd51d1ad1fe7a4919cb01fcb43cc90eb8987db4d7176185b5fc444a144cbf7407f161e63a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620581, "uuid": "5c24db5b-500a-495f-bae7-4157c2b09d31", "value": "T11947238BE1BE7813F466A67B51D72D2AD32CE515F273764B8E50120B2CC36450BD3B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620581, "uuid": "7e186b3c-30f6-4727-84c9-13e8143dd67d", "value": "393216:ovdif70vT/X0v5Wa2ozIQv0nJvN+z8bffXGrYnpgjvP/Z6k00LJ:okT0zX2qvfJvN+z8bfeUnpOvnYk0MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620581, "uuid": "f7ed0b18-d282-4c8f-b318-d8131b52ea96", "value": 26490728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620581, "uuid": "0a91a10e-33f2-498d-9d6a-d0e88a628037", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620581, "uuid": "a6580ac0-08ee-4e7b-9637-aecf37a4db03", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9b853c-8557-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784674788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674788, "uuid": "05e6edad-f324-4f97-98a0-ed89093f3a4b", "comment": "Malware payload", "value": "0c1f0b1e4f25bb9a55ec805f13cc252b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674788, "uuid": "6e68d956-5c45-44e5-ae50-0a14887659d8", "comment": "Malware payload", "value": "8319f644ea7e62f69665389100b0a35cd4c1a8dc8670934772271fcb33ba4576", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674788, "uuid": "11bd88f2-4e80-487d-8c25-faff9dbb1b22", "comment": "Malware payload", "value": "f4169ae97ff7e1b6d6034c511bec50f2b5bd508e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674788, "uuid": "7ed527db-dc1c-4e28-92c7-0c81da4d8661", "comment": "Malware payload", "value": "e61732ce3228e29a8c0580b3ce727dcbcb0b5915feffeae6e112dd67346ab5144642431f5384d91fb255fc4932b901b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674788, "uuid": "99ae622f-2c28-4557-883d-350241a61ccf", "value": "T1CD234C62F98376B03F510279DF91A9667F5B9C3B4E682B41F0866D1CA1346BCB0B24D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674788, "uuid": "7c61676a-6f08-4e8a-b869-f54ceb9f9804", "value": "768:i991WnWydzUKO8EorVM/MN0NBF7Ssr6cYtNGTiPax+dFVcglW:4MnWYUKV9K7JahW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784674788, "uuid": "2069341e-c1bf-4365-87d4-5bf1fc294fc0", "value": 48511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784674788, "uuid": "a949658f-d4d4-4c38-a989-ae4a5fd52727", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674788, "uuid": "2adb0884-0ed6-4e07-84dc-b301e54f5f58", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047d181f-8517-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784646933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646933, "uuid": "d8a8979e-aaaf-4c9b-bf7e-d6e2ff93fbe0", "comment": "Malware payload (WannaCry)", "value": "2385c3dfca2bdef4eb16dd48cdf04c53", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646933, "uuid": "3f5163a6-8a29-495a-8574-3da81059579c", "comment": "Malware payload (WannaCry)", "value": "836d18ddae8a91b1ce6a2d79722f7115ee3b0358060160c585ff2c891023883c", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646933, "uuid": "1d6fe18f-2f86-439f-ab67-23b1d969db40", "comment": "Malware payload (WannaCry)", "value": "67b6c47a248269de27364300ae5a83f6cdfbd5ee", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646933, "uuid": "34f918ac-3e83-4507-b5b8-205c69c5c73c", "comment": "Malware payload (WannaCry)", "value": "01ad3d515e5c1428a7e721fc4748d11085d91620e95b4394174c5f043d4f70d674eb0bb6720b5de3da91a233cf9018de", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646933, "uuid": "6dabe95e-fb1c-4479-ac7b-1a1dd3edc1f5", "value": "T1F7364E2199C8E7C0D713A1B7477E06785A514094B3157B92B3B1AFE3E66B08F4EB02DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646933, "uuid": "03484cbb-62ef-4c13-b0a7-9654f4ff8ec9", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646933, "uuid": "3d0480b6-e677-4b90-ac47-ceb227cf888b", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRKkRiwDnz9cEA5yYj9XEk:jnXnAQqMSPbcBVQej/1KkRiwtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646933, "uuid": "eafcb980-c030-4cca-a6e4-ef2f9750f109", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646933, "uuid": "d450e1b5-edf3-4604-bf6b-6f07a50ca095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646933, "uuid": "5ab28859-630c-4761-acfa-c7c2bc0f2bd8", "value": "836d18ddae8a91b1ce6a2d79722f7115ee3b0358060160c585ff2c891023883c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2495256a-855e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784677481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677481, "uuid": "44a28de9-e3de-4b8d-ad1e-7640cfc97f82", "comment": "Malware payload", "value": "0b4749bb50c6dd126241b57dd59e6737", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677481, "uuid": "def4c1cc-5ec1-4969-9f7b-ea918cb580b0", "comment": "Malware payload", "value": "839ac20629dbb94451871be5133dded462f9452a905b276fad46e4956e974277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677481, "uuid": "8fc2cfe7-bb92-4b59-8167-56d70468b0cf", "comment": "Malware payload", "value": "a9ea794fdbcad021d083516af06099cee15e2bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677481, "uuid": "78cc2405-c34b-4cb7-a15f-a4c1bbdd1a99", "comment": "Malware payload", "value": "45044f27adef80d532a598ee6824c99000d380c60a85951d5274c7702f61144f3e7c5420ac5726a842d2fe94f2d2bf00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677481, "uuid": "9c2f41fe-191c-4289-85dc-f0bd72c5e4fb", "value": "T1FE666B03EC5965E9C0AE96308A629553BB717C491F3123D72B90F23A3F73BE069B9744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677481, "uuid": "d6eb8d79-7429-4465-b8cd-7dc8b07cb4eb", "value": "49152:dSjbWQs5ZsQNNk93jzPxlyCfjYqtzXFT8OJxCVfaK8IGV8ZA8yNWIV2KKlK1KcmM:dSuQUOC4rS58eEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784677481, "uuid": "ccc8f2f3-60be-4f5b-8fbe-b8ecb0cffec1", "value": 6566050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784677481, "uuid": "7ba720fa-644d-4852-a614-aaced4229926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677481, "uuid": "e2637492-f7f6-4105-98cc-7c322de2a4bb", "value": "agent_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6804ceb6-8524-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784652683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652683, "uuid": "4a0b8cb2-c24a-4312-aa47-d32b515b37c3", "comment": "Malware payload (MassLogger)", "value": "e9f62d2bbb5497433369816f9c6583a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652683, "uuid": "38429512-6706-410b-a118-932188d73ce3", "comment": "Malware payload (MassLogger)", "value": "83b78a436b2105cc98eefd04f7621dc2072be71d4f89e3310dae654e4d5c7a9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652683, "uuid": "99d67ae3-818b-47b9-b052-a498011495f0", "comment": "Malware payload (MassLogger)", "value": "67da49696260e0ca09c60bed13a3f9a5d75f6239", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652683, "uuid": "868425b0-4358-4242-8092-b87adbe9d8b7", "comment": "Malware payload (MassLogger)", "value": "44ae310882a959aa15c5f4fc0a99c8481988924a2086d153a05b6459168ec1d723cad9662768b996795071be8242e65b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652683, "uuid": "308b3f0f-43ac-4883-a8bc-b7102e2d7484", "value": "T1E3767D3183F12299D9656590666B83664F769AF27135104C07E8073237FFB38F9EBB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652683, "uuid": "9a7288fc-2216-4d8c-8e4c-0aafdc03f34d", "value": "49152:GDIX88kfYuA1rIdl+NCafQIN1LOfUSkScIcDWNspbPwzL3f06WloEt9yNRJprDXr:6NhGCY1M8DW+FKEqZr7kkzbYbn1wleu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784652683, "uuid": "02e0859d-d75f-4a32-887e-e5a9b9ad2c89", "value": 7689354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784652683, "uuid": "98b45046-f920-4af0-9895-f6b583c5a1d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652683, "uuid": "46e3746d-e2a8-4bf8-9eaa-ee329c37645b", "value": "SOLICITUD DE PRESUPUESTO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e81587-84cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614300, "uuid": "310a2ceb-6018-4690-bdcd-70c30268e242", "comment": "Malware payload (Mirai)", "value": "0a771a56976de98cee1c6edf7cb9a25a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614300, "uuid": "cbff0189-2e4c-4590-b765-601e7b69e0fd", "comment": "Malware payload (Mirai)", "value": "83c3fe8e8b9033458f2145acf07f15dcf502e4059b760159a424a89094dfb1b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614300, "uuid": "2008d12c-8625-4f5f-b5b7-94024e592b72", "comment": "Malware payload (Mirai)", "value": "15c6bbc16b3e12fc83717e8116a022d2bd65d08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614300, "uuid": "df82e768-3db9-4cef-a8a2-a1b6b833fe78", "comment": "Malware payload (Mirai)", "value": "c6c929a3e1fe61237fe744b545ce99f858abc903238b0a6dde5d1a287cb0e8dd249557426ed2118300159c7104b58f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614300, "uuid": "c422166d-de8e-49b6-b8a7-8df19d5d8329", "value": "T150E3F745BD418F23C5C711F7FB9E42983B167B69D6EA7103D924BFA0378A4DA0E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614300, "uuid": "4d2992b9-4ce9-475b-82d7-deccdc2e9177", "value": "1536:UyM1g57lPXPFZvXvnPTs8sw4g4wYAYwscmgTIrYo6tKX/4F5jAKyJE64V5DX71JQ:hMe57rt5ak5jMX47XBJMA7VfuHaz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614300, "uuid": "c39f66c0-03cd-462e-a9d4-633a3187cfde", "value": 145916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614300, "uuid": "f7b0686b-46ae-4a75-8eb9-b6eaabe908c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614300, "uuid": "e4273242-294d-4c9f-ad5e-08dea272492c", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18c2ce5-84dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784622312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622312, "uuid": "d9d1e65f-4fab-4716-8d89-03169b6dd35b", "comment": "Malware payload", "value": "4caa32245353c46a58929aef5fe706e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622312, "uuid": "16425607-e4a2-4411-970c-4215f626a870", "comment": "Malware payload", "value": "8410b9a9b874ff6a7588e20d0eb27fb2425b49c0cd1b5bb1f8492d513520aeda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622312, "uuid": "2d8e43f7-1a33-45e7-b77b-c402686161a3", "comment": "Malware payload", "value": "141e82643279a003382ba561f0d36775e49de24a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622312, "uuid": "d39212a1-75af-4d03-b15b-6310ac08f200", "comment": "Malware payload", "value": "679234a6eed76b15642b3472e5750f08ff9a808ce635dc3cf3e924cca23e7d9817a3f9dbf0121b8d0a7428cf6a44d28b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622312, "uuid": "08840e0c-157b-456e-9c31-0216d911a3f1", "value": "T153A3B60E2EA1DFACF369823487B78B34A75C63D127D1D684D1ACC5002E6435E641FBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622312, "uuid": "272950a2-1aa4-4faa-85dc-56150a8ed027", "value": "1536:JBpCWLN6Bcd+W1Ue2JzMfO0PQviNFdcc0L1ZzZ0E56Plg4fluJxwOMN7BDeqv2:RLDUe2JzMfO0M9cwZzZ4dgtfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784622312, "uuid": "8b6b22b3-1ca3-47f3-b573-d4671103dab6", "value": 100820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784622312, "uuid": "05710f6c-8207-4724-b13a-8690a0c25d29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622312, "uuid": "fde8430d-1c17-4beb-853c-968802ffa0b1", "value": "VRQh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cfa52f-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593575, "uuid": "96727ab3-8086-4b7c-bb73-d263a9ced7ad", "comment": "Malware payload (Mirai)", "value": "0c775fa89dbf20b6b10d609ce8b44703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593575, "uuid": "8b18fe59-d385-44ce-97d9-0d618edb2c4f", "comment": "Malware payload (Mirai)", "value": "847866fd99c7898e27069e3f0dce04c6e5e39ba51bb2a86ccc086d51b4320b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593575, "uuid": "dbbd740f-96bf-46e9-83f0-ebe51e39e52e", "comment": "Malware payload (Mirai)", "value": "42fd8ea509f26c9fa6ab6c841bda08162021b4dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593575, "uuid": "5efca838-4388-4e94-bcda-32a423439097", "comment": "Malware payload (Mirai)", "value": "ca4af2f66be4d68ba37ca986997566246767b644de04b8ca44107c612337372a643f04baf4bed1f8a0d6ee226e117b37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593575, "uuid": "0da53309-df50-4379-991c-da1517097c1f", "value": "T187A36CD6F243D4F6DC2605346173FF375D72D5BA2329C9C3D3E89A36A822641C91AA8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593575, "uuid": "0ab2b6eb-2206-40ce-99c8-44b2d25bf013", "value": "1536:+XeCa/WojVnyrbQM31JP71RTS2ASm6zuWPfSZt6cJasl70QhL3SElCXDBE:5jNmlt71RulYTfOtXJnh0MlCzBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593575, "uuid": "1a0904dd-4354-4252-8038-2d9400d8f5f6", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593575, "uuid": "07ba152c-32b9-46da-9ab9-e735aa7c2228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593575, "uuid": "7333f66f-703c-4309-aa0f-6147732d2494", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2eefd87-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784612033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612033, "uuid": "a9d98d90-4556-4228-b6d2-65d1e6729258", "comment": "Malware payload", "value": "aac63fd6adfeeebd311c754874e98f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612033, "uuid": "cd2be256-52d3-4660-ad54-49b4abbb72f0", "comment": "Malware payload", "value": "86118665e6ed6daf79b7e33a64708cb60befc5e55962faed8bdd7dfecff18fc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612033, "uuid": "607d22ef-4d03-4c5a-92b3-1272cbe94e89", "comment": "Malware payload", "value": "4a5c8b3b58c561297cae609d6bdfbe978ec64257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612033, "uuid": "9649c83f-322d-417b-89c9-87029de95a7a", "comment": "Malware payload", "value": "0968129ced32bec288986c81b07fe7575c0ef024c5da412aeb0566d977f8d8aa83b8f5ec60caa280b2aa69f6ce24b826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612033, "uuid": "98a12e34-9b01-4956-8e73-aecd818bb311", "value": "T14EA3D90AAF611EB7D81BDD3305AC0B4274CCA617726837793538D91CBB4A94B8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612033, "uuid": "1e3f822e-bab8-4958-b9b9-dca56b77e132", "value": "1536:mtttIX/hy75Xm6qnAKKBKouXZ8ix6lcFi1+02UxRgivKlK3C:QWvhy75XXqAKwEXzSxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612033, "uuid": "8b05fe44-1ad2-4296-8994-6a7265f2bf0e", "value": 101044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612033, "uuid": "53b41cc3-ecdf-4844-970e-2bd9b85cf790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612033, "uuid": "d93961a8-afc2-4775-a198-8026ec363852", "value": "OUi7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b21cbf-84e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tsunami)", "timestamp": 1784625839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625839, "uuid": "8f90c07a-a2c3-45c2-8faf-5d56eb5c712c", "comment": "Malware payload (Tsunami)", "value": "f895104d7e20dc6808c05164103d1357", "object_relation": "md5", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625839, "uuid": "a65710da-082a-41be-9cc0-d79c13458862", "comment": "Malware payload (Tsunami)", "value": "86947b00a3d61b82b6f752876404953ff3c39952f2b261988baf63fbbbd6d6ae", "object_relation": "sha256", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625839, "uuid": "074c0934-8a59-42ae-8fe5-78673fb6dbb5", "comment": "Malware payload (Tsunami)", "value": "aec367a2ac984b1695edeab3717c663212487b6f", "object_relation": "sha1", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625839, "uuid": "702f6d14-53de-43e3-a35d-2f36e59fc4a2", "comment": "Malware payload (Tsunami)", "value": "1e0646954ab7d61298069af8d629e4002e3a1df89081f20df60ca2a4ed7bec9e308a98a26b4fdd109368d8c6a8e2e4e0", "object_relation": "sha3-384", "Tag": [ { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625839, "uuid": "42e82758-6e6a-4c95-9cf6-c77e541dcc85", "value": "T1D513F28468F57D26D346F9B82A917C19EEABA89503563BC03A2028FD32731F747748F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625839, "uuid": "3d9ab707-9208-4e55-802b-cb6bffbcfd9e", "value": "768:29kvhd+xT8f2YsseRvRjNskPKMqqoehgHGOmzZCwWvc59oHmVXVjJ:mGyqyvRjNdK5/HGDZCdaoHm5Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784625839, "uuid": "dd109809-b07c-4da8-aea1-73f9862bcdf6", "value": 45012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784625839, "uuid": "646bb248-b8d3-4666-ad99-1d2001ee8a70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625839, "uuid": "bc49b793-f21f-4bb5-83fa-49327c585ec1", "value": "pty4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c82ad6-8547-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784667874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667874, "uuid": "147d7fc1-5b3b-445e-9260-a80e23070b79", "comment": "Malware payload", "value": "8e8ca089db68c887def4d1177fce9137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667874, "uuid": "8f8f34ba-eacc-42f8-a28b-3fd51bf214b6", "comment": "Malware payload", "value": "86a058d461cdc5486430c2f6b1800235a8fbfdbe7d1af4af5d2d2d2f003c7634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667874, "uuid": "2940ea25-65f4-46b9-a292-d5c8b9ebe0f7", "comment": "Malware payload", "value": "febe8c12554f76d279faebef79e2fbb2153983bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784667874, "uuid": "e3caeff4-5cb2-4a5c-a5e8-98f55dd7983c", "comment": "Malware payload", "value": "1d79f296ffb04a23a85b399aaabf982ea986b49e742850ab23488c9c11fa9f37eb5b5e645f060fd1998aae340ba05902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667874, "uuid": "956b2be2-d095-440d-ab91-0f955e1152d9", "value": "T1C3632A75B9818B56C1D52677FF1D8388331723B8E3EB7113DA196F6137CB82A0E2A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667874, "uuid": "eb0b8202-af3c-47af-bd02-2e06530c126b", "value": "1536:qVbm7Ju6BQNy3bEkPCbmeT1yQ3yN8clJW0nZcJdNFL1Udcfdp:q1aJuYZXOm81yQ388clJrZuLFL1UdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784667874, "uuid": "f2b28368-9d70-4b8a-9764-601a549e4535", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784667874, "uuid": "0577fc52-5f47-4255-9979-5f5287621526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784667874, "uuid": "55fce66f-e581-40a9-ba80-6bf0db61ccfa", "value": "03W7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f29e2dd-8507-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784640159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640159, "uuid": "7f9db8d9-23d5-46ac-ac43-a12ea257a4d1", "comment": "Malware payload (Mirai)", "value": "309a066c6ea28e31f01184f759d2b67c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640159, "uuid": "70cf829b-d18f-4dcb-bc6f-6d00a3bbcf2e", "comment": "Malware payload (Mirai)", "value": "8793d30a43d8d26aad7c46f03752199a39434a1350708eedf2b238de7728c52a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640159, "uuid": "9b19ee54-06d8-4d34-ac33-274d00c09b90", "comment": "Malware payload (Mirai)", "value": "f26a6db28e5015b25384f4e9c663bbcf44e1aa8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640159, "uuid": "3550fcfa-a381-446e-944b-46a67aa35a23", "comment": "Malware payload (Mirai)", "value": "1604d6d25b64d9802bb21c8db0413babf8d8c62c4d1466a24a84b3c8bfd65ed84241b0aaa6323f466d2ac3476ea9b880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640159, "uuid": "d442b6ae-0030-4e8a-9b85-104b7f44d8dd", "value": "T1C2630279B402F590D7503873A29ECBC47A19DFFF0A8F9B034416951512E0493BDFD989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640159, "uuid": "2612ca0f-fd1b-42c2-9058-4d7dd3d459a6", "value": "1536:PwdhxxI0USvSwk/aKKwGGzEV3SnGLAB94dsgT3Asv:PwdWsnk/aKK3GzUiGLGed33pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784640159, "uuid": "e418d21c-9961-482c-8c33-be8464453a0b", "value": 67424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784640159, "uuid": "04e3d583-85ec-4a90-afae-4777d87cd6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640159, "uuid": "c6a45ea3-ee1c-4fa7-b483-5414990e25f4", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569ff9d2-8507-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784640198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640198, "uuid": "1a2d4a92-4ccf-4d4f-a696-8351cf55ef2b", "comment": "Malware payload (AgentTesla)", "value": "f44ea37db819ee43e33195acbf1b225f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640198, "uuid": "cc3752ac-19c8-44cb-b8c3-70f9cb82beac", "comment": "Malware payload (AgentTesla)", "value": "87d9f4fc7f470e4723c6171d4a9fb3f37998663b84ab46965d2d7d4729fc444e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640198, "uuid": "6fc11b10-2587-4911-a615-01e0a178197a", "comment": "Malware payload (AgentTesla)", "value": "1c100ba62fa3524681332fc71af8d9ac26f082bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640198, "uuid": "79268e79-8e8a-48dd-ac6c-9cb8a27a167b", "comment": "Malware payload (AgentTesla)", "value": "b77a96d2c6f3a3b7e47c0930f9a5af614b7498fe52c9c92388c55fad55ca63c01ec0221794a1fc14152b464c1e07b3ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "enogcaen-br-com", "colour": "#A0DD29", "exportable": true, "hide_tag": false }, { "name": "ftp-enogcaen-br-com", "colour": "#0CEBE3", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sambobby--enogcaen-br-com", "colour": "#125F56", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640198, "uuid": "7db935d6-e32b-481a-8d3b-489760927940", "value": "T144E5195296E4511B7361EBDD522DDE78B80E84532819CF90B58EE73C382DE8AE2147F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640198, "uuid": "a7358c84-fa4a-4517-bef7-ae7ed1cdd5aa", "value": "98304:OF2OF+IleVRP+bg/aQWpfUS9lWs0yx7I7f49fyhzrRjT/3LOPpROlcKoKpZE7e9X:gFZYl/aXcS9lWs0yx78f49fyhzrRjT/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784640198, "uuid": "6786b779-a112-4360-89cd-a7640bd3b952", "value": 3291847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784640198, "uuid": "87de126c-943c-48e0-b072-3de169fbb45a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640198, "uuid": "5c9986d6-6a3d-4aa1-aabe-7988bbfd8729", "value": "INVOICE AND PL.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15437224-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613460, "uuid": "92026115-8ee1-43ca-80b0-6573fb447b3a", "comment": "Malware payload (Mirai)", "value": "61a7261ab418ca97440524e159543c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613460, "uuid": "f4f16d4a-8b91-49d3-904f-f91294722b2e", "comment": "Malware payload (Mirai)", "value": "896700e89222787a983c34556c488d3f97e7a71126e25f8decb91ab9680a3bfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613460, "uuid": "a3293416-0706-4446-8dae-ea4273567057", "comment": "Malware payload (Mirai)", "value": "314c88a2a9596e16ae457b23f0ea283765e7fb07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613460, "uuid": "7067c6d7-4feb-4ec6-8486-739bcd7dbee7", "comment": "Malware payload (Mirai)", "value": "c5ef9a9e61b5850f285c047786a9e69cec4930e1d6e65b5de433f10536ac9afd60a9dda215155e6e1e259aa252e80b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613460, "uuid": "6dec2aa6-633a-4b37-b21c-e47934327f6f", "value": "T12A13F2305C459871EE2016B8D8604DC4E3AEDE30A0F871F699219E6B559B23F68B2FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613460, "uuid": "00566316-1752-4c01-a7fa-a27cb234e9d9", "value": "768:YXDPkGaZfhXyB1P5v/k4nJzHcR+D8+yWhjXapwyN2mHZdMs3Uozp:A3a9lYdd/k4Jo+dhjqoOnJzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613460, "uuid": "78eb17aa-d379-4901-938c-1de4b3416f80", "value": 41668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613460, "uuid": "fc2300fe-b2ae-491b-b8be-08c987d80b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613460, "uuid": "37d68bed-00fd-4654-beda-b513db8a5bb7", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7c049c-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784620720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620720, "uuid": "768eb063-d3a9-48a1-89ea-436ac544c45c", "comment": "Malware payload (RemusStealer)", "value": "87b15a6e7e625b2fe0cdf84393dd9009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620720, "uuid": "1318815c-ccb0-49b1-82fa-78570af14f40", "comment": "Malware payload (RemusStealer)", "value": "8981f88f636eeecc37d383a89db09e8d91cc638454d36e6970a5d7df91f8db30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620720, "uuid": "887c1660-b689-4096-b073-316d4f9a2927", "comment": "Malware payload (RemusStealer)", "value": "86992c361e6fc3e01afe9079b14a1ed165d2f13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620720, "uuid": "e1604d2e-cfe5-4c76-ab4d-8df426f4ada2", "comment": "Malware payload (RemusStealer)", "value": "695746ebabeedbd7c5fd0c76e822bc4b317e225c0f26dcf8dc5f3e840b9bfe0364859abc5b596f691a0eedcc8656274b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620720, "uuid": "2bd82d0a-f56c-49c9-8d6d-cc8045621439", "value": "T184C539076CE049E5C0AEA23589B65192BB35BC0D0B3533E72E907B782F727D09E79B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620720, "uuid": "be1f2ccc-fd7c-49cb-b550-023b3201b0c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620720, "uuid": "3866911d-b2ad-4e2d-ba47-38bfb9b4e911", "value": "24576:7jo0XcqMHnjYoyNgykVDfzRMNIQWb19dKxlGJ7bvI1qtxJBele5r9DY7vZ1vrmpd:7joc4HjtymykVDNWIQWb1FDSqKbqpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620720, "uuid": "b1b40571-e076-4c63-8acc-28cc29d7c3f5", "value": 2532704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620720, "uuid": "6df0a289-fef2-4f50-a4eb-549febe44312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620720, "uuid": "ca3383e0-ab06-4e6f-892a-d99e9832c9a6", "value": "\ud835\udc7a\ud835\udc86\ud835\udc95\ud835\udc96\ud835\udc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c448f793-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784612036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612036, "uuid": "fdaa4394-f046-4ba9-a764-e11eec62517a", "comment": "Malware payload (Mirai)", "value": "03576551b9e2f3384dc6b692bac69b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612036, "uuid": "ca8a9ac0-d106-4c5e-bfa9-7be03203e57f", "comment": "Malware payload (Mirai)", "value": "8a13cede7474d3894b0205e889d132f29ccd6f96a5b60bfbad35d5747cdccf55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612036, "uuid": "7a2f813d-e78a-4aa0-b394-c8c43625f90b", "comment": "Malware payload (Mirai)", "value": "e282dc82b40ecf48cfac2e101c12574cac5f0c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612036, "uuid": "627825be-c1a4-42c8-a9bf-75bf86ac2aa4", "comment": "Malware payload (Mirai)", "value": "aed91f55bb654b35b5c2f4fe829f4c76fcf90aff1b0b1282c5958c8d7203b6b0ca5c2da557b2d9a4aca373f6462169f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612036, "uuid": "e32540fa-75d8-400d-8da6-fed80c31fb99", "value": "T1F724431A3E22DF7FF56D827447F38920969876D62AE1D584F16CD71C1E2028E640FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612036, "uuid": "6efb23b4-9577-4996-a44a-df54a765b0a8", "value": "3072:gdIAD7zec055EBFqR7intSRq9RXd05CywYukopnCa+q:gdZD7ycE5EBFq8teqfO5kYubpCa+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612036, "uuid": "291d1aec-1e15-44a0-9ca7-1e254ecb0425", "value": 217256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612036, "uuid": "7acf0091-0729-40d5-b439-636857b97e22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612036, "uuid": "31a91fc9-6ab8-4bae-98ba-655455a3c877", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fb5cad-8554-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784673348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673348, "uuid": "fe260e8e-4485-48c7-b47c-93eab0741535", "comment": "Malware payload", "value": "b09b63589e5c0cc81394b1b54819de9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673348, "uuid": "2779395f-c074-4055-b346-46dadba80e2b", "comment": "Malware payload", "value": "8b50f23c7f09575224f6ff713d72b67382103f24d5c6e91ab2c74c556b729185", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673348, "uuid": "b2deba28-98c7-4b21-941e-a6176bb39e4b", "comment": "Malware payload", "value": "6ccd0538e005c563d4b5b480c16f60dab29acb35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673348, "uuid": "b09831d3-1548-420a-a731-7d7e94f1689c", "comment": "Malware payload", "value": "6d152005cd17cabd4dd178dd667033950b88c3e8179aa35fb0e7c1cbfc31147f9c164efdb9afe1f0f446c3d3e7037197", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673348, "uuid": "a0f24d31-dada-4d6b-9f8b-d8ec5e0420c7", "value": "T10496339993A408AAD877A53F5D25D063D371B8224760D8CF1BE4872B3F572EA3C3A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673348, "uuid": "72dc615a-2bbf-4003-9480-d8a11708d1cf", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673348, "uuid": "e563567e-68c2-4e97-9b69-ea53036e0ef8", "value": "196608:TQpoYtbW897GXPHMe81SF2RPUewytKZ22HsMRqabRgFeDU2:I11wPsZg2Ke3K42HsMRqabYew2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673348, "uuid": "089fc408-a6d6-4f24-8701-a8fdfe1e731d", "value": 8682029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673348, "uuid": "d36ea696-adad-4c80-ae01-8d4809b8134a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673348, "uuid": "ee65da94-7852-4811-bf57-51f222ecbeb8", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2da837-84da-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784620798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620798, "uuid": "e3864c31-cd9f-4966-9ad6-3ef97769d110", "comment": "Malware payload (Mirai)", "value": "929a16335f06de827a3d5688eae11963", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620798, "uuid": "16c0e1a4-9606-4801-b0f8-03add946a533", "comment": "Malware payload (Mirai)", "value": "8b68663561a747c1c8bff7d3bdb7cd48d1f860c189063ee4850b29d7b05cc27d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620798, "uuid": "30a9f235-5f9d-41b8-946a-fff38655e9a4", "comment": "Malware payload (Mirai)", "value": "7608c6de2ad33c55402ad0d106e3485e0c4a6874", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620798, "uuid": "ea50e4dc-7f37-48ed-8ecc-3e33d7d6e5a6", "comment": "Malware payload (Mirai)", "value": "77f4b1012aa1788410f5450167c53124c51c7e83f93b6cb87d88680082b55b160c147812705ab070c9c9f7517a37ac5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620798, "uuid": "83eaced8-952c-477f-bfbf-c2d9dbc3aa65", "value": "T14E01C2D9D2609A004019D52D33975290F431C3C7554B0F647FDC943EEB99E2CF1A6FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620798, "uuid": "09bd301a-4c5a-41c0-beda-f1b0c548e66d", "value": "24:kXCKysE2hi0ziQvZoha6S+izzeXsfwUy7:e9Qp+Ms6Vi/eXewUy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620798, "uuid": "9f372dff-906c-4260-a71c-818f40793969", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620798, "uuid": "90637200-7e5b-4e30-890b-9c04b74cb393", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620798, "uuid": "2efa57f5-347d-4ca0-87b6-81423fed7dde", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c26af7-8543-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784665838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665838, "uuid": "715cbb72-2891-4df1-8d79-5a8eba0cf934", "comment": "Malware payload", "value": "8c82496049dd65950f842b02171b32c0", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665838, "uuid": "c4e8d7db-ed3b-4520-a28f-6bd509053393", "comment": "Malware payload", "value": "8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665838, "uuid": "7b6c45b1-b11a-48ba-a7a2-ccbf226562d6", "comment": "Malware payload", "value": "c79f3ffc6e55121710bcb850f3e6e9d20b0eba61", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665838, "uuid": "525a7bfb-bd02-41ba-9f42-57cbb07af4cc", "comment": "Malware payload", "value": "782e479d970ffe627cd3c47f74bd4879956cce53bb6a3ff559a5ed4376aed290bc6095dac7f4e6b3db3cf9216516aca1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665838, "uuid": "cb667227-fe13-4b81-a15c-7640e5b52b95", "value": "T1D4268D43D65291E9C02BC2BC9E175A727A21781CD834FEBF5590DF233E31B105E6EA29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665838, "uuid": "c5ab41ac-241b-4efa-ab2d-439f0cbc79d6", "value": "69d04b283251e75ebf7bdd628fba938f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665838, "uuid": "696c5086-76af-4a86-a367-84f8896dbe75", "value": "98304:Z1DLMVtjANF8oC4xEyrTVYm8bILHGWCv5IjjPmgDfwxfH+YEO:Z1XUWXC4xEXegv5IjjPmgDfOfH7EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784665838, "uuid": "739ae1ad-27b5-4d6c-a52b-90d5e357f21e", "value": 4734152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784665838, "uuid": "3319cb1b-f92c-4c1c-a2cb-1d674e4de620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665838, "uuid": "bd801aeb-b54f-4423-bd52-af02d7b5e12e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a4f4a-850d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784642916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642916, "uuid": "d89ab3f3-6523-4d1b-ac38-dda4e18a554c", "comment": "Malware payload", "value": "dde98adf48da57891eb39400fe9be870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642916, "uuid": "559b6c7c-7337-46c3-9860-81c3a3f48e8a", "comment": "Malware payload", "value": "8c82070c717903ad67e4a09f881410a4b67c12b74739f355508b3382891e72d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642916, "uuid": "37f8f681-edf1-4319-b18c-81253f757925", "comment": "Malware payload", "value": "78f4f90e48f52012c2f6e23d36f73ed715bbcfff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642916, "uuid": "17c083b1-c8be-40ec-acfa-42a01bcfc47a", "comment": "Malware payload", "value": "6df05892637249974f8260821275674d5ab4f0da8f2d3065f26f9dbf892396b4e58ed195de345b760ad123a98173a270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642916, "uuid": "1c34d49a-b3e3-4a02-b99e-91eeb850a5d2", "value": "T1A3E3F887F901DFBBF80BE376449308157530FFA60C521A72726779AAEA3A0D41467F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642916, "uuid": "dadbf2c3-d273-4afc-a45e-78d04ca3703c", "value": "3072:iD6qlTt2f01KGp7bzQ2PRB6UNTdVsjbitL8oXlyqDbM8x7:O7p8GpXzlYUNTHLfXlyqT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784642916, "uuid": "d50da617-f9df-4f60-9c29-5155ddf61418", "value": 155808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784642916, "uuid": "dadc46b4-7693-4cba-b946-2502709142cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642916, "uuid": "f04ba883-7fe3-4b39-a3bb-5ffb9e13d0d0", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace8e99c-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613714, "uuid": "a7cd096e-b622-4439-9e4c-008de59565d8", "comment": "Malware payload", "value": "cf218cdb1c232a7f3c8042d2abf8c713", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613714, "uuid": "1b3a1422-4e40-46cd-be0c-83748c181aee", "comment": "Malware payload", "value": "8d50245db0afa4e25ac78646c32590170f796056bb4eec7dc7e4ad9989c0ab59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613714, "uuid": "f0fa88ca-af03-4fc3-a17b-72b81100c8b5", "comment": "Malware payload", "value": "b298f87f7582467cd327e4485a63c04567d42726", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613714, "uuid": "5d49e24c-f992-4bab-a00e-768a40e35e50", "comment": "Malware payload", "value": "94a7b34db96b801d175c2686de7e17a39931c6d3d53d1162d72a405d43858b0581399e88d7154996a39c4e5156a8f36e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613714, "uuid": "829530c6-b184-49d3-862b-ed718a12829a", "value": "T183236C551A957C149E98C4361D7E2F0CB9AD43E6320852EE7FCB3CF28C8AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613714, "uuid": "5bf05ec4-763d-4933-9e05-6dbf5ee76b88", "value": "768:QdVEJVIhtMb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:QzEJ2Mscr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613714, "uuid": "90d6c157-4409-4b96-be1e-5d5fc4cb8280", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613714, "uuid": "e0934b81-1e1f-4243-b53f-2a6e3e1befa9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613714, "uuid": "3f0892ae-3a3e-4ebf-9c67-bb473a257dc0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd67daf2-8502-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784638331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638331, "uuid": "df3524ae-ccdd-4a8b-af10-d853bb51bf9a", "comment": "Malware payload (Efimer)", "value": "233e11dfa9f8ef5d520534dc3ffd1664", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638331, "uuid": "bec6c8c3-f041-4880-b4da-c520e893d087", "comment": "Malware payload (Efimer)", "value": "8d5ad5276e320486c83b30b4a13e056769882ad2ab052c515a258daeed16ff76", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638331, "uuid": "b6619d92-163a-4e1c-ab8d-4274134064f8", "comment": "Malware payload (Efimer)", "value": "efed8d27de7ddced21a8c3bdbc2ae3448959b3ee", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638331, "uuid": "a1bd15b7-2563-4256-8410-bc72dcc8c3d7", "comment": "Malware payload (Efimer)", "value": "22b8a4291cc114f386f9ac23a9cee454c58e850f9a95ba708655b374f274c8fa3eee2031c3a6f0c3160455c085f2cb31", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638331, "uuid": "ac35842b-505e-4418-b7dc-96130de12afa", "value": "T123E6330926D161FADEB7403CEED022C6E6BEB8E24B71C9DF476883611E571E10D39A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638331, "uuid": "862c73cf-6c96-4722-8aad-9e4e87625263", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638331, "uuid": "cf2af2ad-4f9b-4410-81de-c645cdcbf97d", "value": "393216:dyoBu/i+yKsn0Z1BrdP1hm9aXMCHWUjXWcuI3/PGTAI:dyj/i+yKTBr4MXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638331, "uuid": "c69153c7-e26b-49c5-90c7-fd5f10cc407f", "value": 14327686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638331, "uuid": "612a577a-2b85-4e6e-803f-0144f8a44301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638331, "uuid": "706b9569-625f-4241-ad7e-23558ef26dab", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d751c4b5-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784615504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615504, "uuid": "62aa3a8d-ac67-4533-8d00-cc7922a71c84", "comment": "Malware payload", "value": "e7d3880ab37b761fb7c313bfd707e4de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615504, "uuid": "aa3ba58b-329f-42b5-9e21-ec6e19bad767", "comment": "Malware payload", "value": "8e237a4708522111c2a4d7a5c3b553e083bc2b8a71af72bb6ce6cac435958130", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615504, "uuid": "8f0bb131-040d-4122-a817-2f7f02200e71", "comment": "Malware payload", "value": "4b5dc1827afa5cc7b44b4d3e77f2308029913291", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615504, "uuid": "948f4937-936b-41d7-b6ab-54c7af909935", "comment": "Malware payload", "value": "b86f5c372bd6d1bde2dfd273055c32fbe269d743011afad42ac57e1cc8b220441830e532fa4ef440a615c61e9e77ddcc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615504, "uuid": "a4dc3c7a-5445-44e9-8002-3d52554027fe", "value": "T1E6C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615504, "uuid": "f8db5545-235c-4f54-ae86-642dfb3b53ac", "value": "768:I8vCB+25j6es8R2Q9FYpMSUpi+20qUpi+20YQX:I8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615504, "uuid": "842c4ffd-0913-4ada-97dc-859f849e1aeb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615504, "uuid": "7a7eb0cd-151e-4654-b85e-47093abe67c4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615504, "uuid": "61ea475a-81a1-4692-b7b6-a7825effb466", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28f8262-84c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784612972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612972, "uuid": "ac66a00d-cbc5-4653-9517-7b883d94027b", "comment": "Malware payload (AgentTesla)", "value": "1351c8b0f91bc0184123103cc81b9442", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612972, "uuid": "a3aa8089-961a-47c8-8212-3c9a0760836b", "comment": "Malware payload (AgentTesla)", "value": "8e7009c4804c4cf7b0192f8c6c7f3e080ebb4a447fc68fc6312b8f5e2f7fe452", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612972, "uuid": "a8da3c0c-6d4a-431b-84b1-af17769af009", "comment": "Malware payload (AgentTesla)", "value": "b8b3f288c7639bed0076986a8d43fc281a5466ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612972, "uuid": "65c5cbc2-079f-4f75-acbf-4120b09fb56c", "comment": "Malware payload (AgentTesla)", "value": "0e87144483ede477c11150f8b808921cf351536f488d68565aa5585abcfae1b922b524fd3af5538cd836947a76137deb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612972, "uuid": "de9cf1d7-d75d-4164-9f18-11067a243946", "value": "T19C06F6006B649572A71EE76CD676AE78880E600331EDCF0C704E96647939D0FB769BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612972, "uuid": "5c33645d-3d2a-4415-95c3-ce543ddf9e9f", "value": "98304:PbDgnOz0yeOG1rUufBk5QssTgJby+o4k3fYQEKsmZNrz5nVsv2wAfujLdptCQc:P5ZArUwkGssTeoLzmU11n+OwAmd6Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612972, "uuid": "ed5668d0-8ee8-485b-a9fa-21d38c7ee8cf", "value": 3712221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612972, "uuid": "51cfd791-2ae1-4345-af01-69e3f9c1806e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612972, "uuid": "23b20cc3-3efd-4bb5-a8c1-cf3bb35f8575", "value": "Info_New_Order_7132026 _PDF.shtml(~99 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6a2030-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784611918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611918, "uuid": "437a79e8-ec23-4920-956e-3a507a573e21", "comment": "Malware payload (Gafgyt)", "value": "cd3577d74f66c877b038cff141b8a743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611918, "uuid": "6707cd71-e012-464b-b7a3-41a13e8c368e", "comment": "Malware payload (Gafgyt)", "value": "8f0a5b5d0d72b8666ba34d37388a03b10e8843e5175bde81b4b80e40965b3893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611918, "uuid": "f642b395-d7d3-4544-ac76-0f6c917f1231", "comment": "Malware payload (Gafgyt)", "value": "30f8226f536683e8b715acd44387f57028f50dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611918, "uuid": "f3e6b23e-4aff-4ebc-b0f9-15d949bc44de", "comment": "Malware payload (Gafgyt)", "value": "acb263170c82ec69a8bb91806806b496aa57b82a6d2a9052bd3fca5243b8034f5e72fcb8c4c4241dc94465c5cfc62cce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611918, "uuid": "c646c6d4-3496-4d6a-92fa-381b7a43f746", "value": "T18F631975B8818F26C5D92677FF1D8388331B23B8E3EA7113EA155F6137CB82A0D2A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611918, "uuid": "41631e6c-a6df-4200-9dcb-a78ece8f78fd", "value": "1536:jVbm7ouCNQNy3bm2PCbmeT1yq3yhYc0NajtZcXAFO1Uc8xjp:j1aouUZTOm81yq3oYc0N4nMAFO1Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611918, "uuid": "3ceafa03-b5fd-42b5-add1-466071ee0ed6", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611918, "uuid": "a757c54f-346f-4227-a4e2-06332954ca7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611918, "uuid": "e57639b8-876e-4119-a1d0-30b3dc7ba6da", "value": "FN6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c110c48f-84a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784596139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596139, "uuid": "977c4992-64a2-44fb-8bf1-5caf6a421897", "comment": "Malware payload", "value": "80edf28f7ec6295cda88970a79ff6efd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596139, "uuid": "b732ed4b-9623-4f07-84e3-d7fdd983e444", "comment": "Malware payload", "value": "901ad9c29b0944a6af9642c4021c80f7959c8d31c7fb7b9a6216e17d12244541", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596139, "uuid": "0ede7bcd-4b67-41bb-a83a-999299aa50cf", "comment": "Malware payload", "value": "274e382068a55f5d8a7da48436f7dd548a8888b0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596139, "uuid": "8427bf4f-71ef-4103-b6b4-0406d13bdbbb", "comment": "Malware payload", "value": "b0150d69a512383b7fa1946094e0609ff18cebdca8ea776b25430b3a4df61cfd9018d915821ee0f27905fc84cd653121", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784596139, "uuid": "1aed3381-f398-4c51-8e3a-014e829e8baa", "value": "T14301CECA8650BD00446ADA5D62EB5294F811C3CF0E5A0FB87FDC5D2DFB99804B026F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784596139, "uuid": "5c31cf51-0891-4c6b-8424-8b2d7abd8f53", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaDjCGutCDljCfFn8CwBtx8ClauD:kXCKysE2hi0ziQvZohaDjEghSKj8E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784596139, "uuid": "e1f71b61-1a33-42c4-8586-da954576103d", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784596139, "uuid": "62991fd6-341a-454c-bca3-0c3db2c60a5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784596139, "uuid": "c6827979-0524-4726-adca-3cb937844fe8", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61963cf5-8525-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784653102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653102, "uuid": "315951ac-2874-4dd8-868c-3e7a4bdd5cc8", "comment": "Malware payload", "value": "f9e334a0151e82980c894c5bd2b5a5d0", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653102, "uuid": "92a1751e-d55d-4f8f-b3b1-a6b3ea39e1d9", "comment": "Malware payload", "value": "907da6987c3fd2115fd62c8dbcba9837cbdeb8dd00851265c601a93261184343", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653102, "uuid": "93809cc5-c6fb-49c9-bef9-b645e5d2cca7", "comment": "Malware payload", "value": "8d264ff6220849e9664912eabde378c0e8757dbc", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653102, "uuid": "00b22345-8b4b-405e-9e2c-25f09f0f671c", "comment": "Malware payload", "value": "e9a09c9486b8dfdaf166554b6ca792ed1a37118813c4ad87def0735f49f2bf5f461e0a3a133f5dfe18e85b3e47152511", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653102, "uuid": "e0dfb1f1-3876-4c4a-8023-3f5f8f4876dc", "value": "T1E0C7336C3F717640D053FA3722762AEF5B486976C603DAB3BB584F2C64E1E2609B8750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653102, "uuid": "e2844c61-377b-4628-aeee-fc359b336a0b", "value": "1572864:0K9oXGRJgg1ebTFhax+hFSb1BVM5RN1TKopG3giB:0KOGjd1CFscFSq5jhQ3giB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784653102, "uuid": "221fc9ae-ed29-4732-a05f-70bebd67c0b6", "value": 53452434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784653102, "uuid": "9f436131-c7a3-44f0-9468-d183c072e847", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653102, "uuid": "d2183627-637d-4c4a-9b97-2696de7a24a8", "value": "OmniSpeechAI-Detect_2.5.4615.0_x64__sh8fphax66b9m.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe2c034-8513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784645529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645529, "uuid": "23f6e5f3-f661-41f5-b69d-5ef6c0610006", "comment": "Malware payload (Efimer)", "value": "2ab072b6180ecb124b4ab969f529c167", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645529, "uuid": "90a49a60-e959-4149-8299-11483c230a34", "comment": "Malware payload (Efimer)", "value": "9099b97d2d8dee71f2fb394862aa02da55dc69a85e5da3c92b933ebe1bf6f9a5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645529, "uuid": "9ab5a03a-02a0-47f1-8c9d-a22c8a2124fc", "comment": "Malware payload (Efimer)", "value": "353357a71b3e233a8b0411a0ed470fd05f5ed323", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645529, "uuid": "1f011c97-3c24-406f-8042-14e15ef4ecaf", "comment": "Malware payload (Efimer)", "value": "1acf698da84551730e40f10bd5e7ff7bc99482fe52010eda79977c20b3b42dad3310e2b4ff3f160c798ce9ba0e2989c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645529, "uuid": "39c1478d-f40f-405e-9527-ff973f8e7a94", "value": "T12BE6338863E012FEDAE38038EEF01295E529746A8B72C7EB4BD493B19D171E44D39753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645529, "uuid": "9e7c0014-3f41-417d-8c75-2938ba2374a8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645529, "uuid": "2c3d3bce-9f0b-4b1a-8daa-b86b3bb8e13e", "value": "393216:pPKbiInvl+CLsWOgUXMCHWUjXOcuI3/PGTAI:p94+OUXMb8XjH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784645529, "uuid": "08c32d63-0aa8-494e-ad01-a519c2ef2dbb", "value": 14314817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784645529, "uuid": "81bbf1b3-449d-4b7d-b8f8-a96d2efbcc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645529, "uuid": "4f509418-3ac3-433f-9ca6-bff8a91ec759", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95596ee-84c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611561, "uuid": "bca0088e-f377-400c-b562-217264bbb56e", "comment": "Malware payload (Mirai)", "value": "c5dc0cc85374777946cdc778e6218f2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611561, "uuid": "d5d83db6-b192-4950-9e5b-e400a3a582b9", "comment": "Malware payload (Mirai)", "value": "90a55e49ae16063ba7e3fbf16ad96cb00b6a5f09ebccee6a1bf66b59f1465994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611561, "uuid": "675e2d97-0e70-4630-855a-566a3dde214c", "comment": "Malware payload (Mirai)", "value": "45a23623234b69692b06f126a8cf90255bef0d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611561, "uuid": "41bf1fce-45b5-4d0d-821c-0caa781c7c22", "comment": "Malware payload (Mirai)", "value": "de06892dcbf65cf114c2f9ce057efefc1e08670c4122df81fdac97b4e853251bebd6c2347a1b0a8f07bc1ddcc68ddd26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611561, "uuid": "85ceb51f-5b26-46f2-ab3c-42f2e64729f7", "value": "T1AFC31986BB83DAB3E55314F002B757360B32FD3A5836EA85E3787DB099525D0A60637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611561, "uuid": "41a54f59-2995-4a72-90aa-a81f3689d953", "value": "3072:Hg6Fn7YSdHL6qMBp61wvgM7BhdPHDsj0G:HnbrNterp/DsjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611561, "uuid": "2e8fdb05-5f4a-47e3-9b74-a65d56038fe8", "value": 126712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611561, "uuid": "67c22699-83a7-422e-9713-a1f274e7cc09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611561, "uuid": "5344eb0f-3b4e-4ac0-911f-e63432a02181", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c4672d-853d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784663529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663529, "uuid": "f0197da4-6efb-4943-88a1-2e93d0984052", "comment": "Malware payload", "value": "108834f2d3ba6a9731c100c4f30a2825", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663529, "uuid": "b096b832-ffe6-4187-abe0-b2d1e7372db2", "comment": "Malware payload", "value": "90c46ec7e2400e4999afe7ad56f205afecb41041493ae2884c76666a77c82f8b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663529, "uuid": "eda82ce1-f12e-4f5a-b21c-f89f3200eb42", "comment": "Malware payload", "value": "e45bdb988bc5dea61cb4833323bc2adb09568b6c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663529, "uuid": "4ee8f7fb-b8bc-4515-92fc-da202b6a97ff", "comment": "Malware payload", "value": "ea08eaca2b9ca21677e030ef1ce4d8da5a3b9165b587624d7661e294dd27073e9235e8b6e933d1edff65e69426ed8670", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663529, "uuid": "fdce3bcf-c80c-41ba-a1d1-c6f6f650f3cf", "value": "T127E63368BAC802EFE1730078ECD25985E95474A65F72C9AB53DC9BB16E670E0CC3D712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663529, "uuid": "131c99aa-347e-4b6a-a78a-5da9f52b0ee2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663529, "uuid": "35865de5-6531-449e-a69f-864ed43111c9", "value": "393216:JAtoLGdvtPua5UHQoytHzrHsbFvXMCHWUjXmcuI3/PGTAI:JAeLG1tD0stHyFvXMb8XbH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784663529, "uuid": "b5c0c9ce-7754-4753-bb51-f186026c481d", "value": 14320323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784663529, "uuid": "ef6d0f42-61a2-4af4-a133-9608526e6e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663529, "uuid": "51c51d22-5c00-4e2e-9e71-3bfb58580eb1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d330d43-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload (N-W0rm)", "timestamp": 1784672717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672717, "uuid": "b3fb9239-a107-44e5-8a00-90072e702a4c", "comment": "Malware payload (N-W0rm)", "value": "895c99e22e6da193dcdc7b895f53217b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672717, "uuid": "a02b42a2-ab0d-452c-8842-738b9e58c572", "comment": "Malware payload (N-W0rm)", "value": "9236af4b0d79c2cd99e098b7e599106d85f377af7f2cab91e2cf733bfaeea43b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672717, "uuid": "e3ddd111-0ac0-431c-94f3-75ffbd8e27a3", "comment": "Malware payload (N-W0rm)", "value": "65a887df163d492e207378e28962c059d5f075ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672717, "uuid": "157923ac-2c7d-404c-a41a-7b5ccacd4984", "comment": "Malware payload (N-W0rm)", "value": "b3565156e46c3a62eccff13c1cd2ee3b97365cfc8158ce2fe3fd317417c14162aa09a1901d84cf2e1573c55a33a13944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672717, "uuid": "7e836221-4c75-4a8a-bfe6-210259db9989", "value": "T1AD66223FB28B653EE17E5A367AB2E110583B766165124C1696F0C88CCF164B02E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672717, "uuid": "361f512a-eb32-4a64-930a-731db6f74c70", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672717, "uuid": "758c7d5f-bcad-471f-81b7-647d13652c16", "value": "98304:z5Od2hNc2L7LiQhKlSmHQKzwpmwPFfdMA/Ky/4ZwD8GD95nXXgnov1M9tTG7rkQY:NlXKz5HPzwpmaPwZwFZ9tv1eWoQZNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672717, "uuid": "55a07017-16ce-44c2-833b-ecf6774f5ed0", "value": 6845376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672717, "uuid": "a896bca4-4b43-4c95-a5f9-f12e7260d7c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672717, "uuid": "2b01ae31-d289-4458-af72-0beeb7261b47", "value": "9236af4b0d79c2cd99e098b7e599106d85f377af7f2ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb87515-84d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784617095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617095, "uuid": "0cfda2d0-b81e-4cbf-a4e9-73a1beeade8a", "comment": "Malware payload (AgentTesla)", "value": "dda06dac764df47dfca1fa34900042a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617095, "uuid": "27359f2f-7c76-4f62-a98f-524fe79a7dae", "comment": "Malware payload (AgentTesla)", "value": "9355412abe08d3781913f925945e2b93713961b95df327b0f153c29dd3483f0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617095, "uuid": "0325f724-a8df-4a34-ab1c-9d7a12a4b0c0", "comment": "Malware payload (AgentTesla)", "value": "1a03566116122f267b9eae418701679774934f22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617095, "uuid": "8c903063-9871-4b90-9aad-1748dfa4811f", "comment": "Malware payload (AgentTesla)", "value": "f103b7975839d058cb85f30481a045559d5df2e88c240b7ca4a44bb31d7f43bb1d60d2e79629182f93f5bf7cf1352610", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617095, "uuid": "d6815823-8760-4efc-bca8-0fb59a375bd0", "value": "T17CD4238133C5DE07D49696349F2197BB18E2EC354A95A3ABEB603E1DBD302D17E2F241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617095, "uuid": "afa9387c-5d22-43d8-94f7-c82e73542c5f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617095, "uuid": "98f450a6-edfd-4ccd-9357-cecb82e5e1f9", "value": "12288:3X42d3t75NkEPa6Cmy3LtqZlaaU/EhXxzGCL1TjjkagBi8/jDv/4XYh:n42dXN3MbqlI0xDLdkagz/jj/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784617095, "uuid": "b48774ff-44dd-4e1e-a45d-0c9a20d0cd19", "value": 626600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784617095, "uuid": "f9351f65-f024-4747-9043-694ce871247e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617095, "uuid": "fb4ef254-c6d1-41f1-826b-3c83ef845320", "value": "SecuriteInfo.com.Win32.Evo-gen.29712928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a283f506-84d5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784618851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618851, "uuid": "396e9e11-5e0c-467e-ae0d-bf5cbf4fa971", "comment": "Malware payload", "value": "d474f229ec62b7d1dd2abffcb4e90db0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618851, "uuid": "1b19ffab-3bdf-402e-a517-cdd5e1aaebfe", "comment": "Malware payload", "value": "93782e231819d6779f32dbd24f37f3dae97df75e63d300dbb4cd78ecd81919dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618851, "uuid": "441a1bb2-e4f1-4f9b-b705-429e235064af", "comment": "Malware payload", "value": "ff5dbe6a80c14a16455e199e130a5b3909ad054e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618851, "uuid": "fcf4f1cc-6655-475e-96ed-f505cdefd549", "comment": "Malware payload", "value": "d66305c084b8156f7065c4cbb3e19748b48e6af308a928f777c7e4e49dbfcc254e0d20fde4a758af03ab85c271e37bc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618851, "uuid": "3af476b5-e33a-473a-ac2f-33592d780284", "value": "T156237D652A857C14AAA8C4371D7E2F0CB9AD43E6320452ED7FCF3CF68C4A69D921871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618851, "uuid": "375534d8-6ca0-4078-a337-18d0ed4867d5", "value": "768:vXOGVvd9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:PL2cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618851, "uuid": "30902787-52be-406f-bdeb-2d0eae6b74f0", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618851, "uuid": "a16e26bb-f63b-402b-b633-0af2107af7c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618851, "uuid": "967fd9d7-65fd-4125-91af-2084a6b76b3f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559c5172-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784620440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620440, "uuid": "5ba8a215-1d77-4b8d-8a29-bb422afaa056", "comment": "Malware payload", "value": "a5b754040708f0698ec2b973700d63c4", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620440, "uuid": "d0cce7e9-7cb2-4f59-8f4d-a93380e3f858", "comment": "Malware payload", "value": "93f7204a0e6c353a429ad391e9b0f99d911d350786446754163b2cbf17d02e11", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620440, "uuid": "8af58380-4e64-489d-8986-cbc0903f0bf1", "comment": "Malware payload", "value": "f886e193902c6f1bbe7153b6d6d4fcaecccd006f", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620440, "uuid": "e7b1377c-5ccd-4202-ab95-afcd04cfd0ae", "comment": "Malware payload", "value": "7fa9994e9a21d99183c165bd3f985cee1b966666379ecc84898b80bb95f245fbea82c5ad85400c1dd25de0fb9e7094ed", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620440, "uuid": "4e1c77d0-1da5-487e-8fd6-05d8c4c6980a", "value": "T1D21733B21DA4490FCAFB5DF703D002621B8E8B310875D5ABBF5E94E9F76E642820D359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620440, "uuid": "0cc08a50-eed5-42fe-b703-e304df2aaa8b", "value": "393216:mijPr0EBx+gtzeZMi/IEUdkJlK4cgEfAXNY0CR79hcXv+SYM:msz0nIeu8JvXe0Cp9hcXv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620440, "uuid": "562bcce1-e221-4670-bac5-68a285f69b49", "value": 19144704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620440, "uuid": "bc8c7975-4587-4763-8084-c70362839706", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620440, "uuid": "831de9dc-8bcc-47e2-84f7-07613b8c60c3", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a9ee30-84e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1784626460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626460, "uuid": "9b1f26cf-7773-4870-9a01-104432f7d0d0", "comment": "Malware payload (RatonRAT)", "value": "b11203d84388f194cf7db36c0c2f20f4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bore-pub", "colour": "#6FD501", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626460, "uuid": "f2e9aa9c-8531-4d51-8587-f1c22b3638f2", "comment": "Malware payload (RatonRAT)", "value": "94072aa98faadb3a2f27fc10857c943713fa55a5f7ca41d3e81eb63474f9ceba", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bore-pub", "colour": "#6FD501", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626460, "uuid": "748510c8-92b1-4d0b-8aeb-33dcf7c5cd23", "comment": "Malware payload (RatonRAT)", "value": "9d89d108cb5e679d32be9af7f677237c11ec2256", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bore-pub", "colour": "#6FD501", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626460, "uuid": "a37b52c4-a575-4938-afe7-cee9b16bdef6", "comment": "Malware payload (RatonRAT)", "value": "32d05a3a52298529c3c6f78bc0ed21e270432acfea3454d8793aa877e7992ae310fa036f96a62ef4ac230c9c06fb43a9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bore-pub", "colour": "#6FD501", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626460, "uuid": "0611cc30-9726-4fcb-9783-d7efb2316fb6", "value": "T17B26E47177396C738939578ECCB9696A3CDE088703227C20E4CEA1B9E1607E17F1D996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626460, "uuid": "a5ef6d31-ebf4-43a7-8103-2e99bdc2e4f5", "value": "24576:Jyuegp/XJ+QyJieoS39X0BOki7tY7rhuKytmmQn5gzYKIblTAHUqZsjHOynXNoSX:23V0Bpi1On+Y7r0mu8NWdBnYufJUtUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784626460, "uuid": "9fffd47f-4632-4564-a579-638980ebdbda", "value": 4612793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784626460, "uuid": "a9e652a2-d037-4fa7-b6d6-ebac4e80cbf2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626460, "uuid": "d8d9603a-a01f-44a4-ae93-615fdda1f237", "value": "Zentlegirl.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ce0af2-84a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784598756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598756, "uuid": "d5d7fcfe-360c-4176-ab4f-3464abe34c68", "comment": "Malware payload", "value": "dceeadcf0b77afca511c5a8caf653b0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598756, "uuid": "be9aacb0-5fed-464a-9c37-cd04cf5b06e0", "comment": "Malware payload", "value": "941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598756, "uuid": "609f0d3f-92de-4c34-9867-8a5155f39698", "comment": "Malware payload", "value": "87f75ccce73b499013e72bac644f174f21d82027", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784598756, "uuid": "20f1ba06-b257-4a52-b80e-a719db13da55", "comment": "Malware payload", "value": "533a2a342a21979a9700dd3aba69fd3c702d0cd526547c4b292f7b11e79df03eb3498074a3ff7a722055d4266b0cb216", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598756, "uuid": "247c1535-49b6-4d66-906a-b7252bfb1102", "value": "T15801ABCAD250951085699A1E669762E0B430C3C6169B0B687FACD83DEB9CE14F16AF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598756, "uuid": "f08d7380-ec41-4521-b9ca-5f6b3f720aa4", "value": "24:kXCKysE2hi0ziQvZoha1a8UnMar2jF7727:e9Qp+MsxUnMaKjVC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784598756, "uuid": "2e51bb41-08e3-4ebd-afad-64f43cac7039", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784598756, "uuid": "397bd162-0931-44f8-a075-dc176eda245e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784598756, "uuid": "b3ce5ba1-8cbb-4e8a-a322-4be79f658a10", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e64b1e3-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613046, "uuid": "addd9113-80b8-4c9e-9dae-8b3d2f4d41a4", "comment": "Malware payload", "value": "851943f11dd1d8b4b48f2f6c0bf293d3", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613046, "uuid": "a9d1a3b5-7125-4427-834b-8cabc2e32b45", "comment": "Malware payload", "value": "94368f124d5d21b6821d69b3a481f683a6a20a44bfa214e49341e7951a66f796", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613046, "uuid": "9b5adc7d-70d2-4a2e-9d3b-046d85201d86", "comment": "Malware payload", "value": "81e655f33efef0dd0878fff6c0e5876ea74d4fa4", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613046, "uuid": "4788ce9b-e424-4825-811a-4ae6b174ca95", "comment": "Malware payload", "value": "6cc0348e8c865116be6b7aebb2e0237533686d3f9014eb805c53c5235285683353a17d35a930c3ffe319b9fd010bd3a8", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613046, "uuid": "4653bab1-f8a2-4d56-aaa5-b56589d578ee", "value": "T1AF840202EBDBC0EAC189F07406C6B4729D31FC379265ACCB57D19B24664DAE067CE366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613046, "uuid": "ad2c55d1-372f-43b6-a3e0-86cb990ec479", "value": "b27c08f159df6bf992261e37c96247ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613046, "uuid": "44082890-60ff-4f21-99e1-4a212a65035c", "value": "12288:kvVbLY1n/Z+6fPixwaxdNI7nRPbCta9mFHz2SyKZoyi:KKn/eNGnpzsz2SZ1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613046, "uuid": "d0ff8f07-7311-4f06-a8b2-0bcbfdf5b0de", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613046, "uuid": "545baac7-a2de-406b-b873-1b05daa1135d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613046, "uuid": "34f99f24-6992-4e9b-9513-47bbe542cba9", "value": "RFQXXXDescriptionXB35O-18342,PDF.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ace6cc-84e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784626002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626002, "uuid": "88cbcf0b-56fa-4ca4-8f54-747e5681929c", "comment": "Malware payload (Vidar)", "value": "6b221b36033a0dd80277ef6082228b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626002, "uuid": "44bc164f-30f6-4e4a-a31a-318941a054e7", "comment": "Malware payload (Vidar)", "value": "94459067a2a451a1683b910ddc5f83b5ec4f720e0af186c62f7d0ce03191af26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626002, "uuid": "6cf4ec91-7eac-42b3-b5d6-ec6b1af9973e", "comment": "Malware payload (Vidar)", "value": "b7922019d3ba2b176db28553c1d475a5f6280529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626002, "uuid": "8af19e0e-faf2-463e-8fd7-f3d0e62b80cb", "comment": "Malware payload (Vidar)", "value": "c7935bc066ca1179e3479eff47fbb056da86a8aac28e385dc6040275c9f2cb59340f0b30a292c573f2603625c71a013e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626002, "uuid": "878cf16d-e114-4231-aeb9-8797075e6679", "value": "T10F269D07EDA109B5C4AAB63688B742017B3CB84F9B3233D72E616A753E767E14D39314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626002, "uuid": "64639d1c-39a9-4513-9691-83afe557dbf2", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626002, "uuid": "b6e01d13-5727-428b-854e-a83615eb41b4", "value": "49152:P3Ha12oyL9VdwVZMDEJRm4q1iiyi6rGXquEG4zJJcYcJ3E37DWKJjvOvi7v7tRD:Pu1R5qA7cCqOjCORD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784626002, "uuid": "26da27fc-aa72-4cb8-8c31-540c1a413ded", "value": 4807808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784626002, "uuid": "787c5e66-56e1-4b5f-9f2c-70b2c81094fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626002, "uuid": "810409e9-7dc7-47a8-a652-32c8d1451e0b", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcf33e4-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784614840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614840, "uuid": "f05c3b12-b35f-4fe7-8ebd-3e3c764bd6ef", "comment": "Malware payload", "value": "41135fecbaa8e064315518827a2e3e7e", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614840, "uuid": "0b72ab27-da12-4ca5-a736-d66f95be1948", "comment": "Malware payload", "value": "945d7fcaee739e2fd847286e8e243c7cd14b537096d0abc243211244bd75f511", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614840, "uuid": "5fdfece5-9ee4-432a-8654-a1502b1f8fa0", "comment": "Malware payload", "value": "8595e840f2bdd065b3838a9f963a9f5f11ac56f4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614840, "uuid": "c288ef20-fac8-45f5-9007-210be9673eee", "comment": "Malware payload", "value": "baa2278f3e2e8ba1417a97825d54535c515efa23df30a50004d6d0f03a2cfff215a2ca1efd3297328b8382a56f767de3", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614840, "uuid": "bc189508-2a77-4bec-b6ec-954e40b09ed4", "value": "T1F1A3039348974072E27209671F9CB9B860EEA3CD9933749145CE36E8CF8B573E570CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614840, "uuid": "3dd8ca6c-c928-4dc5-89ca-c15b766e99b9", "value": "1536:NjSBqWT9YaureLOOBzGczmsmyUmMEGuYJlzEEpYKVfHXCr:CBW1r+OOBz/mjyUmMEGuYfzEmYs3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614840, "uuid": "c42ffcbd-c89c-41a3-be67-d88335417dd6", "value": 101564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614840, "uuid": "e7375740-8af2-43b6-9d62-161c08d725b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614840, "uuid": "9d6b54f8-5fa3-41fd-b4fd-a5cf8fda933d", "value": "Quotation QU245853 .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc59d7ca-8543-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784666246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666246, "uuid": "1aea4732-120b-4fa1-a3e0-2200b1a8f88c", "comment": "Malware payload", "value": "ae959a98f0f477b1009ddebbee7cdf38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666246, "uuid": "0eb70849-2274-4faf-870d-7ada95d43df0", "comment": "Malware payload", "value": "9539c6ce1df04714b2d3d44813611a6b7c39afa2be5a592ab9a16361d0a3445a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666246, "uuid": "aed5185e-1b6d-464b-84eb-f5524237f4bf", "comment": "Malware payload", "value": "9cc8d32da3609b26b989b8a5c2391952fb942c89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784666246, "uuid": "fdb3690f-54b4-4fe8-a29c-96d1ae9112ed", "comment": "Malware payload", "value": "c8ee106fad12f0c4a077d624a9d8559e9b49fd5668afb187474c18652ab8a30304879b7ac2f819791c50a9e3473a1757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666246, "uuid": "fd3a7c80-2830-46ce-8abf-96cd28e810ed", "value": "T1A9632A76B9919F1AC5C52277FF1D4388335723B8E3EA7113EA156F6137CB82A0D2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666246, "uuid": "f20a6bfe-6d57-48b0-8252-3b4331617b51", "value": "1536:yfjOrmV4LSw1zAyKsYapNPSbAb1Svg/S7H8WvJZczdFG1UU7ibC0fF:yfjOrmSSI8o1Nu+1So/Sj8ozYdFG1UUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784666246, "uuid": "4ae626e5-793b-475f-bed2-1e853d0e9ee6", "value": 70940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784666246, "uuid": "444b32b4-821c-4f35-9c2f-9f7740ee08ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784666246, "uuid": "a23ca1c9-848d-421b-a3e0-73ff9c8a78ab", "value": "PYdl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f2b189-84d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1784617107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617107, "uuid": "375c36b3-b0bd-4102-be1d-e7308eec27a3", "comment": "Malware payload (DonutLoader)", "value": "97e8547c52abd5aedcfc106cfa93aec4", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617107, "uuid": "bd9daaef-3977-41c3-a076-9308b570f66d", "comment": "Malware payload (DonutLoader)", "value": "95821f98505ad6076ee47fb16453283f5191288be89197974f3b50362354a0e4", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617107, "uuid": "0c978ba1-d076-45a2-b919-0f9a1677c407", "comment": "Malware payload (DonutLoader)", "value": "60dc099c833b0a359e291c2a4ef102557f88ad6e", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617107, "uuid": "4b50603a-1fea-4c09-b34f-dc036d9de3fe", "comment": "Malware payload (DonutLoader)", "value": "09b59d12d54876c998e694e6fbded8aa785bf2fc5682c7b7b0145eb2e2d7851a2f0285ff820c424140f655158477a00d", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617107, "uuid": "1c658e78-9135-40cd-9d56-d25480012843", "value": "T1C9468F616E5859F5EF8C290E90AE6F1D87F042176A33706BFB41DF04BEDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617107, "uuid": "392d69db-0903-429a-a929-d66294fb963e", "value": "24576:wquWMIFXGGh5r22jm2geg583tt+l0UyksKnx8j1u00sYNDXvRZx2BJ34xAmmsW/F:HKiK+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784617107, "uuid": "d6c8fc17-8ba9-4107-8ad6-8d5415c25534", "value": 5488179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784617107, "uuid": "76b890fa-dc07-44c1-81e9-191028e29495", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617107, "uuid": "d377ffba-8d76-4c06-ba17-d01b6a83a56e", "value": "Order description & specs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848f115f-852e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784657026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657026, "uuid": "4ac10633-316b-4dab-9794-d6fb8d09b69f", "comment": "Malware payload", "value": "1426db43990a0654c21b3f543fced7d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657026, "uuid": "43c2f27e-1ae8-4a71-b05b-ccb6dce63356", "comment": "Malware payload", "value": "963b6abbcac6e22e2abf2dd373106732caf7c2be40f5319c5bb8d1c8f784fb68", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657026, "uuid": "13c77638-676f-4e5f-a201-1e212da330ee", "comment": "Malware payload", "value": "fd904dd6793716652c617a1b7fdae39133404bde", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657026, "uuid": "0c445afb-f56a-4b99-ae5c-bdfeaf62517d", "comment": "Malware payload", "value": "844158376aba3df2557eb2167b79481d7a9d784055701d72c2b428a80eb0da7dd6d6fd1ffc4419decb70c95c27fcc8e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657026, "uuid": "7b82315c-825e-434d-b383-a7bdc9a00ce9", "value": "T13F236C551A957C149A98C4371D7E2F0CBDAD43E6320852DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657026, "uuid": "713770d3-2c5d-4bdf-a4cb-2d723b86beb0", "value": "768:8VEJVIhtMd9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:CEJ2M+cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784657026, "uuid": "02307562-9112-4fe1-a3fd-7926693c63b8", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784657026, "uuid": "745a13e4-5625-4592-94b8-8e4ab7092aef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657026, "uuid": "c6a77d75-eb2d-477f-8932-724ee6717a44", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bc745a-84b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784605373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605373, "uuid": "fb5e31a0-e147-4a54-b2c9-4498c0969c98", "comment": "Malware payload (Mirai)", "value": "050ca58f47acc067ac400b9f9ab07fd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605373, "uuid": "4cce274a-8a9a-405d-aa54-5ee6d02b3a26", "comment": "Malware payload (Mirai)", "value": "9650b84c44403decb656beab529c70fc1ec02bafa9d70f7694c381998bbea22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605373, "uuid": "d3879d6a-4cb9-4b8b-b8d7-b7efdad060f1", "comment": "Malware payload (Mirai)", "value": "d2298aad53870adadd0a8c7700748586fc689c9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605373, "uuid": "b75222bb-0422-4da9-a393-861e91794b3c", "comment": "Malware payload (Mirai)", "value": "9baea4fa2782f92250ab7e49e5330c9f7718585f356db113b1e823c9a070d62d0c6c480b0d499003c9942ec8eecf4ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605373, "uuid": "93c9a293-62b9-47f6-ba78-c7aae2ad60cc", "value": "T1E633027257AE6DE151B09737FC32EC1A669C17F8996B30DA2CF09A1973C58014EF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605373, "uuid": "bd4c0498-c517-4c44-a274-e6c749bd9c82", "value": "1536:d9O/ZMAXIxNUk07LcPqF1aBexo4opKZb5:d9O/ZNKy/LGqFUFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784605373, "uuid": "3a94893e-2773-4707-847e-70373bfea364", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784605373, "uuid": "ac205928-22d7-4383-8301-51e38c1b0ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605373, "uuid": "61e34d7a-e1ed-4f85-b029-4e0f820adbdf", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05a89e9-8539-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784661797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661797, "uuid": "23c5a3a6-8955-44b6-8e70-8765a44367e0", "comment": "Malware payload (Mirai)", "value": "a2f8224a60a5c8e35311cc1bf08ae873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661797, "uuid": "4dba7dee-cbfa-46ee-8a43-1f6f7ecdd4b8", "comment": "Malware payload (Mirai)", "value": "9697a161278f262022eb0cd80ac97e2b83349f79990fd6547d452d40cd422969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661797, "uuid": "3663f2b4-628a-43b4-988c-86be0a12a591", "comment": "Malware payload (Mirai)", "value": "9a15d2ea07c63db9ca7fca4e715d1f970fce7b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661797, "uuid": "56115ca8-0d7b-4583-bda6-91ad247e4e03", "comment": "Malware payload (Mirai)", "value": "c24484671327781d43200ac2ebd849d78f2406db3d8265e9a92349d055ebe9b2ec83b0ab78d2decbf8c0a91c902a56b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784661797, "uuid": "3ce77d95-278d-416a-a472-3b22cf7b6b4d", "value": "T11FF3875E2E228F6EF67C873147F74A24976923D623E1D684E2ACC1142F2025E545FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784661797, "uuid": "85127bab-4526-4cd8-b177-af384fdd526e", "value": "1536:vS2crQAB/bF1X+Cw3taQG6wOkL21vYs1ReKF04AyQoIqgT8F7muXvu+xR5Sm:vM31XAdaX6wOkLQvYs1W4AYB7hXvu65/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784661797, "uuid": "5de036b1-3722-430f-b8c5-481370008b3e", "value": 166320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784661797, "uuid": "6ba676b5-a1e1-44d4-92ef-4b09f3b100c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784661797, "uuid": "c26ac9a4-b05b-4ae0-ad68-26b59a07a7f9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5041c5-854f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784670999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670999, "uuid": "f2f634d5-dcfc-4fc8-8977-490a70fd0ac2", "comment": "Malware payload (Mirai)", "value": "797ec97c7e2d568cf24c012fe9660b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670999, "uuid": "afb87e94-6fef-409f-8355-05596b962856", "comment": "Malware payload (Mirai)", "value": "96d70bdb604934486925179ec1113832e0492b8fc5048f4f1e0b3c30ea2891f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670999, "uuid": "b49354cb-2f08-4851-bb1c-8f84183e372d", "comment": "Malware payload (Mirai)", "value": "a6da87865bfcd8ac7b358305adb87119524cc09e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670999, "uuid": "95939eef-2571-4d01-8e01-fc20928fa063", "comment": "Malware payload (Mirai)", "value": "8126d63cb2fb973e8a4f4dc73dec667e2b37df9ace670fd606d86746f9c75c2e84de0955441fc74d5912a6b3f939ac6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670999, "uuid": "81b00ed2-346b-46bd-85e6-d1f50b6f9e06", "value": "T15C83092ABD409F05D4D526BAFF1E434933535BBCE3EEB112EE141B25278A92B0F3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670999, "uuid": "35f03424-4f71-4395-9273-26e80bac82fd", "value": "1536:hDn4Qa8T2Yu0kE5PynmXXe3hDIzLAP6FNIOvgRzuqTllG7iDN6akZ9a+:6Qa4jkaVcdwAP6FNIOvgR1OWN6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784670999, "uuid": "9d473d94-9157-4d6e-922b-ce98502bc435", "value": 83740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784670999, "uuid": "f5af8e69-8492-4217-b7d3-77dda4c8c856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670999, "uuid": "77482952-27b5-4a48-9792-554378dc7c0e", "value": "Chfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd79258-850b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784642140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642140, "uuid": "88f6d88c-e43c-40a3-8f63-4c91fd4fbf75", "comment": "Malware payload", "value": "319f3c3edafcebfa727476e7ab393e55", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642140, "uuid": "66b571d9-3c22-4dc0-9dc2-038b2790a62c", "comment": "Malware payload", "value": "96eed3775bfd7e33d6c1bb339f7cb2c6b9119e3172215835b84d33fa1f45e643", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642140, "uuid": "31c3f316-cb12-4e61-aac4-262cd3678cb7", "comment": "Malware payload", "value": "9df366d56d792cf2a9b7b1b588405f061a1ad6dd", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642140, "uuid": "f14df4d9-aa55-4af1-b723-6e9ecb7ade43", "comment": "Malware payload", "value": "df65fcb66a79e881c48ffb479e5df3b1392008bc404af8626116ce9fa6039cafa13484bd10954d1d3c482ba0cbdd11f8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642140, "uuid": "516adfd8-645b-4aab-bc47-eb95b0b37878", "value": "T13D85335396E88467F6A7377CA9F12323B2793CA01B7393DF66406A9C29337C25531722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642140, "uuid": "45c245b1-c2eb-4fbd-9a76-2405336efb68", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642140, "uuid": "b0d76851-06a8-4112-b97a-ae5e23a0d7ff", "value": "49152:WkfovDwaxCH/WmLWoi3xS0TASv9hiXScH4:2Eu34crv9YScY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784642140, "uuid": "5f6623f2-3468-4be2-b904-ec8d3070daba", "value": 1767848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784642140, "uuid": "55f2ade9-c11e-49f6-8d04-0f3943aaab72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642140, "uuid": "897c8edc-9032-402d-b7d6-a9ff84efba00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98b425b-8532-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784658833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658833, "uuid": "eabea47f-a1ec-48fc-8013-ba3cc3697dd0", "comment": "Malware payload (Mirai)", "value": "9df5e10bc9031f224ef0fbbfe5589539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658833, "uuid": "7eb58ed2-da6a-49fa-a95b-c2daf6c86e94", "comment": "Malware payload (Mirai)", "value": "96f31f83928d686ac340769de5724dc5046afa568f92bd28dd9afc0f62c506a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658833, "uuid": "f48c8aef-f06e-4e46-85b8-6630b4db3a53", "comment": "Malware payload (Mirai)", "value": "75ac31bf33fe8bc01e0b8549e0e07e6876fc681d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784658833, "uuid": "4d801ddd-626b-477c-9586-29105005f4be", "comment": "Malware payload (Mirai)", "value": "ca8832fd699c0f7e87dead9d6cd46bcd93fb15a600a75de5f3bfe2e3a64bdc9973683ca28440d79b972d1c97fe28b4c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658833, "uuid": "aa72f44d-2254-4cef-8b9b-5ab6ffc441cb", "value": "T1A9F3D80AAF510EBBDC6FDE3706E90A4639CC944722A43B753674D528F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658833, "uuid": "554ab0c2-dffb-4fa2-bfad-a1b7525e3827", "value": "1536:y7bF7LFThOe26U8ZarGKtuJr4d4DmZE515ybaJooURhom0Xpjskgx2WvCsnnDgyX:yvFHPOFb8X4mXEbacaZm2s/nD7klgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784658833, "uuid": "a3b150f0-e362-413f-b054-0048ea1923da", "value": 168944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784658833, "uuid": "1d265cbd-b405-4eaa-8aa8-b3195f73f3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784658833, "uuid": "74085304-6692-478a-9bf0-c43cf955f1c3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16332f7-8516-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784646820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646820, "uuid": "d72f5291-791e-4ec7-abc4-87ffe9f0d3b0", "comment": "Malware payload (AgentTesla)", "value": "d9f499d24cf235757840dea598462c7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646820, "uuid": "3ad571b1-9648-40a9-a271-19d175ad656b", "comment": "Malware payload (AgentTesla)", "value": "9714f79bb2296d3108cbf1c692bef6578e65bff5d17a80df942bbec516b45c84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646820, "uuid": "97355074-8a05-4d9b-a271-f329cd84abab", "comment": "Malware payload (AgentTesla)", "value": "4009082edb6905c656932c331ac6131222a28a9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646820, "uuid": "2c391163-0577-4875-bf7e-12c47af5e2f5", "comment": "Malware payload (AgentTesla)", "value": "354ff52208bf5a9d145f91e9659b964088ff3aa157f306a86f12d63fa0ca412f2e68ee13c24892f4580009a85483974e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646820, "uuid": "69d04718-7612-4e93-9b82-9451c138e871", "value": "T16B25F1365D822E44C63D1FB8C023555877F0D817A2ABE74A2FFD10F66BA2B81CD2B855", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646820, "uuid": "348f3ade-4c79-486e-8d0f-493f84032fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646820, "uuid": "75a4996a-5d5b-4f9c-9b0c-2ae1461160dd", "value": "24576:POF8HKLZ4e2sAh8cYHJPBiSXy9IEV/bOxX:W2HKtH2t2cYpPBivfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646820, "uuid": "7d293841-4352-4bd4-8e10-c800c03209c3", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646820, "uuid": "3f6dae9d-3ef3-4811-af9b-03f2d30e1b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646820, "uuid": "3e730405-8f7d-45db-93e2-7d92067961f5", "value": "P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3a694d-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784646006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646006, "uuid": "5b7a6a8f-8010-4737-9e9a-06e4455fd89b", "comment": "Malware payload (Mirai)", "value": "c3755eda65b54cc55f4ca42d94d3283e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646006, "uuid": "cca03f6e-22fe-4ae3-8055-421240e35048", "comment": "Malware payload (Mirai)", "value": "980a7bfa9dd517f3b934f61e23d9e277bf222ce9b1cb055eecd1c7f87b35d7fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646006, "uuid": "c24b483d-1cea-4ba1-8252-3d46f81b59d2", "comment": "Malware payload (Mirai)", "value": "856397520af5a42a79b593965b076f2808c5ffe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646006, "uuid": "d9d16a57-d3d4-4522-8d31-852b32a34701", "comment": "Malware payload (Mirai)", "value": "2f1bd8292bfb5b9a6c58cac85245436d3e7fe6a990eb46ac58a3a23b0e8607cdc514f4f5c572968ce56f55971ec231bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646006, "uuid": "b7a96313-7d73-475a-9317-051176cc7da9", "value": "T14EC3D60FBE619F6CF768C3314BB74E35A68927C627E1C546D26CE1105E6024E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646006, "uuid": "5785a5f9-d5c6-451b-96ef-5c026b108e2d", "value": "3072:VeQT4VrkZvyx+MV6rkTNlF3UlWcQ1Q9w0X+Vd7+g:Vecscfwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646006, "uuid": "c03fbc9b-7f50-40c7-b210-fec384f73580", "value": 126128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646006, "uuid": "2f35f44c-2980-4d74-9014-58995c3c64af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646006, "uuid": "cea48ade-9be8-430f-9a36-cd362e3823df", "value": "980a7bfa9dd517f3b934f61e23d9e277bf222ce9b1cb055eecd1c7f87b35d7fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0d1ffc-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784618463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618463, "uuid": "0000f7c0-0f8d-462e-9ee4-bf302eca3ea0", "comment": "Malware payload (PhantomStealer)", "value": "a1da91f9271d2c877cda84c08810726e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618463, "uuid": "93f2774f-d4e7-41f6-8d75-20b596985a3d", "comment": "Malware payload (PhantomStealer)", "value": "980aad870fa82114087d4f604b1b00074f81c6754b51a195cf24988aea4a16ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618463, "uuid": "09eb23fe-579c-4259-98ff-14ecb6e2a1d9", "comment": "Malware payload (PhantomStealer)", "value": "85853be6dd6c237bdaa901a45f278d7d453d8cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618463, "uuid": "1b95ef8e-3f81-451d-afbe-3f6996e9a914", "comment": "Malware payload (PhantomStealer)", "value": "8bda2811b619d987248db74e5d67f09ce9c7ade37bff483adf275a5aeac966a6c0ff91830ffb50cf21a60a4ee0a913bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618463, "uuid": "ee525855-1e54-4137-8d5d-b1a9bb0a7b35", "value": "T12684BF127D0CA4DBED3D6372296785862FF4747A4B9212AFBAABF21648413034E1FD5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618463, "uuid": "c2872fae-4be2-4497-80a5-31d50b66959e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618463, "uuid": "6c32b68f-0145-4218-af25-05d03974f488", "value": "6144:Jwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437ARqRzwFsfA0h00s/:JzhufPAgEYFV4RIsf900IB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618463, "uuid": "1d88702a-5371-4080-8c89-79d488cc2df3", "value": 383529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618463, "uuid": "50fa62f2-25f4-4759-86f6-2f5d3cc395c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618463, "uuid": "a46cb0e6-eaf8-4f78-aa7a-978253296298", "value": "Amagermadden147.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25b0ed0-84dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784622314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622314, "uuid": "93cd961d-f7ca-47e3-8184-604c49e5ac1a", "comment": "Malware payload", "value": "843b085e5e35d2df0335c03c0fdd38b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622314, "uuid": "4f392904-67fb-425b-bc74-bd0a72d0746b", "comment": "Malware payload", "value": "98a7c83c815918d942021ab8203eaa97a39913b5adc97c2f3e0979896d677033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622314, "uuid": "623d0027-fbaf-467d-a61f-25a89a19e2d0", "comment": "Malware payload", "value": "3db8e549a5cec7789e7f5d501114ff3f2ecc2d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622314, "uuid": "49e59d94-48f2-4bf8-bade-87a789be27c9", "comment": "Malware payload", "value": "ab5ddc7ca1778340e3e554cdfd05d36acd12c67f19e58b9be2ddae8ed9b5a5c1c70df510d21e7897b993ab2db95dcf61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622314, "uuid": "e75e1399-7630-4a04-9729-5ceb82b0c8f5", "value": "T11283082ABD805F05D4D526BAFF1E934933536BBCE3EE7102EE141B25278A95B0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622314, "uuid": "3498f720-8805-4582-a81d-ae09fd883630", "value": "1536:Eun+Gad3mYuqkA5PynmGXeGhDIzLrPI4NNPeZQuuJzllcqip3PWkZfn:wGajdk26tdwrPI4NNPeZQZk13PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784622314, "uuid": "6aadc4f5-7429-40c7-8549-3369d947118d", "value": 84104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784622314, "uuid": "45f8269b-7319-4438-a3f5-89b58212b9e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622314, "uuid": "3274732f-b764-4e8f-9840-2a26b73bc36f", "value": "YQN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba8bba0-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593123, "uuid": "586f3aeb-5370-46f1-89d2-ae2619961ac3", "comment": "Malware payload (Mirai)", "value": "921876e01ffcf338a8b993d8c4f05557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593123, "uuid": "ca77d0a0-a061-438e-b393-45c8f266d26d", "comment": "Malware payload (Mirai)", "value": "98c21848798bd3259b4eefe0b455d510f6e481c476882f03708cefafdbb10e54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593123, "uuid": "f656ccf8-8c88-4059-b5d4-09fd00ed21ab", "comment": "Malware payload (Mirai)", "value": "6225acfcb5963c9a34c7e9dbeaa17e8828042d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593123, "uuid": "92866fa8-77c4-43b1-be18-4e3479280685", "comment": "Malware payload (Mirai)", "value": "0234ed329de0414d95d426963b81757d3b91baa9aebf38c0925890e6692fd539b125edc8de681ea1ca367f03a76de293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593123, "uuid": "7f53f29d-ae1f-4b92-892d-593e03d7982b", "value": "T1CA731A2679746E2BC4DD92FE12F38B24F1A62B0D28F4855D7D721D8EBF2059029137B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593123, "uuid": "b0c7c5b8-7e5e-45c5-989c-1ca27e0b2e8f", "value": "1536:Y1TO8X3EXi9/VyQtX4Z9BxmvAF9/joX55Fk5QGBHRYn:YxOwEMZX4pxmvRrSBHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593123, "uuid": "e50634b4-5fb8-47c7-a0a9-c25137ee8ac7", "value": 79416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593123, "uuid": "690fca37-5ddf-4b7d-bd4e-9fafe534f233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593123, "uuid": "9fc5b0aa-7091-4e46-851c-2e3f3c0f3c95", "value": "nullnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ceb0cc-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784611149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611149, "uuid": "48be7d6d-a354-4710-a138-aa0c7bc56c97", "comment": "Malware payload (Gafgyt)", "value": "fd2c3d81d97f57cafd8602c70747ebc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611149, "uuid": "8514857b-cfb5-4c5b-9f5e-3daadee53f89", "comment": "Malware payload (Gafgyt)", "value": "99c57cab4a3da0dd1081633659c3e852b80539aa97eea3956c7f065fa860aedc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611149, "uuid": "33b68ca1-8c65-45cd-a411-90c57c0fdbd4", "comment": "Malware payload (Gafgyt)", "value": "91ab2d34246c607c3d081566ea3730d131aed163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611149, "uuid": "a7a21924-8b62-415a-82a8-0b418b7e36e0", "comment": "Malware payload (Gafgyt)", "value": "1c6bb87ced309e8606379f86383554af778f7d8fbc0a940e3277fcda115520ecdea715df2b21c88bace8c33d57bd47ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611149, "uuid": "676bc9ef-b71a-457f-a0df-5fa4b08b5775", "value": "T189D3F849BC819B10D9DA35FAFE4F028933575B6CE3FE7202D9205B2127CAA5B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611149, "uuid": "ed1c5d62-bbf4-4049-a7bc-a6d1347b7c59", "value": "3072:FG61jcCHZnOyYFssOsgRta/uiT05Cz9JwVNdzPr:Fl1DXYFRO7Rta/uiT05CJuNlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611149, "uuid": "e761f948-c80a-45f2-9933-7685626efb6c", "value": 130452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611149, "uuid": "fe907f45-7d8d-49f8-ac2d-9da633efb19e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611149, "uuid": "4c79cf93-6857-4277-b687-0c3a16341c33", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd4012d-852f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784657635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657635, "uuid": "1cab059b-42f0-46a4-86bd-ea96811a8cb6", "comment": "Malware payload", "value": "9eae4d385ef6dc64c7e6c1e3bc3ba867", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657635, "uuid": "e0d12273-11c5-41d2-a8fd-2be76785964d", "comment": "Malware payload", "value": "9a78fd4fdc0613c38a2b82b31fe57813741e1be91c5d9509f316c4b6295528fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657635, "uuid": "950d1322-e7d9-42fa-b687-efc26f169595", "comment": "Malware payload", "value": "695ac9e447e5833d34924733962e7080f57f96ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657635, "uuid": "4430160e-3afc-4d27-a91e-a282b54a065f", "comment": "Malware payload", "value": "138edfc7d7cda286b58f884ca959861eb083b25f34c5a2635375505787b89f0d5e10a69dbf58c6cfd225210bf5dea4d0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657635, "uuid": "434579c0-f1a8-4b27-a9d9-f88d09f42b7e", "value": "T131014CC6E32099508029D86F769755A0B52283C7454B4FB8BF9C943DE799E04B066F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657635, "uuid": "82f20941-84bf-4b41-8eb6-965aa4107b2b", "value": "24:kXCKysE2hi0ziQvZohal2H8oYneUZ+jp7:e9Qp+Msl2coYnfZKp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784657635, "uuid": "a49b92a9-a7ba-4519-8a29-0f95f31aab73", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784657635, "uuid": "69d9f2f3-264b-4b57-b796-b13063a5ed05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657635, "uuid": "94d42e3d-2afe-42be-81a9-002560d89993", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ac4467-84c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784612946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612946, "uuid": "5194f97a-9993-4412-91df-aac017875902", "comment": "Malware payload (PhantomStealer)", "value": "57219ad97b5aef22994d825017a41352", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612946, "uuid": "25607567-c5d3-49fb-809a-c97a21ec6b63", "comment": "Malware payload (PhantomStealer)", "value": "9bb410fceb8d54d5fbf067d32c9713ccbb6cefa31c29460e15251cc18aa8b325", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612946, "uuid": "18fe8fbd-4e82-456e-8947-c0ed93e8a28f", "comment": "Malware payload (PhantomStealer)", "value": "2d9f426646ba579ca830fe4516b021e453cf5bc1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612946, "uuid": "0c6d9964-f4b6-4188-833d-0dac089a9948", "comment": "Malware payload (PhantomStealer)", "value": "720b0277555f4247085c6760b605dea797b8f8fbd087f9e4ead27a4941c6ef3cb53a4f2dae55682abbc42e06a8ed4ef8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612946, "uuid": "bdbded3f-c436-4d14-b274-a6239f93437b", "value": "T171465B61A758A975962DD72DD23AEE68814E300764C9CF2C326F5724B758E0FE34C2E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612946, "uuid": "498631fa-8520-4606-a652-ec5a408466ae", "value": "98304:+D14cB1x+sKKbL0JuwOCz+oT2Dc0dg9zAIErtXEzsOz6A2yypYcRXgDktv23j40J:g4ql/fwOCz8G9sfu9z6A2WcBh23jr5Mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612946, "uuid": "353ba257-789d-4917-b6f4-fb85764b51e7", "value": 5509005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612946, "uuid": "8532d084-717c-49e3-9d2e-deb7da279cf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612946, "uuid": "65c8af74-f37f-48ed-81f8-e7946d7e4db5", "value": "Statement of Account.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f40dd0-8519-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784647799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647799, "uuid": "33deec81-722d-492d-a21a-e6b2c632e21a", "comment": "Malware payload", "value": "946f0f95b975566de7e9f5d63d97ab6c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647799, "uuid": "f57053df-0e20-496d-ab1d-2a91c20c66de", "comment": "Malware payload", "value": "9c074ed10a29d98dce19f36bd211e3b476e273bb4dfc2800f234a3b64386aed5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647799, "uuid": "8e4a567c-e8ef-4f7a-9b1c-bec74b086f45", "comment": "Malware payload", "value": "ab0f499b197a50d8ec735adf74682d9a87f61936", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647799, "uuid": "a19a38b1-6b07-4c6e-9aa5-c6c7e0543601", "comment": "Malware payload", "value": "cf3630732e3e51a14277ec40a290471e75b050ba07d03c3a8703fe581c64fabf43d7ecceb14a2dfdae239e30d1c8abfb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647799, "uuid": "6e63f1b7-a28d-4151-ac39-6ecf18d59187", "value": "T1C94633CD7CCA5F70D41BD3B6854234AEBD293FC9BA1B9D2A36D879401EB33291672205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647799, "uuid": "3c55818f-2e93-4395-99ea-3d3694bdb72c", "value": "98304:PBnWAI6VE3gRt+W0sQALolY1e0ammzaK/SxrnM+3RMjnShkWyes+eq1wCZDImOdw:ZWS5sdR9flOtB8okWyhE1dImyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784647799, "uuid": "a5c4f04d-992e-4915-a7fa-fc67a78031c1", "value": 5828608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784647799, "uuid": "5658a937-1db1-4bf2-b2b4-468860f538e7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647799, "uuid": "e1694f24-2869-4b87-b21d-add733b3612f", "value": "appstup.38680022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081ac7a7-855e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784677433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "0844d228-6b39-43a3-a239-b579fa98da95", "comment": "Malware payload", "value": "e2c26477c7019fcfeb969c052e71b735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "c937b797-861a-4352-98a1-124de2dba892", "comment": "Malware payload", "value": "9c285fe3a491ee6a6f872ae71d47dfe29e44a40b9e7fcba85a39a2368584333a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "f34cd3ba-0a3a-4e08-8eff-678ab97318f9", "comment": "Malware payload", "value": "07135c099597ecaedb84b9d8ba7e85980b887d9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784677433, "uuid": "a925010f-4f71-4731-aa3e-e07437ea18fa", "comment": "Malware payload", "value": "5cb88206da5fa294ca87968a485cdfcb374231410b40416b8c1949455dcf0d508d8ab339e114eb2e91c4aaf09f527714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "d0715215-0085-444a-9c9a-48a45ec55ac1", "value": "T17EC533F0F4D3CE21E9AD31DEFEA39AB106B5102989B39906C944526ADC35DD7C67088F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "2828b8bc-c752-4bbf-8deb-3a491fedd46c", "value": "49152:L9aI/YyfNnduwHOZzexbttkUyt6XNAoTelU9VVeodi93xm07/eHgUQsxkoq:UnOduwHI4ZtkY9AoCuAodcmLHgUQsxk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784677433, "uuid": "d0542dac-53bc-46eb-8043-57954a18d276", "value": 2681608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784677433, "uuid": "4481fbb7-10de-453b-b302-20641ceac34f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784677433, "uuid": "b10d7ca2-7fe5-4cb0-a0b1-3bf765d6af7c", "value": "agent_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb98626-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784615055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615055, "uuid": "ce9a0868-ba11-4003-9e50-b38867bc3e22", "comment": "Malware payload (PureRAT)", "value": "e737b5740ab356fb46d8fe0d96033cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615055, "uuid": "589dd01f-6385-4697-beec-6776993ce5d6", "comment": "Malware payload (PureRAT)", "value": "9ceeacd7f64359972fc44c73798a4e215effeff4bda4f6e309bedc67bc0c8d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615055, "uuid": "a11faecb-bbeb-46cf-84c5-6cd68cfbecd5", "comment": "Malware payload (PureRAT)", "value": "07ab88c64a87f3db9d8a0fc9f57af0179c743a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615055, "uuid": "ed4c9464-c0e0-4c59-b2b0-9b4130c8aa19", "comment": "Malware payload (PureRAT)", "value": "4129f673b96600cd15e136ead7b179683689beca55c16f47b932d2a1e30b11453c2761ee36a93ced23dbc3d8bcc75577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615055, "uuid": "80f12241-7039-46fb-a21c-0636a5b2ae84", "value": "T1FA755A55A6A441A8E0A29578CB5EC933E7727CC60F70968F03D47DA73F33250BA297D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615055, "uuid": "a87aabcd-c95b-4a15-82f3-7f54dab2129c", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615055, "uuid": "762cb32e-f9e4-42b2-955c-fe37eea419ae", "value": "24576:JRSfrAEH9XIYpj0BEHB5jZDidXPGfjuIb1iN1Eob4b:JgTbH94YxVv9z21K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615055, "uuid": "d9c745c0-0a30-4078-9429-a0301643e10f", "value": 1550195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615055, "uuid": "4a4b390b-f424-45be-9197-86338ce58027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615055, "uuid": "d3f4594b-ef0f-4ee9-8d2d-8ea2ede9905c", "value": "data_cache.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7205d603-84c4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784611468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611468, "uuid": "97634e03-7115-419f-bdf8-5e212563c1b0", "comment": "Malware payload", "value": "33c330e3f2bf55723af2597fc060b319", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611468, "uuid": "89e7ddf6-fb69-4768-87c4-06a63df0ef1a", "comment": "Malware payload", "value": "9cfe9ecb6e496c69223f59ba3ccd26f3872363ff3fe29670d55d227270bf9920", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611468, "uuid": "f0eed5ca-01e7-4708-93bb-380329a1a03f", "comment": "Malware payload", "value": "e81380bde40d0de3b590dac2f3f5609dd3f2cb46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611468, "uuid": "91b819bc-6ccf-4e39-b62d-2755e6e361b4", "comment": "Malware payload", "value": "5b1d79fe9d89098dbfcccec1cb87ed59a2cda0add0c08d535367e15ef4503a713c96dd7d08f1ef4fec8a318d8a85b0d3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611468, "uuid": "4aadc451-0ff3-4c9c-80b1-36416841b6a6", "value": "T115C28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611468, "uuid": "a0100d5e-1337-4d33-854a-f2c67be61220", "value": "768:Q8vCB+25j6es8RO9FYpMSUpi+20qUpi+20YQX:Q8l25Jod2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611468, "uuid": "d5f8a106-a492-43f2-96ed-ba33354d42f1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611468, "uuid": "425ede4f-da90-4e6c-925f-2de7de7e5735", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611468, "uuid": "1a17c9e8-1aff-4241-9855-a97c33aa75bc", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6834880-855b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784676464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676464, "uuid": "de00b0da-c9a3-4f86-9fea-1191b6b3f07a", "comment": "Malware payload", "value": "d508acf1b819def1189d6a651aea6383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676464, "uuid": "d03cffca-629e-4385-a779-0d7172ecceb2", "comment": "Malware payload", "value": "9d5db6a00c6ebf232c2b75d649e73b4eeb28b88d830059db3ecd041ed377ee77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676464, "uuid": "60bb6583-65e1-421a-98c4-61102c7f840c", "comment": "Malware payload", "value": "02673d2fad0f979ee459fa60647db38e6bc9a28e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676464, "uuid": "0cf883bf-d980-4a1b-9d8c-5f897dc80434", "comment": "Malware payload", "value": "64d668785a9a24c56b7447d2089cb76d4d23f630488fb3657f0a62c52fbbaf0d3fa4da29fff21cf7ef1f5af55767e7fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676464, "uuid": "728b43d7-32d7-4e05-837d-05ba5e7ea1d8", "value": "T15FA3E90AAF611DBBDC1BDD3709E80B0635CCA61B716937753538C928FA4A90B4AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676464, "uuid": "17cc3c12-d472-4051-82f3-1402c31dfff1", "value": "1536:48xuh/R0h4XErXS60hAlbl/a+uH/8HF+EC4Wsb0tiz0Z4G1tbV8:2pW4XErXT0ilbNWU+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784676464, "uuid": "a5e5285b-45a6-4cbc-9d65-bb58ba048105", "value": 101012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784676464, "uuid": "3d5b212a-d54e-4d14-9daf-36acb993632a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676464, "uuid": "cfb025cd-7d3c-4401-a5a8-f54603be4f01", "value": "PrA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88a28be-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613358, "uuid": "a7b91677-b899-46b9-912b-2fb437536df4", "comment": "Malware payload", "value": "6bcdcdcde36b741288357f8673803da6", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613358, "uuid": "e70f96bf-b806-4e97-9613-41b73da10fe5", "comment": "Malware payload", "value": "9df9ac4f71902d15d0762ff6ca5c45de506a2eb1593a1edbdf9ebf3fc2f69c5c", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613358, "uuid": "a885a9e6-b7d6-4e1b-b436-8f7232d0c965", "comment": "Malware payload", "value": "ceffb40f4d29b4cb6b87e898f29bbdd2d068de19", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613358, "uuid": "dd7ebea9-25e2-40f5-a31e-0517f133d13b", "comment": "Malware payload", "value": "a689c8c8384827e5a426e4d4726750ca9ef567497f5220dae0ef647b997723f4e8c2c707488d19bb25d8b07b2f9fc761", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613358, "uuid": "2ade9933-bf53-4dff-b02c-9321f7024728", "value": "T1E56486FA6036ED8A86370E40E1043F179C299EDF66B847F8778815D1C19C68CADE75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613358, "uuid": "a5cebac0-9352-4714-bf00-38b46282d149", "value": "3072:S6EBJYmm2hpc0woGSkHGzv+rvTM7VHhnM8xStoYy6EofdyfdAGplk+d/Dn3bDDOU:Unm27Nb+rIVBXCBfdyfd7eIGVjFZCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613358, "uuid": "1121f092-2152-427f-8d07-94421c064c30", "value": 320226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613358, "uuid": "6457052d-039f-48ef-b9f1-01ecd50448c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613358, "uuid": "76d3b712-3b97-4555-9acc-d55141fdd0e7", "value": "9df9ac4f71902d15d0762ff6ca5c45de506a2eb1593a1edbdf9ebf3fc2f69c5c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456baecf-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784614829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614829, "uuid": "2e727e01-3ca0-4a4e-abdf-60bf47307f2c", "comment": "Malware payload (XWorm)", "value": "e0951aff3ee0cd166e76c04f68d34469", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614829, "uuid": "7423b650-f55f-409b-bc1d-aaeab6788c97", "comment": "Malware payload (XWorm)", "value": "9e1c3817c2b4f5aff5b8ed5288fca53df1ad392022c2fa3b609e0103ec2ae08e", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614829, "uuid": "5923d3f9-bfea-40bc-99cf-1f2f336025e8", "comment": "Malware payload (XWorm)", "value": "0d93b6262fcc32126cba2530d66624e6fb3c100d", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614829, "uuid": "e48c54da-1866-4c5c-b4c7-4be2808c8023", "comment": "Malware payload (XWorm)", "value": "e2db19bb98e853c6c6d6509ec6d89964502baf273c1cfe1317cdbe8835c20cf50f5061e850b9350c22b4d563810d1594", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614829, "uuid": "1206e229-c4a3-485c-95ad-ad258316a0d3", "value": "T13C45121399468F93DA6CC7F87F470E6C9F06272CE09539EF05661C9B7B692220C8E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614829, "uuid": "2bed70ec-58a2-44ae-8b7a-ed61767b65a8", "value": "24576:QFZ0H1J8zzbjSzPhrIpurNfsr7JvRDEE9CE4BeL+d8CtdIOFzSX:e2J8DjSzBIpnrFp4ICEseLWDq+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614829, "uuid": "1ac6347d-bce6-491d-ae4c-ec532e632375", "value": 1276048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614829, "uuid": "5c780789-5f04-43bc-bff6-5fb3675dec13", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614829, "uuid": "7e19bacc-89a4-47f6-9716-8bf3bb76ec63", "value": "qm_equipment_analysis_v2-0002.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d071e8d7-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613345, "uuid": "601bbfd3-b527-43a3-8cc4-28d7c4386322", "comment": "Malware payload", "value": "48e7949778ed52a026d89318b4e62466", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613345, "uuid": "15bb02fa-b187-44c6-87df-4756ff4ccc92", "comment": "Malware payload", "value": "9e5a318d4bc23972b5d53d594c392a4b68cb722ecc017632c330b4f4db9f4c02", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613345, "uuid": "c0c269f7-bfd0-4e5e-bd9a-5fdcfc4f3953", "comment": "Malware payload", "value": "843899106b664455f3c7a7b20bd7e8e877d91353", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613345, "uuid": "83ea686e-8a61-4bf4-807e-658f585ca9ee", "comment": "Malware payload", "value": "17f01453fa27aa4df99534cddbf5d55683cdbc7ea5d6135226bc5c7be6e994e9540a4935ba884e84405bb69ffc748714", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613345, "uuid": "4d28c30b-0728-4f82-bb16-6fcaa6d2167d", "value": "T17892BF057FF0D420F11B8DB11EE2EAB43AA5FE116E439E1F77887B9D1ABA046449311E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613345, "uuid": "199adda1-49d3-47f7-bb02-f1cd0d29b614", "value": "384:QgV3/EFrAXsGQ4P6wmgZOCi/a0T6FHWRrSsctVcFXt:CFrA8GQ4P6MZli56FHgrdct8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613345, "uuid": "5f977983-8325-4eaf-b89b-29e00bd3457e", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613345, "uuid": "c78b40fb-6f66-4c97-875a-e321baae4784", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613345, "uuid": "b278b75f-c7c7-4845-9cba-a25bcedadb68", "value": "9e5a318d4bc23972b5d53d594c392a4b68cb722ecc017632c330b4f4db9f4c02.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc6ee4c-84d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784619835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619835, "uuid": "601022d6-8b1f-4aad-9ced-1bfa0e4c3c2e", "comment": "Malware payload (Mirai)", "value": "8f49d6f903f29946f9aead1d11224801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619835, "uuid": "83b3e71d-0c81-4977-a20c-d92de71c9dff", "comment": "Malware payload (Mirai)", "value": "9e5aca63dd43c7e9702924bc56709a9eccbf007e39bf281c23c986ad241b0d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619835, "uuid": "a522449e-42f0-46fb-b44a-cf689c1252d2", "comment": "Malware payload (Mirai)", "value": "193b8fbee7de99f7cb27fe6c8b1fbf5416d9b60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619835, "uuid": "b79a3d65-9e2d-4ad1-8ea8-402d29fd44a9", "comment": "Malware payload (Mirai)", "value": "b0cb1c640e246ce08d0badbde20d263e3373270234ac3d3c6a53883daf898732b8825c735d7449c230b6650b33edff97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619835, "uuid": "c15cd7f0-adef-45ad-8afa-2c8fddcf68bb", "value": "T17B834A02B3580D43D1671EF02A3F37E5D3AFD59122E4FA89250E9A4A41B6EF3154AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619835, "uuid": "ca16ec3c-7ae0-42de-bd73-29bc877d465e", "value": "1536:Vcdl8usQeNWNhNtoaeF++Qma+4a619tLeJ:VcBsJW9WFcmn6xeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619835, "uuid": "267ff972-9329-4efd-8ddf-c11f99920b30", "value": 87744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619835, "uuid": "2e21a604-bb04-478c-8720-7c975c5d34cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619835, "uuid": "933eb1eb-c1e1-4ef2-a06a-d6d0b5f4406f", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482959ef-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615263, "uuid": "e7e548e4-9cae-40cd-b136-26fbeea4920c", "comment": "Malware payload (PhantomStealer)", "value": "266f27794844707dd1f0518427702b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615263, "uuid": "25edcfb3-2c28-4a21-899e-6e8ddeefcad2", "comment": "Malware payload (PhantomStealer)", "value": "9eea466fca41e3b3c448f60c36c2fa435b1744fe9d0efa543a7fb1ba15c5f9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615263, "uuid": "a881d323-67c3-43da-bf3b-759aca6bdad5", "comment": "Malware payload (PhantomStealer)", "value": "af7c19907d8c56855c4b1d79f1247f5eff271bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615263, "uuid": "2d6b35f7-3565-450f-ab9b-e874248d2d56", "comment": "Malware payload (PhantomStealer)", "value": "d2cd17a609511a0952b2452721a526082494a9ea1ebeb57d385cb78a0824496de17ee992b7f65062a4f615631b19a5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615263, "uuid": "afa13700-c8ab-4ed5-9a54-3b57b32af098", "value": "T19BF49D68A3F50499F1FF8B7494B68421DE31BC4AA938CB5F168452AE0D73742EC70B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615263, "uuid": "52c86967-f7b4-44ac-b2f2-01f8920bd592", "value": "12288:V9ClgK32RO4nLChMpOy3OJj6wBxb8ic+Kt0+:V9CN2R9OMOy3OJjvxb20+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615263, "uuid": "8116693d-0b76-4b66-83fa-103133a3c8d1", "value": 764620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615263, "uuid": "57f253a9-8da5-4263-8973-f7099e959bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615263, "uuid": "734ea904-f335-45b4-9953-158ba638704a", "value": "9eea466fca41e3b3c448f60c36c2fa435b1744fe9d0efa543a7fb1ba15c5f9d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e6253e-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613334, "uuid": "d608a8ed-8cba-49a1-b18f-532247f2db4a", "comment": "Malware payload", "value": "725e8d3da99828f09ff1f1311a35c110", "object_relation": "md5", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613334, "uuid": "38cbafa3-b666-4141-97b2-be0338476042", "comment": "Malware payload", "value": "9f41d95ad7dd2be350f4c93e85dd3add49b438138025345943815122b7818c18", "object_relation": "sha256", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613334, "uuid": "07fbca03-0979-46a1-bb7a-220cd61c33d1", "comment": "Malware payload", "value": "bacd064b44b46205676747ea955cd4463e859373", "object_relation": "sha1", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613334, "uuid": "d6038219-bf7a-4226-ac24-e71cf7632126", "comment": "Malware payload", "value": "2fa15e9d8972ceb705b07172cd6c282fd5b9a4ce7b69ffb691fb861e3e2811ca8036805b094bdecc02ab054991eb059b", "object_relation": "sha3-384", "Tag": [ { "name": "192-255-195-158", "colour": "#F36B7D", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613334, "uuid": "24c5f59f-db0f-4edb-8859-6708d8b703be", "value": "T197D27C2437A1C02AE545AA758DD5D0CB2B31FD52FE4A8B0F32C5734F5839980EA17B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613334, "uuid": "9af47de8-ba35-4b2b-9e20-cc456478bf32", "value": "384:xk2o1tuoELxoTd6CFdhEb0sE8SiOD9dCD5Qvno88mNX:xFoAycCFwb35Siinv/8mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613334, "uuid": "5582ab11-08a0-4e88-9c91-86917de3b969", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613334, "uuid": "5dd4dd9d-49cf-496e-bd8b-8fec918b8f6e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613334, "uuid": "ae8bd47d-94ab-4225-9791-329d52ea7d5d", "value": "9f41d95ad7dd2be350f4c93e85dd3add49b438138025345943815122b7818c18.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe6d847-84dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784622309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622309, "uuid": "e7736232-b853-4ce6-97c9-8c9f8e2875ff", "comment": "Malware payload", "value": "4a982489068796a84a934058c4eba8b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622309, "uuid": "9216b293-0ddf-4e12-b44f-02e4bb5d7325", "comment": "Malware payload", "value": "9f81839b349bf6aa8ab6a325151bdf078fae53e10a52f14f8ab0d5b36544c7bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622309, "uuid": "b82f306b-d224-4eb8-8086-b2e5f57f6950", "comment": "Malware payload", "value": "888594ab8fd705be36f694d0ba1a03f7aa8ccf8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784622309, "uuid": "a6b28a0f-0adf-4ce1-b565-41ac1a35e804", "comment": "Malware payload", "value": "1d4534c6349c3cc30c1c1d1b5037e475f31cedaa8068859b21b434965ce7b66254bda2f253203c16c32a785d1f05ee54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622309, "uuid": "d94ba747-cc1e-4a7b-ae27-622e4c9bb9a7", "value": "T17D630967B9418F19C5C5167AFF1E934D331327B8E3DEB213EE142B64278B96B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622309, "uuid": "4eb1d551-b374-4af9-8a9e-51434f6cafb5", "value": "1536:NOn0eOJkjG+6K/rCj80gnIOle5zDq3VKHU5MABIiA9XyrvEYw7F:JeOJkj95rg8Ve/QKHUri9Xyrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784622309, "uuid": "24fa138d-a46e-4192-b5c7-df3919d7da80", "value": 71692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784622309, "uuid": "151aafac-2ca9-41ae-b946-ac819f43a0fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784622309, "uuid": "3969992d-9eba-49d5-82ae-d5f0d91bf1cd", "value": "eOF1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8675b7fb-84e8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784626964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626964, "uuid": "63e6a50e-ff14-480e-a0e7-63cbbe870613", "comment": "Malware payload", "value": "21c592557fa91e760d6fa74312e74d97", "object_relation": "md5", "Tag": [ { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626964, "uuid": "d3664ea3-ee6c-4129-818e-3ce7802667e7", "comment": "Malware payload", "value": "9fde6ea9b16c1464fb5f3cfa5f8b491a09e0cc7e3257e8166df15d4ff8d159cf", "object_relation": "sha256", "Tag": [ { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626964, "uuid": "2722e099-c3c6-445f-85a1-84c0a7a9ec3c", "comment": "Malware payload", "value": "8ed739713915d4e88de266848873579a4cc27354", "object_relation": "sha1", "Tag": [ { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626964, "uuid": "26dd116f-865d-4a61-989b-408b05de0760", "comment": "Malware payload", "value": "84e092a4faf256ba81c8da34b2a504ce221577f72248310e0f6d322f908d92ed7c23e581a9299ea08a3895754d66dacb", "object_relation": "sha3-384", "Tag": [ { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626964, "uuid": "fdab8517-326c-4e4b-a314-fa0e5fa63413", "value": "T12F75336F6090D5142339FA9A3FDFA15C38A884D2A539DD020CBF4E37557A43858CAF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626964, "uuid": "c0546c34-2041-4ced-98b0-870b28b02d18", "value": "49152:soYZinxsggN9OUrjJji7nH8uex1N6IPte2/:sv8naN9OUAo9zVt//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784626964, "uuid": "c175fea3-165d-4eae-b08a-9ac2e41da3b3", "value": 1611605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784626964, "uuid": "cf58fa89-0270-4a1e-b0b8-9cb094ab1e29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626964, "uuid": "48a41a96-71f6-4487-8456-34cd470e6b2a", "value": "stego.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d419a528-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784613351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613351, "uuid": "e6368f33-b005-48cb-8cb4-a7dd911f64b6", "comment": "Malware payload (RemcosRAT)", "value": "d1cb5e5b20c7001a38e7b2db8e956962", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613351, "uuid": "431b93cc-739a-48a1-96f0-27b24f1af3c2", "comment": "Malware payload (RemcosRAT)", "value": "a043b7589febc738a5b7b9d399b140203f9e1d1bcc14622290ce2dcf9ac0b384", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613351, "uuid": "7f1c20bb-dbb1-44be-b35f-d1fd2a51bf9d", "comment": "Malware payload (RemcosRAT)", "value": "b6012f35abc5bef7debd0ec4e0ddc2797ae1e972", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613351, "uuid": "485eea2b-a11c-45bc-8b7e-9780e5e121e1", "comment": "Malware payload (RemcosRAT)", "value": "a958d12c81afe6af1ce04ca86e6310eba8ef1ebe9581e79ca597f177728d0e1412c87457a7c76869916bc0730c371dfa", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613351, "uuid": "dbaa4f92-372c-4521-8d52-524b348ed29a", "value": "T1D2A2184743BA05D8F702F1897D803A22CA540BCAF86A587E76D453B717FDAC5E36A834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613351, "uuid": "cda0b951-7543-4711-9ef3-487ae8e9a249", "value": "192:opoGm08iBA1ph6tsVrOqHrdua3BtzZoqzuStzZj4/afSVbT:omGmwQph6mrOqHrdua3aPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613351, "uuid": "a1e0988b-4b23-4744-bc89-453f27e6beda", "value": 21785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613351, "uuid": "f283120a-3bc7-417a-853f-dd6579f4f251", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613351, "uuid": "3da8dbd8-a619-4e8c-ae43-f9038c01ac48", "value": "goodthignsforbestfeelingforbetterplacecoming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbd53a9-84fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784636073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636073, "uuid": "0c666d8d-c4cc-44e5-afe0-d3cfecc473d6", "comment": "Malware payload (PureLogsStealer)", "value": "f48adedd79b57519affc9ee5ec8c3958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636073, "uuid": "22ace65c-9dbb-4fee-a6c2-c170b2afc88d", "comment": "Malware payload (PureLogsStealer)", "value": "a19d356251a87c785bcef042bbfe0e0bff1a908fb2a5bf095c4df04d6a5bc0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636073, "uuid": "e0ab3026-712d-4be2-a4d1-c63b0119764a", "comment": "Malware payload (PureLogsStealer)", "value": "42ed4d3bfcf886995f2fb320d7ff1238d7dfe47d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784636073, "uuid": "77b20248-4ed3-4725-a135-9e18bc5a10c3", "comment": "Malware payload (PureLogsStealer)", "value": "1e97dd7f570633d9fb334f25b2fecd3ccdec246afbabbd2346a30ca375917158108ef7a659af53eb623aafe5bc7ae190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636073, "uuid": "e323f7ce-e1ad-43f7-9938-91992bd1b775", "value": "T10D05AF3A36A28F21C24A4373C5C7490097E69A8736A7EB0B71C513D61D037FEDE4A697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636073, "uuid": "a3217978-5a15-44f4-afa6-02b2290f400f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636073, "uuid": "3ed7b013-0b7b-438d-8ad2-0932d5465a8a", "value": "12288:2Pcks/TE91Qo93JHwvNl28CvBOmbPxam2xC1aFq1hKGtyb8NrGst3:2rQo9pguxBjxam2YCEKGEb8Rz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784636073, "uuid": "55c17f0b-5f1e-41f1-8ac3-d9042d4ecfbc", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784636073, "uuid": "6e5a4570-6a3f-4387-9ab7-88d9ad9a5987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784636073, "uuid": "bd01fd41-109c-4b9f-8a6f-63fd7da52119", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.21226467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afa9751-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784613201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613201, "uuid": "6c14f8f2-73f2-4905-9f99-bb3e2ea90c16", "comment": "Malware payload (PhantomStealer)", "value": "6eb55297620741e8575d4ed7121298a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613201, "uuid": "49b9a54b-0b9e-49fe-8b65-5cefcba19b24", "comment": "Malware payload (PhantomStealer)", "value": "a225574dedd7ff1273e00bdf36786663a73788cc662ff54980eb56e6b317dbc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613201, "uuid": "46770a16-76d8-48da-bdba-c38774b5addc", "comment": "Malware payload (PhantomStealer)", "value": "a3dc49fbf9301603a97dbe3fb9188b1efba5a19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613201, "uuid": "3749caad-04ff-4072-80b2-6c2447b7e83c", "comment": "Malware payload (PhantomStealer)", "value": "c8630c98da0befca1dba6d366ab71112bf95c4a75e0beadcee638d422e6876cacffa94589d2c7fabc9c44de0de7e763f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613201, "uuid": "0bb630f4-ddf3-47ae-bfa1-155a50b9ec5d", "value": "T19884BF423D0CA5DBED3D6372296785862FB4747A4B9216AFBAAFF21648413134E1FD0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613201, "uuid": "2b71125d-5e75-4a20-af73-4b5ce5872898", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613201, "uuid": "2de7e2a4-dd2b-46a2-b2e7-02084a74f4d4", "value": "6144:vwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437AqfpwOvnttusYUTm:vzhufPAgEYFV0KOVw7UTA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613201, "uuid": "b484655a-0c62-4ef4-a3b1-dde5588b0549", "value": 388808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613201, "uuid": "3fa846df-0e4d-484d-bdc6-f068e0c741fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613201, "uuid": "1827d592-14e3-4d96-a789-d53d60e84ade", "value": "Files.09876543234567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9756b1-853d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784663537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663537, "uuid": "b7544964-ae02-4ff8-a108-a6fffda9cd13", "comment": "Malware payload", "value": "0d2b893053e535cbb69f369fc059cec1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663537, "uuid": "825438fc-c162-4f9e-a47d-45ec98357788", "comment": "Malware payload", "value": "a42d6c45a80c597e1ced0c59b76761d95ada94c7510176f32186eab043d85e25", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663537, "uuid": "805370a9-66cf-4324-9901-047fcd9dd4b6", "comment": "Malware payload", "value": "5b5e9e5f6e93f4d7f2ec2fb6b9cb3bac82f9a4cf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784663537, "uuid": "cb74ec70-dd63-4184-bf38-b89a8e12ecf9", "comment": "Malware payload", "value": "8ee04737f2b2f23604b0dab403368dbf2050fe398be191b40e9bcbadc168aafed3bc0ad081afa4f955dea22c97b51177", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663537, "uuid": "353a8e31-7d64-47df-92d7-36bb6dbeeb4d", "value": "T1B4B66B47EC9148F9C0A9A33189B791967B35BC481B3223E72EA1BB382FB27D05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663537, "uuid": "8cda2db3-7656-4db5-a6c1-910b16772ccd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663537, "uuid": "7e3ab142-910d-4334-847c-9cff3a2548da", "value": "49152:50h5lbWEv01/wiZeoOqj19fO57ESCLiw2tdf6yCAC56:58lijm5gJLiztd/tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784663537, "uuid": "fb128a9e-2e8f-4f4d-ae00-0cdcf4b5b2e0", "value": 10862424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784663537, "uuid": "5d917611-722e-492a-aa10-2d267eecd63f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784663537, "uuid": "e40568ce-ed94-4a8a-9b82-030d178484c5", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2fefb0-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784619325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619325, "uuid": "0d7d1df3-95a7-4b67-86f5-9494c54ec81a", "comment": "Malware payload (ConnectWise)", "value": "67db0fb9ebf254b651e62f1f1e36a6a0", "object_relation": "md5", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619325, "uuid": "f8ea6b06-4b0e-49e1-88c5-c5351e5d86e8", "comment": "Malware payload (ConnectWise)", "value": "a45b775ce18c20e3cd648d28ec73716036c525a6a5e9a313de9f004eb2d874e5", "object_relation": "sha256", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619325, "uuid": "d36b67aa-3a05-4606-a83f-b6d0c26232f4", "comment": "Malware payload (ConnectWise)", "value": "4b2d29849b979e86eb1f0af2379dd7831a1126ff", "object_relation": "sha1", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619325, "uuid": "fd435aef-d743-401b-9a5f-890f063fc945", "comment": "Malware payload (ConnectWise)", "value": "ccfbdce9038348ca5539d3443e485293c4360b494edfdc05aa173a18469acc3f31a3d4a2dee6fdff11da8437f0392f07", "object_relation": "sha3-384", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619325, "uuid": "20dc28de-86c4-4321-9237-5918c919ab2e", "value": "T11C650220B6E5883DEAF61A36FF7A92615F39FD251B20C15E8394381D0D70A919BB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619325, "uuid": "d85409fb-575a-466d-9d9f-12821b5fa1cd", "value": "24576:lZPlmF0uwTKh56Z5vePu/DVeL1pVjeO6nUUGGu/aYmQurhwQUv:Zmh69eWbVypVC1gGu/aYmn1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619325, "uuid": "9989e03a-1632-4119-806a-5b754559ab9f", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619325, "uuid": "c23f0c90-9849-4265-9dae-f44f7c21ee9f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619325, "uuid": "9e9854e0-9b84-4071-a23e-9c1511a16482", "value": "setup (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbe3e2a-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784672929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672929, "uuid": "c11490c6-e206-4139-a537-da9c65737647", "comment": "Malware payload", "value": "a3a11aa9f8ea13d27b246370bf7aefe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672929, "uuid": "f6d487fa-d4a3-4a8e-a090-bb61005977dc", "comment": "Malware payload", "value": "a4a4f6bb57b72bb64de6a93b8de5a114f265f2802c046695595355353e1509a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672929, "uuid": "c2594bf8-0652-481c-9229-ccc460129a47", "comment": "Malware payload", "value": "05927fc89de0af9401fc3e00c7a5b5697cb19cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672929, "uuid": "e4c65800-e90a-4c98-b4e0-c4b5f1255822", "comment": "Malware payload", "value": "0940c51b3278715173a34bb83eadff3bbd6ab87d8298556d91fe7bd97034e8e47318f9e4117e0ef85d76cd04ec7487d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672929, "uuid": "e9d92dc3-4f0a-48ea-8f29-0e29f2c749d4", "value": "T1B8A3E90AAF611EBFD81BDD3705AC0B0234CCA61771693B793638D528BB4654B8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672929, "uuid": "62476b0e-b79f-4871-b0fe-4f792d334df1", "value": "1536:/sQxwvYLFBWZX/6/hAlVAuqauDJREI+mOJm0TqVGgjzxz8PkLc+t:z04FBWZXC/ilVtiLlVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672929, "uuid": "e4c3f1c1-a690-457a-bb75-b1dba1852d8f", "value": 101444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672929, "uuid": "4dde4c89-769b-4212-980a-71ada299c2cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672929, "uuid": "5ca4726b-7a01-4fd6-8087-c6d0836f87e5", "value": "Wznp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4125c5-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784614953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614953, "uuid": "ade0c6a1-74ff-4323-aac0-71e8b07abec2", "comment": "Malware payload", "value": "10aab9e4bcabb40ba8d27d950d5874a9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614953, "uuid": "a35284ad-f6be-47df-bba9-cd9470986c1d", "comment": "Malware payload", "value": "a4d215f9419f2b44995b6e2086ad36478ef76e62010be2f4d54bf7aecc6967cb", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614953, "uuid": "9bf46c41-5dbc-4583-b493-92d18e230ad1", "comment": "Malware payload", "value": "bb11a649142b70c03a76579279701192d7ee52ff", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614953, "uuid": "f78f9ef3-c6a7-4318-8738-e59b0a518f81", "comment": "Malware payload", "value": "9fdfb50bcba8e4a81a98bf882807264df9eb7204e414e6ea435290c065dc1efeeab30b1d099ecb0c3af3e80b88c1c510", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614953, "uuid": "20e6eb1a-de7c-4da6-8d44-3b6a4ae374ea", "value": "T15155235BFBAADBC3D006047168CA2CE54529FC83A5124B0F32B4734DA6363B9976B35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614953, "uuid": "e67a1223-9f1d-49c6-bb84-dd987ae5e18e", "value": "24576:t7dGXG/59nFU8UL72iP+YDrBaJC9SIk7xe1IIYxV8lA9UXBEUS1r:t7gEnFU5rP5rsIul2KU8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614953, "uuid": "e731b375-c007-49a7-88dd-44de8d4d647e", "value": 1356800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614953, "uuid": "7887ee0b-b1e0-4b88-a98a-b37f53d0fa58", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614953, "uuid": "6d9bf365-0348-412e-acf8-d0618b23262f", "value": "New Order_P02026O7O13.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f97369-852f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784657530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657530, "uuid": "c890c400-1508-4f65-80af-57a3049e5ad1", "comment": "Malware payload", "value": "f9b9fc810b992f6daa98ff2db44f8ba2", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657530, "uuid": "a516e677-231c-49c0-9799-5eb283fa033c", "comment": "Malware payload", "value": "a4d31a2a85e5895d585fa5c583684ccea4ed0d0c9a334f4bab000e0f76b8008b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657530, "uuid": "a35ae1e4-98b4-440e-b34c-44a7ad078853", "comment": "Malware payload", "value": "d58b7b6beaf23f10dfe1bb2fb83e751a2ea3a345", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657530, "uuid": "b2a53322-e0a9-4f14-8a0a-e58c81395e4b", "comment": "Malware payload", "value": "38c7b674b3023d99539e26d589217e6d10360ef2fcc228e5150e7d34b2694ad2c9db6a349d868bcc9e2e1734e799f63a", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657530, "uuid": "96c4a365-b234-489f-a89d-5e455f5a5bc4", "value": "T113F733505391C215D0CB9FFD717F0EF25E2B5EE0B22DA0AB06528975B9A54B7CA8C10F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657530, "uuid": "a63b1472-ff16-481a-a662-be14d748cf9c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657530, "uuid": "f4fb5cf6-afa2-4422-85ea-510eab8c4a28", "value": "1572864:BLdk0RHpUPqU4FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7o7:B20RGqRaABZVPArg/bXeB7o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784657530, "uuid": "3259e41d-7e20-404d-afa3-7b80d2413751", "value": 74475416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784657530, "uuid": "680a4bdf-850c-4769-b51c-88061a5e0ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657530, "uuid": "f457baf1-fe54-45ac-a4cb-ca945e066fe6", "value": "Release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a0bde1-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614902, "uuid": "cb746a4d-c86f-432a-8524-ddd353579582", "comment": "Malware payload (Mirai)", "value": "61da03ee685b2c0f46cde086492fd0e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614902, "uuid": "08390e70-ce1a-48f2-b08f-069fa287de3b", "comment": "Malware payload (Mirai)", "value": "a6e9503b6b54a8c35d5763e4c02d2865c4762f732bd7d0a7d3de8311418f6878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614902, "uuid": "041aa503-94bc-419f-8009-3a2f15bb01a1", "comment": "Malware payload (Mirai)", "value": "3ce5d7a834aa60254815d97c8e1fa126b43a0da4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614902, "uuid": "537efd17-78b9-485b-9f29-db78a734f6b3", "comment": "Malware payload (Mirai)", "value": "77a325ba6a9f772493d19a30b85d11e9a1c6ac2d7169e157d69868ed3e0213f0dd97ac844481df278955fcd6180ca7c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614902, "uuid": "810e9916-99c6-4c14-a63e-7076e9dbeec4", "value": "T17DF30987F900DEBBF80BE3B645A309157530FF660C521AB372577CAAAA390D41467F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614902, "uuid": "77b26471-3847-4311-a667-0ddd9efe0f72", "value": "3072:0iN7agj1OIYR9e37ey4OHsCuNJ/Zl6NZ4ouYVMjbi5LkLszh:0zS13Ky4WsR3/A+ouoLAeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614902, "uuid": "d1455031-be7d-4849-b56e-217dfc046798", "value": 164984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614902, "uuid": "76605a54-f51f-4861-ab54-3109abd6520b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614902, "uuid": "341034f5-b049-4ade-8ca2-dddb688a1728", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36510f4-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784619309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619309, "uuid": "63c9a899-a70a-4ad3-9db2-b8acab05e3af", "comment": "Malware payload", "value": "1e125186ad28b05c4f0057cc1fefa576", "object_relation": "md5", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619309, "uuid": "dd9a5ca3-f089-4064-9b45-8b3c4cb5ecb8", "comment": "Malware payload", "value": "a752682e45b0917cf5e81b6f2510e507068ca0b3a5f5188498519bbe50e9c24e", "object_relation": "sha256", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619309, "uuid": "618fedb6-e196-4d99-a958-cba85f211e3b", "comment": "Malware payload", "value": "82a62effb45741e5612bb68c0652041a3b0f8c19", "object_relation": "sha1", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619309, "uuid": "e9ed3649-baaa-42ce-9d41-1869c116f5f4", "comment": "Malware payload", "value": "1194b14839866131888a19c32036478721c33e219f41c2bb52c26abb781d7b16dffd8c8e0c48ab6a571260ac18b3d5b1", "object_relation": "sha3-384", "Tag": [ { "name": "138-124-93-26", "colour": "#694291", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "relaycomputer-tech-net", "colour": "#308D85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619309, "uuid": "0ed5d469-8d58-4b41-9a5a-e857589d0f07", "value": "T1296240F1AD03CCD0F56392D2D9EE316871305B53E7A6978E00A59840ADEFA44BD88F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619309, "uuid": "8ead3a13-9ee0-462c-92db-b2e7b1ef60e2", "value": "384:mbD44MQFZDLEVWgkpZiHxwtVrR2hAzPtm9AQkDHWvxyFSx:TQnL8qay8o8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619309, "uuid": "cc32f72b-370a-470c-b99c-b114829fb8f2", "value": 14780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619309, "uuid": "11cf7689-c937-42e0-a4a5-0558b86d6d93", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619309, "uuid": "98d29fce-824a-41d6-b373-64c1b8189975", "value": "Client.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fa3e9c-84d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784616580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616580, "uuid": "b97117a6-b05d-4c38-93c7-4f0d8bc5407e", "comment": "Malware payload (PureLogsStealer)", "value": "cea071831277ffa48d28b886901af104", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616580, "uuid": "b4d38e5a-1ac8-483f-9602-c127ea47d7c4", "comment": "Malware payload (PureLogsStealer)", "value": "a84b71e331e6dbf5d36d91e5181c740ecc3d13a6f6b2e38d84365afefe80b1e5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616580, "uuid": "5d41402f-fdf1-4859-be9a-84c91e782739", "comment": "Malware payload (PureLogsStealer)", "value": "57c02f36fe88dfe7bc198316157aa3be13c45807", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616580, "uuid": "adaf8871-da4e-4eb4-ab37-ecfe4f4d9b54", "comment": "Malware payload (PureLogsStealer)", "value": "8c2b15d4f2a7780ce4e0ba69338b34dc667db85aad892b4ba20fce31718cc78d1c0a13c0c24f42bbf064571619a094aa", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616580, "uuid": "53bcec67-dd34-42d8-bd33-d1f2dd24cce8", "value": "T160032A2CA6891FF6A0DFC8E58246FFB921840E5A7440E12471FDECD10B2B2383D5366E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616580, "uuid": "6277d296-a8ec-4d02-8747-63442df02429", "value": "384:aJ4F4NZynJxsyPr1ErbHm0XLJRug/6JMJeU2:EC1Wbsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784616580, "uuid": "2d6e2742-970b-4230-b85e-edb85eef3c96", "value": 38535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784616580, "uuid": "b5dc4393-6947-455a-81f8-be706ef1a0fd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616580, "uuid": "28be74fe-d561-4bba-bf32-463090e170a6", "value": "mm.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa81b67-8555-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784673634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673634, "uuid": "e5b6f4f7-ab21-4669-9a17-e5ee7ad1a510", "comment": "Malware payload", "value": "17b4bda9f4dcec2f5e698776e7e4b9e1", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673634, "uuid": "d3f6f7a5-695e-4e11-9fd6-115785b974d6", "comment": "Malware payload", "value": "a9ff4fbde5bb27981136ca2902000af76636fa327fdfcae50f3de411cbb9f5e1", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673634, "uuid": "20372aed-20bd-43d6-89b8-ed1640ef12b3", "comment": "Malware payload", "value": "46d50c56d58b714f4bbc65b8aa43ddf9636c2262", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673634, "uuid": "016bdc0b-6080-4b97-9a7e-d14edf65079e", "comment": "Malware payload", "value": "370b1e638a6aff30d6426c39e4f59ce919e8c852645598fe8f0b5c4823651a5b91dfb335edd5bfa118a1599457668bb6", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673634, "uuid": "ea57e8bf-e507-4a37-b81e-68be0db5094a", "value": "T188F30EE06746C435D4AF99B9C4BBA6A7A833A21F9C18450D2CD2FF4B7D323464417CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673634, "uuid": "32f19822-845b-4231-84a2-3d2e2e8ed623", "value": "3072:yELIb0+wW1a++9bx7UM+lmsolAIrRuw+mqv9j1MWLQ5:yEL0hwW1u9bt+lDAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673634, "uuid": "47e8fd2c-d755-4933-b645-beeade6d3aa8", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673634, "uuid": "dd20d10f-fffe-4b44-b053-6028356df65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673634, "uuid": "427ccc11-1e6b-4691-8463-bc4bededf21d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cb5244-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1784620543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620543, "uuid": "fd1fcaed-444e-44ec-b88a-5698b078a58e", "comment": "Malware payload (LummaStealer)", "value": "9d7ae4dd9f29a3f59cb24ac0cfdd4e2a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "res-runtimeharvest-cc", "colour": "#62E68D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620543, "uuid": "1891503b-da45-4fe4-b80c-8d53614d6e79", "comment": "Malware payload (LummaStealer)", "value": "aa7e53ad3b051ed7c421377ea97ddc2344de9edb76abff5962827db871a4db4e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "res-runtimeharvest-cc", "colour": "#62E68D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620543, "uuid": "4db1103a-57ad-4553-87f7-dc271f7ee730", "comment": "Malware payload (LummaStealer)", "value": "7984eaf3d9b585583f5e4e536ee961e73463fc15", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "res-runtimeharvest-cc", "colour": "#62E68D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620543, "uuid": "1acab620-7083-4a5d-ae3b-182a401bc231", "comment": "Malware payload (LummaStealer)", "value": "4e548f69156a25de73bec750d20bf65d66d49d94cadc677c0100d934faa01148f5859538b0152b6d63bafbced662da31", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "res-runtimeharvest-cc", "colour": "#62E68D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620543, "uuid": "9438a6d9-fbfc-465f-8131-a4eb52fe78ca", "value": "T10C375A54EDCB84B2E90B1A71449B62AF63396D084F319F97FB003B79FE735E54822258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620543, "uuid": "fc0f9e44-71ba-4348-b316-2040f4059267", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620543, "uuid": "bc55efb4-0f8d-42d5-8069-a5ba4fce0101", "value": "24576:N0Gjg192rI/g/Ld+rf47Q95bQzsFDgDp+JeODtYZtAqelnj/1iQwsTepdN/psCto:N0EgqsnN0fApRjEIhY+zqA/34bQJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620543, "uuid": "b5475f18-a2f9-413c-a0da-5b715b4e6dbf", "value": 23957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620543, "uuid": "28073667-d77a-4e50-b0eb-64bec0bac5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620543, "uuid": "a969a6a7-40d7-4088-8e3b-ec133c0b7915", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded60b21-84c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784612510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612510, "uuid": "1a3016ad-2d69-481d-97c3-9881c851e2ab", "comment": "Malware payload (Mirai)", "value": "b033711b1174c807af7c54d9e32c02c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612510, "uuid": "502e96f4-79f6-41e1-baa2-c0c5160311c7", "comment": "Malware payload (Mirai)", "value": "aaefff3ab529ab233403fe23891de99217522fb371d4a505e4e8145f305b0ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612510, "uuid": "0e6fb0a5-b48f-4d41-a3d8-f333f44ba9e5", "comment": "Malware payload (Mirai)", "value": "ade1e5636756edad09bbdd8323dadfda2b935272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612510, "uuid": "97858ff0-494a-4498-96b3-74eeb700d0f0", "comment": "Malware payload (Mirai)", "value": "62fe07559ba808844530678e193ced16fd6162b212bb1640eb863a69960bf567227c9ea99c69dd4a4a58e1ad34cec0ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612510, "uuid": "62995374-c9c1-466b-94b2-396fd3fd95eb", "value": "T15A833947B981D0FEC459D03887BF7637C923B47E1239B29A67D4AE262D09EE01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612510, "uuid": "ba65ff63-2b1d-484a-8c68-8fa70d0e532f", "value": "1536:cTHF5amJjfczdAqI+zKRqakCkj6Rv3U8GbdGrAyvTdol:cTHJFczdAqNKJkCdRvAbdGrXTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612510, "uuid": "10e247e7-4737-4614-8097-e4397ec3cad6", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612510, "uuid": "8a586d3d-948d-478d-9793-36f834776011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612510, "uuid": "2affe17a-4b69-40c1-b332-ca25190e7c0e", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3922d501-852d-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784656470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656470, "uuid": "407a337a-b646-4e37-b3e3-cff17690e582", "comment": "Malware payload (CoinMiner)", "value": "4b1ff336071a687cd35ef14ad285c854", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MOKKXLL", "colour": "#B1C63F", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656470, "uuid": "3da26363-1571-426b-a8fa-5b65a2de59f9", "comment": "Malware payload (CoinMiner)", "value": "ab161caf790e0722f10c95343132e648a3d64185ed575834e5a9853c9dca7618", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MOKKXLL", "colour": "#B1C63F", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656470, "uuid": "4030bf8b-c4d9-4813-8675-e2086ad11dd8", "comment": "Malware payload (CoinMiner)", "value": "9d7477931b00cfcd23ae914fc2bb8f781cfc7616", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MOKKXLL", "colour": "#B1C63F", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656470, "uuid": "37733cad-30b5-496e-8e5f-1c5b4572eca5", "comment": "Malware payload (CoinMiner)", "value": "af85a8daeb6ca8ce81f19c63dba7be0caf4a9ed3d84b6d8a446a2f9364b39596eb1ec43efd65a6aec523e69c8338cdce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MOKKXLL", "colour": "#B1C63F", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656470, "uuid": "538ffd92-87c5-4fa0-93e6-c0b36af883df", "value": "T1DFE5F23FB28B653EE06E5A367A72A210593B7661A5134C16D7F4C88CCF260701E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656470, "uuid": "e5c855f2-cc63-44ac-b797-cc7a9cad89e9", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656470, "uuid": "91d4d7a7-688e-4050-9cbf-b3736adcbdb1", "value": "49152:QuIuhWNlC3c3CZnMYEMmFkqlM/91+f1Ug83BnF2ymqpZSIy1tQ8:Q5W8lCWCZnMQmFkr/TTg64opZSIyfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784656470, "uuid": "4dc3ff24-3339-4155-9420-867f7c6ea9cd", "value": 3240968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784656470, "uuid": "29a1d5ed-02c9-4839-9997-bd2488cb0d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656470, "uuid": "6e21b7f4-d3b7-4acf-afe5-fde129ccd8a2", "value": "RuDNS_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9994ccfe-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611105, "uuid": "d1629360-ca7c-4a80-b5f6-8e569c913375", "comment": "Malware payload (Mirai)", "value": "ae372c5928ba6644f920a2e2e524e84f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611105, "uuid": "138ad559-7e38-4a12-b59b-64aa8497136e", "comment": "Malware payload (Mirai)", "value": "ab8468d733fb64f4d4db929100a690683ae1426748e7dfe7563146bb033441b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611105, "uuid": "5320caf0-be99-4a10-99a4-1d4ec1e0e6f2", "comment": "Malware payload (Mirai)", "value": "86f76cb1158a04bbb4387abc625b1a5a202e11f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611105, "uuid": "5c13c992-6f39-48a4-b4ce-3979cb2c35ad", "comment": "Malware payload (Mirai)", "value": "fe9a4837b9fa859b7dbf46d7cab49908630e6247366d3b7d2bc01cc9892df39e74d35d4defd72d943621ffedaeea1d73", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611105, "uuid": "7bdd82cc-6e7d-4baf-85a8-16465e5b834f", "value": "T1E7211D87225706F13DF3D9AE71A98824F280B08E3DD5DE29F4EA38B5814DD4C7546A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611105, "uuid": "2f29a462-f33d-4e55-a598-bb0922b0d2ce", "value": "24:vhQLYoghl8hTRShFsGlhosmos6Dho0o/hoOow:vWQcGzfqOFDqh/qjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611105, "uuid": "ee906f29-e9c8-4ee1-9e7c-828edb511b20", "value": 1177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611105, "uuid": "4b5fc89f-c777-41ef-9b53-2cbdb7a41a02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611105, "uuid": "9e0c395f-bd4f-4db4-b003-da6288cfd34f", "value": "Mugen.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91253146-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784618392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618392, "uuid": "afe1bf39-67af-4e62-a94f-7b037c222023", "comment": "Malware payload (Mirai)", "value": "aacfb26e7318e37c9cc8140d079bb416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618392, "uuid": "30d0be0c-56b5-43c4-aa61-2cc59be99c57", "comment": "Malware payload (Mirai)", "value": "ab9eb4490925bd5fbbb4aac51ce8a9b701e25b1b6f810a68d68f2cdbde951646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618392, "uuid": "cb147b9c-97c0-4b85-bad2-9019b561ebe5", "comment": "Malware payload (Mirai)", "value": "023b49addf1b5a4b28c8b63fa9258a36e3987caf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618392, "uuid": "b76d4d64-14cc-4017-a46d-ecae699e9dfd", "comment": "Malware payload (Mirai)", "value": "dbb37b02a40eeae95371944cdf36f09b413ac75b7b3dca5176c68e5a3e02b889efa39969aade048ac3d60eb17c76491a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618392, "uuid": "e8eceec6-d02c-4284-a6ef-effa4a301eef", "value": "T190432885FCD2996EC6D013BAA72F358E33A1B3E4D1CA3603CC945B21738968F5D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618392, "uuid": "0d5fbd4f-8963-44ee-a8b4-a49f150dfe65", "value": "1536:7ApDTwtNTTj7yEFMTgRAMTjd64tXD7td:7ApD0tNTT4M9PD7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618392, "uuid": "ff6056fd-3b4b-4887-be82-63c80d98e301", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618392, "uuid": "5973a565-3e00-41e6-80c9-af0c5af3088f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618392, "uuid": "66dafdb4-c6f6-4580-a754-fbc70a3c4643", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05210a4a-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593247, "uuid": "f6caeebe-ab4e-44a8-afae-11a3892d9064", "comment": "Malware payload (Mirai)", "value": "d365edc46eccf6dfefa8c152dc72581f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593247, "uuid": "65d31bd7-a902-4219-8b1d-9d3ddf3b526e", "comment": "Malware payload (Mirai)", "value": "ac93242580236d6e3be41e03c6dd00aee95c9b0921cfa9356dc307b5006f9e69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593247, "uuid": "1c0e68ce-6e1b-4e35-a230-a071c5a71784", "comment": "Malware payload (Mirai)", "value": "8aecd09641f8c894beb7d1c474d66960e8ac9059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593247, "uuid": "d35e9d49-f40a-4d65-bd4f-caab89cffba8", "comment": "Malware payload (Mirai)", "value": "89e20f4bde973d414a9a66c08f00188bffeed0e816714301cd028ad9ce90e36cbbacc869bd969e407755c04927eb0479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593247, "uuid": "2650fd20-bf55-4779-afce-ddbb43775193", "value": "T1BF930782BC81EA16C7D0137BFA6F108E331567D8E1DA3242DD251FA47BCA81F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593247, "uuid": "434afd7e-ce65-4193-919f-a8fb59d364ce", "value": "1536:tBywrO+bV2LkKsZCPgtAURwaxmXzsk0gDmvzdJq9xB8t46bZp67WJJwUw:tBg+bVqkAxJVQJgz84wZzJJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593247, "uuid": "64a529e0-a5fa-4473-8b81-880c638b26e8", "value": 91132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593247, "uuid": "44711a2d-3bef-4cc2-96d9-e59f2fafe504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593247, "uuid": "e1cfa0ce-9676-46eb-ba64-249cd23ca4ae", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c83c28-8500-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784637159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637159, "uuid": "34c0b57e-9df7-4dbc-95fe-015e169a5c41", "comment": "Malware payload (Mirai)", "value": "7c1ab2310908633e0aac5f0409a796fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637159, "uuid": "3e52c9ba-9b2e-4441-9265-a04aed9054ea", "comment": "Malware payload (Mirai)", "value": "acb7294abb6f559fa9d7f75dc813b682a8b7b1a22c4f3b567f98f526b0eb9678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637159, "uuid": "42e8dd9e-a1ad-4bc1-98fc-176a9e2359ba", "comment": "Malware payload (Mirai)", "value": "4922e6bdb9bc8986b2cf777e83b8658637f18050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637159, "uuid": "a6a62cdd-d2f3-4c1e-8d23-4d5f8ae8e87d", "comment": "Malware payload (Mirai)", "value": "18d75bfe36840e30927f77424fe19baad8ae8da8e4cb995ff482dfb3aca144e65a5bf1af322e08618f9207dd4949049e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637159, "uuid": "db4d5e12-f06f-47e2-9ed3-343e6e0ed94f", "value": "T168B31763DD26AF16C516E0F0B2F24E795B53BD3A49871F99A436EAE44143CCCB1063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637159, "uuid": "05e49824-4461-472d-9fae-a01729483c48", "value": "1536:PuNzfnzYpCJKlRg97oNmohtraiDeWWWhI0ApRbH15a:PuZPzYpBlipohJaInW8WphHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637159, "uuid": "14cc6a68-5b1e-4cae-9e3a-0e02354927c9", "value": 116896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637159, "uuid": "d12face4-632b-4708-9ffc-126d8d532e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637159, "uuid": "d835b2f5-81a1-4c07-9fb5-8f0d17bb394d", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6dfd79-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1784672714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672714, "uuid": "4b4d9670-b1d3-4815-bba5-683d6e1d05b1", "comment": "Malware payload (DCRat)", "value": "22ce9b4f200c32eeb293116301e97307", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672714, "uuid": "f8a79eed-04a8-4c9d-af73-c1221f8d5cc2", "comment": "Malware payload (DCRat)", "value": "ad5a8f0a70678395eee394dbe48b2508784e06f37e7a980f4bd61599d180360d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672714, "uuid": "8a9332bf-bdff-4024-af23-46cf19f12492", "comment": "Malware payload (DCRat)", "value": "7c68c908dddecfa9ad6b4096f81127d46f1ca0d3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784672714, "uuid": "905da2d5-4027-4fcd-bd60-6b56d8184e70", "comment": "Malware payload (DCRat)", "value": "77acef358518b6306656f99faa4374ab9e4f2425583215567eceb738b7f0cf28907e854f3b93f0d3e291b1736e02e5e8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672714, "uuid": "2fb4177c-5106-467b-83ee-bba49fa95915", "value": "T19FD5DF017E46CA01F4191633C2EF855847B1A9516AE6F32BBDBE336D95223973C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672714, "uuid": "071d03c2-8f20-40bf-a905-ff487a6748aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672714, "uuid": "6d42f2ca-d330-4441-b609-c9322174c550", "value": "49152:KYWPh3V0cH0kRHPcEsz/gw3inptdNuW9xLWiYkIX+RPKYwwMz:KTV8APRg/byptdPWcIORPZwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784672714, "uuid": "5cb84c06-3955-4486-89c2-8efa48bc26b7", "value": 2878976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784672714, "uuid": "a75d6bf9-5fb1-4d80-b45d-e52f9635a222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784672714, "uuid": "e8aef202-925e-4d67-8872-ad56e1537196", "value": "22ce9b4f200c32eeb293116301e97307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1c9a16-8503-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638359, "uuid": "d02fb0a3-02cb-4d2f-a6d6-a00d559bd674", "comment": "Malware payload", "value": "ded6e513ba610fcc5843397e552c3d08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638359, "uuid": "8b6d482d-2dba-4db4-a55e-267da356ede9", "comment": "Malware payload", "value": "ae5d7fa1689d2e6a2fb06a274f8fc47082a771775a966973640f082dfe5a86c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638359, "uuid": "eda3da45-cc6d-417f-a7b5-bcbe8aac1e18", "comment": "Malware payload", "value": "3b8c37ac3a38ac70771224aca84d806564b8b8d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638359, "uuid": "bc859191-7866-4403-95a7-72dc3e679dd3", "comment": "Malware payload", "value": "eca3c807a189b69563296cabb2f212aabe11cd51826c1bb9b3447d7774e50d419eb0a5ff59801317111131d9736a50ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638359, "uuid": "f1a43ae2-e679-4029-b89c-4e36c92752bd", "value": "T17FD3E702BB0D4E43E1532DF4377B1BE1839BBD5228E9E280751AFEC993719B16506E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638359, "uuid": "195c802e-0d0e-4d46-83ff-8a62874078c2", "value": "1536:Fk1oEcXyH1xbdiGPOwkxQPdZ/1F5Uge4XjDJob4Uarc7MTtvAA5rNXqNYVO2N5pn:wfcsbdiUORxq//5UQjD+4UarHqAzvyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638359, "uuid": "a53e77d3-2aa0-43eb-b618-bf15dec19ee4", "value": 135072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638359, "uuid": "7bd2cc39-2628-43f9-afe5-e077e9f5cdf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638359, "uuid": "1a737f35-1512-4fc2-8523-90ebcbb46fcf", "value": "eclipse.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35ab524-84c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784612517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612517, "uuid": "fd331fdf-f28f-471b-bf67-31b98252ff11", "comment": "Malware payload (Mirai)", "value": "6d50ca062f8ef6b93f33a1930eee066c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612517, "uuid": "4fd12f5f-0cdd-4c8c-b75d-8341ea5d1429", "comment": "Malware payload (Mirai)", "value": "ae764a11e5a7aa0b064846590708a01c7541c73f50ced0637fcb7b786b196303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612517, "uuid": "e335a02a-8a82-4bac-a462-fe686a2efb59", "comment": "Malware payload (Mirai)", "value": "bc2d2d9f3eaaadbb410b45d86142b5d2b8347225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612517, "uuid": "46c07c18-f0a3-485a-a16e-e78e12b90e7d", "comment": "Malware payload (Mirai)", "value": "5c3f854f3a47a39b4669e38c718a2b37671d268b106adef1e8f8e5897d1e2739f3c823f7bf74db8f4fd72150d3984a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612517, "uuid": "03c67eba-ad54-460e-88ae-60795c4bfbb5", "value": "T1EB03F19ED079DB24F32211342C9E69CAD411E648AA66CDD6CFD4B31BB9C7F342638380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612517, "uuid": "571c9a34-23bc-479a-bbb7-9f52862b64ad", "value": "768:tx5p/c2aKuPhv7wUXEspvjgtmkCqYl4MkSkCaG66IFnbcuyD7UHQRjS:txf0CGv7Nt2mocuBMwnouy8HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612517, "uuid": "02c876cc-9e98-469d-9a07-f05bc125012e", "value": 39684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612517, "uuid": "4393e47c-5c02-4f89-b871-062b52b92476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612517, "uuid": "6f034002-ebcb-4335-8d97-4ae028677690", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f01f79-84e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784625292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625292, "uuid": "6223006e-a557-463a-9f04-ccb19b386036", "comment": "Malware payload (PureLogsStealer)", "value": "190b4c2f0360a4a742785ec9995dc948", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625292, "uuid": "390fdd63-8583-4497-a6d2-b47a9fd69626", "comment": "Malware payload (PureLogsStealer)", "value": "af0afca585caa54140a6673622f2d2093dd5e76eb7b71d428e3893c130cf1f8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625292, "uuid": "405a6143-998d-456c-889d-5af016033e85", "comment": "Malware payload (PureLogsStealer)", "value": "7d2dee03d50f1d8d92c1f2eface99341c54e6f5c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784625292, "uuid": "cdc1d964-4f5c-46d4-a9fb-408b803417f8", "comment": "Malware payload (PureLogsStealer)", "value": "67be95184b7661f88e5409d3a258ef4790726a0acb0668be618156216c10690cffd5a7edb2a255b43d97375bab502661", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625292, "uuid": "8dc9d7c9-c78b-40dc-8526-19cee08d9a73", "value": "T1A775AF4BA3C6044A0EF45824A17D3250079B7731C538B7E89CBC1AEDDFB769B4399BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625292, "uuid": "b98da3c4-7e2f-4351-af08-d959436fd0c6", "value": "24576:i+F7ry21+5QyznAYrT4Tzm2NfPXSjYRwSXSd0/hdK3KYqPH:5F/y21+5Qy7AQX2NfPXSjYRlXSd0/rK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784625292, "uuid": "1aeb6a5c-fa59-458a-9ab4-357568b72f54", "value": 1552678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784625292, "uuid": "7c0bf38f-8d9a-40e4-bd0a-979424aeb6a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784625292, "uuid": "fe3a143f-a239-4572-b96a-4398ee09f562", "value": "PO-O12967-0726.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc7bf1e-84ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614196, "uuid": "cebe47de-b558-4424-8dee-0b1e6b110d69", "comment": "Malware payload (Mirai)", "value": "b5eb97a4bb91106e998711804c3c7cb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614196, "uuid": "5a322115-b499-4ddd-973a-ed2294e69a13", "comment": "Malware payload (Mirai)", "value": "af1e82d30143a16d33b00585dd9ad8ff7f158b9d53774fd5c0e722e109681425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614196, "uuid": "2ad5fdc3-11c1-48f5-942f-7747fdd7bf18", "comment": "Malware payload (Mirai)", "value": "074ab1454c65947fe8ff0f9e6fbf61430d72a826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614196, "uuid": "beb3933a-772f-48b1-96d8-715e7dbcb477", "comment": "Malware payload (Mirai)", "value": "9715b117fa6700d09eb8fa9e085c5206d21e0d86022d31aaa788c2cd2db12ca15672405cba55a6a0fa2cc702eee0beb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614196, "uuid": "6651ed0b-3d4b-4106-bb01-4d945b24d103", "value": "T16A241847AF500EFBD83FCC3F08A51756659CD4A632A82B776634D51CB68B34A19E38E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614196, "uuid": "f0a2a593-4995-48f8-8991-b34251c59a1a", "value": "3072:336WMW+TM3XJ6HnY0+PAFnFJYVnQip6Q65pZJE:3qWb3XJ64/ALip6Q65pZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614196, "uuid": "b7119e2e-201d-4f0b-8f94-4b52a0797493", "value": 209512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614196, "uuid": "a2cd2e54-fdfc-41e5-a68b-836a6e68689e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614196, "uuid": "0209f0e5-e301-49e1-a3d8-5f3f3eb77560", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed5440e-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemCom)", "timestamp": 1784613154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613154, "uuid": "957f8110-7d5d-4c0c-ada1-3d2e9d41c17b", "comment": "Malware payload (RemCom)", "value": "1c1280469329139b25a57f2894e4a034", "object_relation": "md5", "Tag": [ { "name": "RemCom", "colour": "#66695B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613154, "uuid": "fa360265-495d-472b-b959-1eac9554cea2", "comment": "Malware payload (RemCom)", "value": "af2ddbb1342c32efb23134f2a40d1ad390e85f57296c3dee753c99f867fc0ef2", "object_relation": "sha256", "Tag": [ { "name": "RemCom", "colour": "#66695B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613154, "uuid": "85555876-d73e-4333-b619-462309e144de", "comment": "Malware payload (RemCom)", "value": "0c12c4e502b2b4f7787d37beefe45e3136e8c4cc", "object_relation": "sha1", "Tag": [ { "name": "RemCom", "colour": "#66695B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613154, "uuid": "80a7c471-b209-44ba-8111-4c35043ad93b", "comment": "Malware payload (RemCom)", "value": "0c513628c188fbfc33e467052c9958dfd1cc3172158317089e3feafbc13ac3e1f55f89e5e27e6743341aff152fc82c7d", "object_relation": "sha3-384", "Tag": [ { "name": "RemCom", "colour": "#66695B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613154, "uuid": "dbdca182-b9fd-4b8d-abf7-b90ffa54f516", "value": "T12F74AF19371D7862B276212F4D3D9E2396E1F19DA702CAD06208FF787DE95C3AB10678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613154, "uuid": "c615b127-52d7-4e9b-8bf5-60ae31f6832e", "value": "384:cpMpQEkr4yK//E2iTqbQiQ/myKyA7QbKygdhm0gqZkW/U6POm4ixh4WW0AQXXOL0:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613154, "uuid": "7ace8803-c74f-4e01-9956-4d10f3785649", "value": 361574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613154, "uuid": "2a7f454f-326b-4acc-8481-39f59c214a78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613154, "uuid": "e5ac9f81-f1dc-445e-81fc-1eeb023c0292", "value": "A-7.21\u0548.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb75ecf-84d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784620079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620079, "uuid": "6352a990-48ab-403c-9395-c813855adf4a", "comment": "Malware payload (Vidar)", "value": "868e51f08e272aa9f9a1ae2136efa08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620079, "uuid": "55531d92-fc0c-43ac-8f50-bec9e708a2bd", "comment": "Malware payload (Vidar)", "value": "b12ff0101d1b95f11bbb6ecfa70ad0cc5e48c96b2a55200de2df6919087ebaef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620079, "uuid": "dda9d311-b318-4ad1-87ea-3c58d4f194ee", "comment": "Malware payload (Vidar)", "value": "057f3732a057973192a505c8d58707a09e7daf8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620079, "uuid": "4d905e4e-c087-4db0-af34-ecebad472ee7", "comment": "Malware payload (Vidar)", "value": "e930cc1993163e0154a83870b634cd942542aaed751fedd77d6450cfdaf2c5831b1a45bc2bc31907679e846b35fa112f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620079, "uuid": "c49e82b5-ac6a-4bb6-aad2-ec766d1f234f", "value": "T1C3F58C07ACA188F5D06DE232C9769546BAB5BC090B3233E72E50BE783E727D05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620079, "uuid": "1180c50e-fb2e-4685-a0f6-41ef6697f575", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620079, "uuid": "2af571a3-4cae-48a0-88bd-609906ffce18", "value": "49152:DT0zC0ttjbQROpd1nikz664Bbv4Axx8ypN3R8FNrrryfnwREIfi:D543rk74yqUFR8DjKnwuI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620079, "uuid": "b5d66bfa-e9dd-4aae-8d8b-7280b50b2105", "value": 3548528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620079, "uuid": "05bc8e08-3dd5-4e98-ba1a-2e640e31449c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620079, "uuid": "91c37e07-9a1c-4dce-9e4b-c7259b3bd463", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c31166d-8536-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784660260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784660260, "uuid": "6631753b-ba64-4690-a372-b1ecb06a071d", "comment": "Malware payload", "value": "d37350bc94f5fef9f9d82ca627e730da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784660260, "uuid": "0d5cbcf7-c3f2-4d67-b3a2-ab5d5b474542", "comment": "Malware payload", "value": "b18824d6cec9f8da6371f09b57a37b096a9ab7c84affbdb475d1d0564f66e19c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784660260, "uuid": "494d9730-ae8f-4635-9220-3d0437da26df", "comment": "Malware payload", "value": "438c60191e118b3354806adb61194347c4ae8ac9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784660260, "uuid": "f8b6cdc4-3f29-4346-bd24-7eaf791fff96", "comment": "Malware payload", "value": "289c7cc31afc8a90157d3b6946583c171af1fa5484a42b8a7c78e97fd4405cffcb6981396192edac3de8b514245a03ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784660260, "uuid": "e30df8dc-bbcd-49d2-a87b-e034aba407ad", "value": "T12401ABCAD124D800409989AEA2D79154F421C3C61B4F4F78FF6C647EDB84E20F027F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784660260, "uuid": "beb57a9d-04b6-43df-adfd-bfed3da0446c", "value": "24:kXCKysE2hi0ziQvZohapNFv2tj0SxPFmqYXkX:e9Qp+MspNF+5lr+kX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784660260, "uuid": "f0270906-3ff7-4337-ab39-be3a02acaf20", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784660260, "uuid": "65219d08-ce72-4713-b232-0a55a9299f9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784660260, "uuid": "7fdee6cb-0093-4b2e-ae3f-0d4d9d2ba4b7", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca3155b-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613365, "uuid": "c3238f0e-fa9f-4978-b3bf-720aec226751", "comment": "Malware payload", "value": "3aee1ed4b97e12b5191cd8bf724edab6", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613365, "uuid": "5aad0de5-1b53-4996-b011-ed3f6af7a4a4", "comment": "Malware payload", "value": "b29538ef8ab745d8d7f0a7042dc6954a8724c6dc42d1755672aafe59b397ad25", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613365, "uuid": "cbfc7029-3b62-4736-b3bb-59ebb28f292e", "comment": "Malware payload", "value": "0a7316c00de8281972790d84388a258c234dfe47", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613365, "uuid": "8898b17d-daf5-4e6b-835e-b331971df82b", "comment": "Malware payload", "value": "3d15ebb647b8855fbd8dfa758a50e09e725c996546f0f61ad8d364f4125a3e591e240a5d4a83c681e7a8bb5587f0b039", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613365, "uuid": "09a2d29e-f11b-4002-a95b-d90ba0b953ae", "value": "T1D5256CFB13279E8F9A1E1D50F4080349EC7CEC9BA1DC81F9AF458DA649B545888B4E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613365, "uuid": "1ae9845e-ad61-4589-833d-bfc91954f106", "value": "24576:1pFggULWJ08yXm2i6OM4ojEdEnDk89SB5JzxZkVZxP4Hs:1ToLO0vOM4ojEdEDm5tqxP4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613365, "uuid": "11034ba0-34c8-43ca-aa30-601b2a8ad591", "value": 1019502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613365, "uuid": "da8033bb-91a0-4aca-b03c-e209c60b2c99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613365, "uuid": "bb9b4112-ec5a-4582-8c2f-f6c3a393a616", "value": "b29538ef8ab745d8d7f0a7042dc6954a8724c6dc42d1755672aafe59b397ad25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca89670-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613392, "uuid": "759a8c84-d0bc-4ae6-be60-8643baeff6f7", "comment": "Malware payload", "value": "d3b6d5fe0e7acfcc7b1f0236a2b41906", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613392, "uuid": "9c6dea39-5eb1-483b-8f9a-9970247da622", "comment": "Malware payload", "value": "b31906caae86e84dc86fbec7116111474a15a2688509364f9b687bf75cfcf6e7", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613392, "uuid": "56d51343-ca0b-4e62-8f4e-52060fb972eb", "comment": "Malware payload", "value": "c02fe9012e2b00ce6692e1de40103a758a2ff6d3", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613392, "uuid": "a6e767d5-d2d5-447e-a0b0-9c941fccb5f9", "comment": "Malware payload", "value": "18aee203eef4059f853dd8263905f9823516f52ac0a9fe7df337cbc9f0b9f7774ea07548e62bded0cfd53b8e6d3b0e24", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613392, "uuid": "6f97432f-2792-4207-8499-7ae92506e4c7", "value": "T128E4AFB65355AC9F4A1C0E65F4180B4B1D2C58D7E678C2F87E82B4F886A61A40FFCDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613392, "uuid": "135f0dfa-db0a-4c6e-ba87-833ce70da40a", "value": "12288:L9hd0ptLQ0q3KfSvK3FLXaj5o7+3CNYoJQvZxOO9LQSe272rTlUXq2fX+:h0pjXfkK3ZKjVSNYoCqONQSeLrTKXqAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613392, "uuid": "91a4b8cb-d539-4a42-8f34-4f610c128573", "value": 706026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613392, "uuid": "14ccfece-ec3d-42b6-96a7-fb7e7d428a27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613392, "uuid": "47a94ca7-1ca3-43be-b26c-11e957dba8b0", "value": "b31906caae86e84dc86fbec7116111474a15a2688509364f9b687bf75cfcf6e7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b933391-854e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784670728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670728, "uuid": "c0e9dd21-bf09-4c20-831e-d14937531616", "comment": "Malware payload", "value": "96d9b2e24488bf537a17b488e4aadc19", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670728, "uuid": "aaaa22eb-888d-4d2e-a6ab-198d74137d54", "comment": "Malware payload", "value": "b32527764b33b7584ab9466b5c34efe0e4c24daf2e19e792ce2bca59bd3bc4f1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670728, "uuid": "fd1fa3e4-3d97-488e-a973-a8a5b6301365", "comment": "Malware payload", "value": "65cd9bfca4f1326afa72ea4051cc72f9b8395ae1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670728, "uuid": "fa79e072-009c-404b-a01b-b848ac6534d3", "comment": "Malware payload", "value": "aa10537804c0c469af3ff0e85101699daa56d6da060d7cbb6576333ca5aff92bb193678a39cc5ae3fdda492ce6051f05", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670728, "uuid": "8664e1be-7679-44f5-b380-1046c8a24c1e", "value": "T189E63348E5E002FEDAB361BC9EF25654E42178B41B32C6CF576496A66E531D0DC3CB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670728, "uuid": "24deae7a-80a0-493c-bda7-f37d9a59d94e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670728, "uuid": "d9fda16f-a8d3-42be-ae39-85e6daae865d", "value": "393216:O7K0QlrVggBivhgtl/9hXMCHWUjX4cuI3/PGTAI:O7KlrVJtl1hXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784670728, "uuid": "e3140ce7-185f-40b3-b992-7ca23b39c33f", "value": 14289961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784670728, "uuid": "9543bc99-4334-4643-8357-494ab3dc594b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670728, "uuid": "c8444735-9b46-47ba-bfe8-22b638881fb5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f447ef-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593248, "uuid": "9e1cf04f-039a-4f4e-9b71-d0f063f3449f", "comment": "Malware payload (Mirai)", "value": "f29dd3384847be0e3a3dbcf1b5425b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593248, "uuid": "dc8cd49e-1559-4d47-b0fb-d59ba324bb05", "comment": "Malware payload (Mirai)", "value": "b48be96d4178766e340c72991622f74f66b10791742edc9e326ea77812261288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593248, "uuid": "d9f18cf6-edbb-4e53-97c9-49a459a471d8", "comment": "Malware payload (Mirai)", "value": "8cd5b2570581dc70d358592a45c3c8fef62534ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593248, "uuid": "957610d6-74d9-4d42-b1a5-7003b2e2bd3a", "comment": "Malware payload (Mirai)", "value": "cd0b373725a508cb1f6d6bf91a63033dc328ae93e5932cbfd0aa48e7d1559489fa18d55ca9fa6dba3507c7c8990a626a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593248, "uuid": "2f812ce3-3013-4e64-8327-4a73b0323ed1", "value": "T105739D76D0B86D98C5148A34A6AC99B88B17A40467A37FF2C6C1CF654047EFCF2147FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593248, "uuid": "62b1a0e5-fdcb-438c-97e1-53a3f418ccd5", "value": "1536:P/kM1DnBApwt1N0Haa+9mUESf9RwU9K4H00lRCi8G:PMMxnip4cxS1qkdH00D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593248, "uuid": "66cdfe2e-649b-426e-b6dd-daf095212d27", "value": 80596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593248, "uuid": "cfcfa1f4-8ae2-4648-b5e2-0772e203c20b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593248, "uuid": "0a900458-764d-431b-87eb-550cb4fa5102", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b404d3a-84d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (NWHStealer)", "timestamp": 1784620047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620047, "uuid": "b10944ce-38c4-4c83-99cc-145664e5f15d", "comment": "Malware payload (NWHStealer)", "value": "84255ff0dc94545ba6cf0d0764c622e5", "object_relation": "md5", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620047, "uuid": "3b0d707e-de9e-44e3-b7f1-38c9c9a30efc", "comment": "Malware payload (NWHStealer)", "value": "b49354efe2db3cb125aebb365d092c38b2334386914a8b4052b9d46571801d44", "object_relation": "sha256", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620047, "uuid": "b7a67d3d-3eb9-4c77-bdbc-2e6e267c363e", "comment": "Malware payload (NWHStealer)", "value": "9f4a71ccf63382cc38bb57e4fe3df9bf4287e266", "object_relation": "sha1", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620047, "uuid": "cebd0f3d-ec9e-422b-bfc8-2a399e07b588", "comment": "Malware payload (NWHStealer)", "value": "cf857c92c1f129e43d1463d285ce5c1aaea356207eca3c78d8d79510aa0ab4b1bdaa546f4d5482c95184333c52557136", "object_relation": "sha3-384", "Tag": [ { "name": "cucumber-oslo-cc", "colour": "#E34A13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620047, "uuid": "e860c96a-7d59-4f73-990a-1da16f5e52e9", "value": "T14D286B43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620047, "uuid": "3c82c61a-9cab-49b3-97e7-8e8dc8d2fb66", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620047, "uuid": "fb21546a-dc34-4b3b-b3be-33d14ada4b0d", "value": "1572864:pZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:pZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620047, "uuid": "5dc39067-11e8-4964-a7aa-a01e7a799f81", "value": 97870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620047, "uuid": "d3239862-00be-43f4-a877-ea7d9e3d66b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620047, "uuid": "4bd6c322-d604-44a1-8265-80ab4df0ab19", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6189c15-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784615072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615072, "uuid": "2c08104a-d3ad-41cf-9cbc-33f44f9c3261", "comment": "Malware payload", "value": "fab5e19ae4f530a2cbce30299bc7e5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615072, "uuid": "d8c6e7e3-82e8-45c4-a19d-a6abaaa2cf9b", "comment": "Malware payload", "value": "b4a1fc36a4ed48c7e50f5b9a403866390fd925c50ae002932e0c9ed203bac7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615072, "uuid": "90df3e61-7f53-44e8-8b6d-fc6a88488be7", "comment": "Malware payload", "value": "e2693cbf0db464cdfc5c082bb777773ee53cff1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615072, "uuid": "7cceab91-95d3-4f45-8ddf-293ef6b17f09", "comment": "Malware payload", "value": "1b3153deab5c3d660b8995b7a270a25efc082f5ec7c4cec351b943de3dad41df3fcdba508b8319e6c9514951ff874541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615072, "uuid": "6b306b6b-737a-4e31-b273-281f2bae488e", "value": "T19CC63354E2A44AF7F9E7043D8653A4397676FD210F71C28F07B899A52E637E08E35B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615072, "uuid": "a138a0d0-2be8-4c4c-800f-ab11a0715d48", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615072, "uuid": "535fc011-4178-4018-8d0e-7fa31bf30be3", "value": "196608:4ctokKJW+t2PKMmjdV6kh1DvgKaZca1pgyhMkMgQvK3ehQeH2dCkBtp88cWtRDU8:4csJW+tHjdl15LyFQvK3eaeKBpVtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615072, "uuid": "f2b16932-cbf3-4511-94b0-a5d8145f1907", "value": 12604611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615072, "uuid": "c13d5665-fcb3-44f9-8289-7b4d69c092ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615072, "uuid": "fa6384fe-27f8-48f7-8f87-c3b943012850", "value": "online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63b6242-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613408, "uuid": "f2e3ca05-45a5-494d-ab64-c6dabe98c1ff", "comment": "Malware payload", "value": "bd22ca9e4f0ff37686a9f4c4942cf474", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613408, "uuid": "19876e2c-f153-42f0-be2a-2fa3b48d4cd2", "comment": "Malware payload", "value": "b6338fce20d50e1e412d85a5867912acac1318e8355c3db69b7f95d518e1986c", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613408, "uuid": "16aff99f-dc53-409b-811c-8cf50f13690d", "comment": "Malware payload", "value": "d4dc794723f4ae3a0d15ba9b687192c08aaae229", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613408, "uuid": "7925f89c-8acd-45d8-b40e-892d59ef8d7f", "comment": "Malware payload", "value": "329ca1f42425e4d30e5bfb498b6f71b3fb0c05e9442f7a9fd49b7eb24522c8769c911cc9074bf17258e648d6f010f0bb", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613408, "uuid": "26fdb27b-7c74-40cd-b855-9498fa3851f2", "value": "T1807495FA6036ED8A87370E80E1043F179C299EDF667847F8778815D1C29C68C99E65BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613408, "uuid": "5fa2e4c7-56a2-4bf9-bda5-75b116e27bfa", "value": "3072:SGtqosLSrDqHf8RcYJQML/XTTTI6Toq7mF3D1igU5hRQ9DN8gADDZ0EDQvytwqVk:KyMkRrJPL/TXXMZ0QjYsljH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613408, "uuid": "90bdb7fc-66f4-467b-bfe5-4953bd997611", "value": 337284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613408, "uuid": "1feabd33-3a06-4373-9cf1-4c8cbf783372", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613408, "uuid": "a1f43df0-e616-4575-b0da-0549b8c910e8", "value": "cnkaFkm..ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd02d999-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593233, "uuid": "52ccfb0d-855c-4339-bcc9-6bc7e7605dc1", "comment": "Malware payload (Mirai)", "value": "0523a603386515626e6715e45a422a5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593233, "uuid": "d86e3e39-3a46-45a5-b718-4ca50ae8f3c5", "comment": "Malware payload (Mirai)", "value": "b6391baa6d58d96c8a339e98a60371e646d6a558b50cecd8bf42047dc61127a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593233, "uuid": "4c95d221-3e3e-485a-8fc9-d266319e973c", "comment": "Malware payload (Mirai)", "value": "3b9682fa81440590ca942a6bd740ba506a5f9cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593233, "uuid": "45f8a0aa-c093-456d-8036-8c5ab1bad906", "comment": "Malware payload (Mirai)", "value": "7e1b4eaf199e1e17e5f9d4789e33c05aec44f84d299530d4da7ea2394ba8594f3799a4ef22eedf6b1183b72556aaebd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593233, "uuid": "c9096406-f4c1-4373-8f0f-1fa54b0366f3", "value": "T19EB3910A7F600EF7EC9BDC374AAA1B4924DD241A25A87B75BD30D818F24B25F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593233, "uuid": "8ad1551f-3f54-46be-bad8-6ec01cdfa38d", "value": "1536:VTUAnPWQ+tbHc2cAd88LZAJb7zEUX1p70wZsaD2A2j6Z3ktkprhu:1UAnPWQ+tbHc2FhNw1pYdj6jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593233, "uuid": "c394fefc-b23b-4393-b11d-485564275298", "value": 116916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593233, "uuid": "02bbe75f-3cd5-45dd-83aa-162efe6322c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593233, "uuid": "44d4431e-1a2c-416a-9d84-226fbbbee19b", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e70fa3-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784620608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620608, "uuid": "117bb464-9a3f-4e3b-bf94-2b5088f44bd8", "comment": "Malware payload", "value": "de3733d61d6c5400a88d48c6440c01cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620608, "uuid": "4ed48696-e5ce-4b21-ad54-dc5714b6457a", "comment": "Malware payload", "value": "b648989ef96f6b92cab4af8c18777fc87f93b24b904875f95f4a9949b0b04474", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620608, "uuid": "015d4925-6a9d-43c1-bbe1-a9c6596c9fdb", "comment": "Malware payload", "value": "e2dae9df24e9caec272511cd87bd489329c73dd4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620608, "uuid": "9de89af6-e214-4e78-a243-74f4044455c0", "comment": "Malware payload", "value": "d27e0280459538ca2ca8c1a0a2f8b45a3452b8f115f4a24bbd30e58791b71c4b4cdcb52c45d8177acff3f152c308a088", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620608, "uuid": "37e30f11-0f9e-4316-8760-17a4ed2a4966", "value": "T110773315A4692E50E82E603E81DB2F42370CEF0F1157976F5764A3BB7FAB3F98818419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620608, "uuid": "7a779c68-0c9d-40f4-b32b-09aa41a67c34", "value": "786432:lxrKHUl1ZXoVnEh7loj5s//hPTX8c6aZBYlXhIBe:/KiuQ72F4PTXt6aZgke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620608, "uuid": "c74b4cb5-028e-454e-82e9-0158fda1e0d3", "value": 32990116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620608, "uuid": "4cb08a5a-4c7f-4d1b-8712-1f0d7206e38b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620608, "uuid": "cce54380-a35c-462c-b710-5bcc01254085", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7aeea1-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613576, "uuid": "0964d655-d2ba-4038-8573-bae2d9cb102a", "comment": "Malware payload", "value": "16976775a938fa7a5a8941d4ddbdd02d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613576, "uuid": "23af624e-fc82-4d19-9824-ba3dc9d7a6c2", "comment": "Malware payload", "value": "b718e05bc168caa21f1b9ee8ead090b3d86802054fb159a8315b54de8bcfe4d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613576, "uuid": "5352ace0-c91d-4a9c-b194-b151658ed355", "comment": "Malware payload", "value": "7b857f874f6370b619b2d868d7d2cb3d14a8df84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613576, "uuid": "9ac2fd85-a2c0-4d54-91a3-1a9195f267a4", "comment": "Malware payload", "value": "7275356a3767d34e00882b18d6853c8b6d34990538c98e1a6ea73a267a263a12ca701c7c7f6d2d2d0efd741ec23b1034", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613576, "uuid": "5bdcf618-7b2e-4273-a4ec-7faffe691601", "value": "T1F6235B6516857C24AA98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613576, "uuid": "2e615cc7-439e-43d0-9f15-58688a9b2617", "value": "768:r+k9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:r+Jcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613576, "uuid": "060e9d04-d805-4da1-86b9-5eac47a7aab5", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613576, "uuid": "054b2cb1-427d-421d-9b71-38aa6bc8d0fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613576, "uuid": "3009c30c-bfaf-465c-8495-77afe94565c4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25bf309-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784646016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646016, "uuid": "6854d661-c3d5-4acc-ae8e-c5287fe3930e", "comment": "Malware payload (Mirai)", "value": "0d8693638c58645ac6eb7b087c28ca7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646016, "uuid": "23222bc3-4646-4617-983d-907beedcaf49", "comment": "Malware payload (Mirai)", "value": "b754fed0b006adb9323a64a198ba2a968aa43712f506ecce0730d23da5765fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646016, "uuid": "fb5fe9d0-2c81-42d1-b39c-17ab15e20b39", "comment": "Malware payload (Mirai)", "value": "6d206cfa8d3c14d822125351c1a876d2710146df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646016, "uuid": "7bbe6a13-ce30-45b8-88ad-c7651913a301", "comment": "Malware payload (Mirai)", "value": "607b21eb14cb15383db90f7a472dfa02fe0131a21aa2dfca6a85c181878f99aef8970adb90a4b91f705d1ada13fe86b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646016, "uuid": "3f6956bd-af9a-4151-871b-922b32233cea", "value": "T1D4831B81FA8B95F5D50789B080AAF33FDF329B4D4034C5AADF89DE7AD923B816505348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646016, "uuid": "92c77427-5a0d-4e23-925a-88e9e3f45d66", "value": "1536:g/80n9GZty1O8Mba00sE5GJup4OfNsg2CBCL7QFu2WNO:I80n9ytWO8MKpLfNsg3CL8Fu2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646016, "uuid": "05c54252-456b-47a9-b4ce-7f074db32d4a", "value": 88528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646016, "uuid": "92620df0-b9fc-4c7f-9e3c-e3032717df3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646016, "uuid": "f223390b-e634-4cdb-adc9-8cb4f6bc2b5e", "value": "b754fed0b006adb9323a64a198ba2a968aa43712f506ecce0730d23da5765fe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1db002-84bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784609529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784609529, "uuid": "9893e61c-797c-42bf-9238-101d53a6079c", "comment": "Malware payload (Efimer)", "value": "710f3538d79e6676dc776818579dc1f4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784609529, "uuid": "c6ea6db5-f34d-489b-aa16-e3cd4d971dae", "comment": "Malware payload (Efimer)", "value": "b769e4f7c42f7f5ebc5a1604af3c102a10f7fb79597035f700a80575dcf41c24", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784609529, "uuid": "efb696d8-2018-4c8d-91e1-a1f32f72b13c", "comment": "Malware payload (Efimer)", "value": "35def11a499b85defb94a453a92e319394d7ac46", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784609529, "uuid": "621fbc69-d345-4ac6-9a43-0990f09dc21c", "comment": "Malware payload (Efimer)", "value": "c5e0350b91dd1c5b8402ae728d930c1ffc8bdf925c68ea951a809db9f2aaa310ab9eec19bc52a63d0d82f4a7f21b8b56", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784609529, "uuid": "4046e86f-1802-41d6-9880-be988856c784", "value": "T136E6330CA9E526AEEE33453CEEE29459F9A678360772CADF976083616D131D05E3C702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784609529, "uuid": "0a34e8d7-369b-47da-aa5f-efc5a43e4ee4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784609529, "uuid": "8406723a-559a-4202-a428-d75e851f5ad4", "value": "393216:MolaAJfIVLvE+4XMCHWUjXOcuI3/PGTAI:MoAtvEVXMb8XjH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784609529, "uuid": "dcb6ad75-7fe7-44d0-ad42-6e0e83128116", "value": 14276011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784609529, "uuid": "88d7c127-dedf-4d4e-b28b-78d9d0d70cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784609529, "uuid": "f53d5c88-b3e2-4b29-91ec-4ab09a57a079", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3707b89-8553-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784673023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673023, "uuid": "4b95bfea-01d5-4ae9-9875-3012a8cc0f9a", "comment": "Malware payload (Mirai)", "value": "75a7ad802a9be80c2963e0449789ef19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673023, "uuid": "5e751b47-e755-43ba-b5f1-e644014cc859", "comment": "Malware payload (Mirai)", "value": "b7b1d0186b23713f11d0872ace4c43c109120c0c99f0b1f98051c546a1016d13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673023, "uuid": "28c9e5ac-14ee-43a7-8097-631bc39c9487", "comment": "Malware payload (Mirai)", "value": "7fbeb4f71568941e77cdd412b2e2b04a6fa5266a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673023, "uuid": "eb349c29-ec65-4ad4-b723-ecee94f15bb4", "comment": "Malware payload (Mirai)", "value": "1060cbb457b737cb2d74b5ead0d3422eee8f4f280218189248b6e32b57dc49546d168b37e8cdcdfddf65ff6aad70e7b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673023, "uuid": "b02ce4dc-9c24-4811-a4aa-684ddb0ced3f", "value": "T18583091ABD419F05D4D526BAFF1E538933535BBCE3EEB102EE141F25278A95B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673023, "uuid": "dc86e814-7c49-45e7-8161-4ac98890b36a", "value": "1536:xfnZma+3aYubkQ5PynmWXeWhDIzLyPlkNdfupg7uiDll5niimuHkZkPeM:jmaCMkGK9dwyPlkNdfupgNxbmusQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673023, "uuid": "8377c59c-42a7-4773-a8ea-97a8a4d5a1a3", "value": 83896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673023, "uuid": "f64079f6-eb84-44ba-9648-2b536abaf878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673023, "uuid": "c55b47da-b015-4c2f-9006-0c1c0ebd6974", "value": "tTd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc587a45-8525-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784653308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653308, "uuid": "9788e9c4-5d5f-48e2-938c-461000175030", "comment": "Malware payload (RemusStealer)", "value": "768cda7f12b294b87566ad3ff5ef655e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653308, "uuid": "e34c8315-12d0-4c95-b7c5-b2a15cd7146e", "comment": "Malware payload (RemusStealer)", "value": "b81291cafc4bbc09626e88f7b813cb2387a420493277fd9ab2ea129c31a7bebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653308, "uuid": "28dc3b76-ce5c-4dd3-994a-e70ea3e0ae54", "comment": "Malware payload (RemusStealer)", "value": "ecd1e2a3888c5c80b0ab291d6013fbc30a3594d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653308, "uuid": "89b9c995-327d-4592-8552-ac6cbc879137", "comment": "Malware payload (RemusStealer)", "value": "686c9ec9da727443a68fd11a332b0fb3147952bd9352cc051eecd6164c88cd4149c13c5990fc9dfd1b673562a2314e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653308, "uuid": "c0ea809a-6cef-47b4-8a29-57aff93414a2", "value": "T10DB4BE1AF3A359FCC51BC174429B9372F532F8251334AA3E1794DF322E65D610B6EA28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653308, "uuid": "ba79177b-0446-4f29-b279-5942c6ccecc3", "value": "e5ce4a64cf6d536f747a0cf92d460e05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653308, "uuid": "dd575438-e530-4573-b5a5-b175ad7cc467", "value": "12288:3G/fRgsZ5udIL3ottTmqP0pPfMPqwmjNT+FklQ2y:2GSue3otsqPSeqlgv2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784653308, "uuid": "db759e1e-f1a7-41f0-9c3e-80b1962d90d0", "value": 521825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784653308, "uuid": "3f7cc087-c121-4cb0-ba1d-645d92ad88f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653308, "uuid": "81b7622b-2a09-4dc5-8f99-2793a9ae1e55", "value": "PhantomV1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8f4dad-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611917, "uuid": "3eacc393-8b33-4f2c-991a-a229968d7a0c", "comment": "Malware payload (Mirai)", "value": "43613c68a124a4481d4c226ddb4f36e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611917, "uuid": "567b771e-1bd9-464e-bb30-40cad435716f", "comment": "Malware payload (Mirai)", "value": "b833394b614d4635a17a3ae30d43380fbc0b8dcd7a8de601715f8d87e9489c85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611917, "uuid": "255a6d3a-b7d8-4bb3-9cac-27139e190d8a", "comment": "Malware payload (Mirai)", "value": "1313e34358e6eadf44061010d874737a94cbd536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611917, "uuid": "3f717a5c-9b12-4bba-a5a3-e8399ea9974f", "comment": "Malware payload (Mirai)", "value": "0a2dbaaf4da53c3bdbff181a478390d6df199a254ebb4751e4448583586fda57eb039150e2a3f065ddcbfb11b5b127c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611917, "uuid": "bb9068b6-9124-41cd-8f59-6d4d4bc92968", "value": "T1F6C3BE97F68B24A1CC6147F007C76B8D2E6362118E6BE9E76C0E763B097A1DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611917, "uuid": "18f26755-dd58-40c9-bf44-68cd3b30ca64", "value": "1536:H5LQvJrKIEcfzXZ3NB4BuLaLWqxIijGsueEoutC8xZJqKg0//LWQ:H5LQv5gqrDqBuLetRGsZutCpKg0/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611917, "uuid": "a2928e13-bd2b-4699-a490-2538742d1527", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611917, "uuid": "0468047a-1484-47d6-b1b6-fd9a96c69f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611917, "uuid": "eb25ef09-7c39-476e-82f0-9f65497376c0", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaff433b-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613711, "uuid": "95f61618-6930-4088-9a55-1515cb41468e", "comment": "Malware payload (Mirai)", "value": "98422d2615d5dd805160c53c628d3fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613711, "uuid": "cd16def4-1d41-4eae-a717-91880cf5e4c8", "comment": "Malware payload (Mirai)", "value": "b86a145adcb90395127d64256074b4ec26c15a5b22f5a1fd4378763d915eb4f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613711, "uuid": "727e3fd3-5b28-421d-a3bf-8e8282b3fa02", "comment": "Malware payload (Mirai)", "value": "9a2ed291d4f866be3c59309ddfafea5e63a9f620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613711, "uuid": "72ae53f5-1f59-42cf-b4e4-d41b7b0319be", "comment": "Malware payload (Mirai)", "value": "954295d5587ebcd936cabaf7ed691d5e7aecf5f5c3fc7a403fa4ff2d51d5824501728148bf49781663774b520fad08c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613711, "uuid": "31695be5-bc2a-46cb-9077-9343079ad1df", "value": "T18A13F1DED80A2CC2C8BE8ABD54E64AFBDD20B642765E4BC5D704DD883A0DD9AB10D471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613711, "uuid": "61b5309d-e1c9-47e1-a778-24c309f6f929", "value": "768:OfhYYXRdZYA+82XnresSWfwNsPr0cxy9ivLiBlgiIz52gwkLigVqSwtNtUE+leI4:OZYiyAB2ysSWINIr/xii+oiII2rVqSwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613711, "uuid": "ca4cd744-0a3f-43ae-9d53-d34bbd1f4a7b", "value": 44540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613711, "uuid": "1541ea7d-679f-4773-99fc-80114c84b25e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613711, "uuid": "5d830629-a61d-41ee-a5d9-758df77c57f2", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32723686-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784619092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619092, "uuid": "dd99bb15-b25d-41ed-a8c4-ca93ff1ab54d", "comment": "Malware payload", "value": "8e07eff98926d6e45cd715ddf9578566", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "t43wmtq3rv5rs-kimi-page", "colour": "#4B2D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619092, "uuid": "18a73978-bf5c-41c0-bde5-c6eccacb9a4c", "comment": "Malware payload", "value": "b8d3b38d7c48f163cffc8afdc7e18ececf7519113a87d4d3e68f2fcb66791f2c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "t43wmtq3rv5rs-kimi-page", "colour": "#4B2D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619092, "uuid": "040e46f2-07de-41a6-9ef4-7ffa6ac3356d", "comment": "Malware payload", "value": "2e1019415f38d6cf4fb675f0b42026ff5bc6eaa8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "t43wmtq3rv5rs-kimi-page", "colour": "#4B2D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619092, "uuid": "5a8213b8-4825-4e98-acc2-eac5a0943cfa", "comment": "Malware payload", "value": "fc35e4e39a4e31e799fdf3bebc71de15504791ac2ecc3eb97bc08608131bdcfa0ada51950ece0d1937ec11ecdbe31b15", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "t43wmtq3rv5rs-kimi-page", "colour": "#4B2D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619092, "uuid": "94d6e036-4a3c-4cc1-b14f-27b81ab6ced3", "value": "T1E2A32A3561A8103729A3D8C2B1815B4FB154E917EA13D388F9DE45609BCFEE3DB272E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619092, "uuid": "a7d32f49-a9d7-4263-8513-bcd4f7505357", "value": "1536:J7b+iimtrh0gUMyQ+JnGplC+ppGnD1OuLGE07LuTadMw/GC545jSygCjJX4U82XI:Jm+E0vuWKvaUUMVyVwE22A//NNjAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619092, "uuid": "650c7c32-d3b2-4112-a19c-90248cc9ba63", "value": 97880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619092, "uuid": "5b4b2ab8-1d96-41b6-b9de-8c381d1e7bf9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619092, "uuid": "24298ac1-ea04-4d0f-96aa-0bbf67d79f7a", "value": "recovery.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a894bbb5-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784615425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615425, "uuid": "3a1937d4-b486-4ea0-b155-07706c727888", "comment": "Malware payload (PureLogsStealer)", "value": "8f8eefcab7190efc401abbed9d9950f4", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615425, "uuid": "09536f0b-68fc-4f21-a086-615a3a67863a", "comment": "Malware payload (PureLogsStealer)", "value": "b8eca270e07e96f414a4a5ff00c099f1518a9d10ca2f1a4c69800e37b9699fea", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615425, "uuid": "0397d608-c8ae-42e1-a1e9-3ac1f94ce137", "comment": "Malware payload (PureLogsStealer)", "value": "e02ca1f851d0ac8d6ed8b05d1aa0da9849828f1e", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615425, "uuid": "4bad242c-ca1a-4675-91f5-f28c0b7c1aea", "comment": "Malware payload (PureLogsStealer)", "value": "178d8ab75bde7a562a292a5d834d6770d5e0889a534e1716c8d3eb132afd9c5ca677214fa1b5f6e8d75eb63cbbab55ef", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615425, "uuid": "60c1c4ad-290c-4473-8995-afbd0ab25008", "value": "T1A7252349FAFEEB21F1F691384935C50846CECE98A775824F326872045735B3E728E96C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615425, "uuid": "bd0824a4-3b45-4794-8f10-f92c912b31ae", "value": "12288:ZGfwI82f25OdTezN4ee+KahN0QwKF2UElH7k1kyaNsUrS/RQs9ezhg55PZKbs0uB:YfwI/u+eR4eNK1QwKFgEvKhgDZKbs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615425, "uuid": "bcc62287-a3ac-4f5b-8323-1959dd367fb3", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615425, "uuid": "a07e5fad-dbbd-46da-8dda-4acf4b4e4bdc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615425, "uuid": "2099fa4f-a7da-44ec-9cff-8f71adacf77e", "value": "148.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d177cc-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611793, "uuid": "caa12592-d939-4beb-a585-e92831ee5f00", "comment": "Malware payload (Mirai)", "value": "98e000e2cffc2a70fec2e5eecb6b0ed3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611793, "uuid": "9e66721c-12ba-4038-970d-0b5f9be9fd39", "comment": "Malware payload (Mirai)", "value": "b8faa0f22efdd6406077dd9ae5b7b0946c2fa3986f3dfa6a82a1a6a1253e2285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611793, "uuid": "72a95604-e729-494d-bfb6-09852d88027b", "comment": "Malware payload (Mirai)", "value": "e4e2c5782f0da67f4d37490762ed892fcfa17c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611793, "uuid": "9b275739-be20-4a1b-8d09-5c138beab763", "comment": "Malware payload (Mirai)", "value": "e26e4395c3ad96007ff2966e72c20d6f8e37c955e4e6ccdca8ecc46ce1abc421b20c6d4e1233d8d2df6565a1a71a6ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611793, "uuid": "dac24c2c-86c4-4c46-9670-8dbb64f7381e", "value": "T1C913F12CC2E1A25DE5EF3073076E63432664052A652644AEECC46216F897FDFFA147CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611793, "uuid": "8629a6b9-b88e-4d8f-82d6-31a4e8de7ea3", "value": "768:jdW6L35xVZxUQOswaK+n03NU42rRVjKQ8MWCAQdGhtYKDP4MnbcuyD7UHQRjH5:ZzL3JZ6QVE3u429k5MWChtKDQMnouy8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611793, "uuid": "39db1428-91f7-4227-9ba5-4ed482ee2806", "value": 41848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611793, "uuid": "3b1c5d70-066d-42ad-bb26-01d6fc0ecd45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611793, "uuid": "526cd5cd-4f65-4408-998c-6f9a13ee24ee", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3b7d40-84c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611328, "uuid": "864e48b6-fb71-4501-befc-eae84b8f7016", "comment": "Malware payload (Mirai)", "value": "0cd582ec9ddedb01a8f6190ef8a96e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611328, "uuid": "7c0a7186-039e-40cc-9d02-6398d061abcd", "comment": "Malware payload (Mirai)", "value": "b93c89d3fb82eb843fad3ee1168d47e1527c0d07c22a5747f41813021c567a1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611328, "uuid": "af2b8e55-4362-4cd3-963f-44fb541b2496", "comment": "Malware payload (Mirai)", "value": "2ed3eb23955287a6973e2e502762aee017afe92c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611328, "uuid": "6a9b147b-901e-440f-b000-a4b92478550a", "comment": "Malware payload (Mirai)", "value": "cd275a327463e4c0fdb0def3bc82bfd25f7fe5676ac0ff79ef513b5da477fbb6f612f3402a0e5b47efc2a9534fd0c839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611328, "uuid": "ff8ba5c7-d0ca-479a-94fc-9ecb47375800", "value": "T102B36BC4F6C7C0F9E81704718036B33FC73295298025CAAADF6AAE76DE67641D61A31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611328, "uuid": "1fdb9c25-1c46-4ea4-a7c4-c5745ed84f61", "value": "1536:WKIE20iBxGcPpn5F8h0jAO04kKBc4RWs8S0Ss67tXoozIabsp668b:nIoUvByEAd4TqdfSt7tXboo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611328, "uuid": "44cf9551-dd1b-40ed-af74-ab1d4889786e", "value": 117136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611328, "uuid": "281bec05-3c77-452f-97e8-2d13e1b251bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611328, "uuid": "da1507c7-8525-43a1-9b29-8479b32e0dd6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727d7378-8557-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784674605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674605, "uuid": "4cedb54e-1d67-4004-99fa-6b413418c268", "comment": "Malware payload", "value": "81648e86a23a25b472d5aac5278d75b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674605, "uuid": "750a9deb-12aa-4f4f-a54f-81fd812719a3", "comment": "Malware payload", "value": "b98a782207a2826f3e1482fc5c9adabd35018f96a1e01c07b072b979208a5503", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674605, "uuid": "e75be76a-8305-46d7-a995-e23d0e24a7fb", "comment": "Malware payload", "value": "997c72f105550f0fbb93d20ae3eee015cb7875a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674605, "uuid": "ea48178b-65c2-4ba9-9dc8-de93fe8ae4ad", "comment": "Malware payload", "value": "044da79d53b9677c41bfdd0e67d7ebabc04d5d8d495d0bd2423170e6d636abe3b695ceeaab3546d9bb7099efbfe26882", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674605, "uuid": "da12e7a7-873b-44b4-b3ab-4a7f94e90380", "value": "T118235C62F98376B03F5142789F91A9667F5BDC3B4E682B41F0866D1CA1346BCB0B24D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674605, "uuid": "46113a56-a8e9-48dd-ba0c-3c3860cae059", "value": "768:i990HuydzUKO8EorVMuMN0NBF7SsA6cYtNGTiPax+dFVcglW:40HuYUKV9x7aahW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784674605, "uuid": "34844135-b1ce-4002-8172-4ee8ed677f9f", "value": 48474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784674605, "uuid": "56a75c37-198b-41ea-be71-ba5d0962ca8b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674605, "uuid": "0ee0766e-a198-4a63-b78c-26c7eaca5bfa", "value": "y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ed32bd-855c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784676569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676569, "uuid": "bb303611-4f91-4477-9db9-be949c0d6c3c", "comment": "Malware payload", "value": "5bdcbe64da06445fa30757aeaf63ca28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676569, "uuid": "f779b659-9455-4f06-a629-ba5187abecfe", "comment": "Malware payload", "value": "ba05cace3369229c81af123cce385c78295c642918327df7a14a547b158fda84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676569, "uuid": "2e8f511e-5db5-4b6c-86d1-92961a6c2e64", "comment": "Malware payload", "value": "f5845009fcaeac30eef4b922c13816087ecf78d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676569, "uuid": "07ddb81c-fbce-498c-b2cf-6110dc2d9938", "comment": "Malware payload", "value": "f911cb3ec79c9ddf496dff74adf7b159fab37fe3dc83dd2f43a29ae32ed4bf782e17aa01bbebbefcbb6d2c6e9234889a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676569, "uuid": "6cccfba7-67a7-4641-b9a1-2b03f42684cf", "value": "T13D631A7A7D819B26C1C52677FF2D4388331723B8D3EA7113DA195F6537CB82A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676569, "uuid": "da9cd7e3-06aa-497a-8dfb-3bf77faa265f", "value": "1536:hFCfDOxNmi6L61w1LAyKsYc7NPSbAb1SNy/m7hIWhfZcRZFi1URyWixF:KfDO7m/UIUo9Nu+1SE/m9IKxGZFi1URy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784676569, "uuid": "b67830bd-bfa3-4f2f-a48e-1534d6d1a67c", "value": 71464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784676569, "uuid": "767b9ad3-eb19-4066-9c2c-0221d9b1842a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676569, "uuid": "7587892e-395d-4d46-bb4a-aaebf3751cff", "value": "1FSL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44217293-84ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613968, "uuid": "3b2b1791-18ae-4ced-b080-78a6b301ec38", "comment": "Malware payload", "value": "d57bf292cb3af03e082663067a930c0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613968, "uuid": "3277db9c-7205-4f3d-ac31-942823fa22e9", "comment": "Malware payload", "value": "ba9dad2eeffff959dc8cd2ddfdf27378ecb674d939074a5fc57ccebf5bd3b315", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613968, "uuid": "48115d12-1d0a-497f-a2cd-3ee40784df28", "comment": "Malware payload", "value": "b0bdb7ef4940da4d07ed0f39698d6a5a6a9cf020", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613968, "uuid": "a988ed23-8171-4750-bb46-7301691173af", "comment": "Malware payload", "value": "584b4a00508e12d2e0fb23b0a905f5bff94a01ab51c0408627d1cddba4aaf6c4c909dd7efe9c85df1ddbd9184bf8d65a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613968, "uuid": "6eb60cf9-2e5c-4400-8306-421eb163e9a8", "value": "T15BC27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613968, "uuid": "81e5ac4d-3ab0-43ae-8d90-10062dec5f48", "value": "768:F8vCB+25j6es8RJd9FYpMSUpi+20qUpi+20YQX:F8l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613968, "uuid": "c0b362d9-a642-41a4-b020-b03d1ffa4c7a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613968, "uuid": "f5b8a9c5-8a67-49c1-9cd9-8ca427d51136", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613968, "uuid": "0f68b77e-9a1e-4806-a51f-3ac8f5593050", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841863d5-8554-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784673346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673346, "uuid": "f9c3a141-d639-4ef2-b055-d454c579f0e5", "comment": "Malware payload (ConnectWise)", "value": "702503357d409579fe658b1a518d93a2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673346, "uuid": "1113adaa-048a-4c12-9e13-4dbf425499df", "comment": "Malware payload (ConnectWise)", "value": "bbdb4e10ba2e085d83eeb97b10efc6f446cf040cfd10deb0ee48c375f4805953", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673346, "uuid": "b8c08f59-5a7f-44a2-90d7-83522bd3d582", "comment": "Malware payload (ConnectWise)", "value": "3d4a32be0683889cb04ac6b4bcd979da84f34115", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673346, "uuid": "ba9669d9-e9f5-45c3-bcec-83b2963b5c6f", "comment": "Malware payload (ConnectWise)", "value": "bf057505cc5a8932bbbcf4ac1f32f732bb6d72cb6a2a49890ce63d9251d2fa58de94f1299a3df95af0fe4c555a947656", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673346, "uuid": "31f93bc9-bb53-4032-86f8-8c90deb019d7", "value": "T164C61211B3E585B5E0BF0A38D87A86562A34BC049716C6BF57A4BD292D32FC09E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673346, "uuid": "4d19070e-da41-4550-96cf-3d705e4e7b0a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673346, "uuid": "02fb22a2-1539-472c-9a8e-05afcd543abd", "value": "196608:c1EfefPkBKaLNkbgMi4QWKaLNkbgRKaLNkbgBKaLNkbgv:c+WgMiH4Wg1WglWgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673346, "uuid": "e31dc7be-92bb-4589-8033-34b789cc0723", "value": 12580920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673346, "uuid": "1eecfa21-19dc-4bf9-ac0f-0909735a0079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673346, "uuid": "0a3a0e4f-cb82-4d5e-a78f-e51e56191766", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720ae170-8555-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784673745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673745, "uuid": "56b9ab6f-c2ac-47cb-bb09-785038c63f77", "comment": "Malware payload (Mirai)", "value": "45aea77d76cf4f6424b39576de98d6ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673745, "uuid": "fde8a8e9-be00-493a-ae71-ae3271fd6466", "comment": "Malware payload (Mirai)", "value": "bc56faa396b8b6f6487e925a19c3cfa0a1daeaa36e774615db56a7664fa7ad4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673745, "uuid": "2ac39329-f3d6-4ca6-88cb-ea8035bc0683", "comment": "Malware payload (Mirai)", "value": "913c4d9c15123a189e6a7107c59198f2c429cb96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673745, "uuid": "2043fd25-4b2e-4559-a58d-6ac5915ed993", "comment": "Malware payload (Mirai)", "value": "8f816ac763c9b7faa6102c8d37bcbb332be7337cac4b27b1ba9b60f5ab7728acf6228e5d991fd6781f67daa77c75c4d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673745, "uuid": "5e525893-8115-4d51-8d5a-54477544a22a", "value": "T1A983086ABD419F05D4D526BAFF1E9289335357BCE3EE7102DE142B2527CAA1B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673745, "uuid": "d6540bc0-149e-4069-bb8b-22276ccc52ed", "value": "1536:+knXPQEE2PvaYUIlkvkCWd3cbqDdGgbOHB2Nk6z8VTuC5llGviHe1PkZdz:95EwvNgy0ClbOHB2Nk6z8V1AWe1kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673745, "uuid": "c1ad9e51-541f-4612-b73c-ae345e877cba", "value": 83664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673745, "uuid": "db99cd95-bc8b-4df7-b5d6-ff18ac24041b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673745, "uuid": "60be9dd2-882a-44fc-972d-46d8311823f0", "value": "xWr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac58148b-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784615002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615002, "uuid": "766be5af-dd9d-41ac-97c7-4fe290884de7", "comment": "Malware payload", "value": "a29b95ed3ee6ba7c91ea25774fe84014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615002, "uuid": "84666070-4c66-4abb-9a2c-87565debf6cc", "comment": "Malware payload", "value": "bc7b55c9adfd0a3c912295d010304b0cf5e2fb8a2bb40cb529a75a2e23b842b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615002, "uuid": "a3ca0192-c8e9-4e88-af03-5ff25c40452f", "comment": "Malware payload", "value": "2cc50f958ce7eac8b2b3ef3acbff334671cf40e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615002, "uuid": "027ffcb5-0f29-445b-a7a5-aab88b599e97", "comment": "Malware payload", "value": "625b037bb8e3c6aef16cb56afc0f500290fcdaebb9eb4afb6a79833bc103ec86e2fedfecf80d9b324bef421ee177a0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615002, "uuid": "78bec36c-3b99-46d7-a61a-2341b3d1ecb8", "value": "T183354B1BE2B354E8C92BD0748B739772BA30B82945247D2E5EA4EB321F31E505F5E724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615002, "uuid": "47672ee6-97ff-47cb-99af-c85d3e577944", "value": "1809c666d81defee394347c24f878e70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615002, "uuid": "4feeb590-b700-4d03-9818-d10241f497d9", "value": "24576:6syBPRagzRZVxMGF0cBXVKpsq9A5PEQv:FyBPR1FZVxMGF5BXVKm7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615002, "uuid": "5be21193-9e55-469f-9011-26cc7d2674c3", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615002, "uuid": "a4b83e88-9088-4f2e-bc72-2635d5a65696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615002, "uuid": "ea37bd69-70b2-4527-913f-b8f41b7a7e9d", "value": "WinService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2d571d-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611190, "uuid": "845a8f8c-de07-47f7-b014-e3852fee4e17", "comment": "Malware payload (Mirai)", "value": "df95719fc58852c212f0c1dd61a1268f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611190, "uuid": "8068c2c2-0138-4915-b66c-694d74543907", "comment": "Malware payload (Mirai)", "value": "bd05608e53fa3cbf91b34ed97c07ddb95fdcd0c43fda02576e6abd04e2e5c74f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611190, "uuid": "d6e607b9-a5ce-4a9d-88e1-63264319046b", "comment": "Malware payload (Mirai)", "value": "8c1def05fdf6d179cb31dc89d17326c68cfe9329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611190, "uuid": "ef5b98eb-e142-4a87-9726-567c9323a5ac", "comment": "Malware payload (Mirai)", "value": "da675a1b3bd4db231ed6bfe1e7ca6a91d1798ccb02624e50ee8c9d61af7b959755e0484d9b92f9fda7cac6d593b7ca75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611190, "uuid": "5497b1a6-8cad-4cd0-88d2-c9b44f3648b5", "value": "T1EA23F193D37FD064D6A9103978086B475960D70CA72EA7E13FD4B9289BF93712D0A70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611190, "uuid": "437f26cb-edae-4633-9d2a-41e24a4ef179", "value": "1536:6dCin287fmq4WgpuX6RKQlgkLMinouy8jd:6x2efm7RgKoutjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611190, "uuid": "a0ae56f0-f3a7-4c6e-806e-45b1b1601f53", "value": 49764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611190, "uuid": "81701ed3-09ba-4d15-acb7-184b5820c33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611190, "uuid": "66fd6694-e71a-4a87-a528-6032972e2bc6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767c24a1-8554-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784673323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673323, "uuid": "dae6923d-44ad-43ec-ad90-bd2dff8733a2", "comment": "Malware payload", "value": "bcfe67b91d19cafd0b65697a58c4218f", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673323, "uuid": "a0228ffe-d5ed-4350-9e27-1f278794cb41", "comment": "Malware payload", "value": "bd9324f4a2f381a9f17cea58e0bb4a43d56ae55478cea07854440d07cd7e1102", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673323, "uuid": "1a69a54b-3de5-4f69-a9d3-96edc5eb7a20", "comment": "Malware payload", "value": "6147841e8450f185a64d1fdef515293f3e327e7a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673323, "uuid": "3929b38a-67ec-416b-be1b-836e4a0c034e", "comment": "Malware payload", "value": "8d4e5a5abbb3582734e83171f2c882153d00e294937ad3d3d9a4cc6966a51c9a2948b4a4f52201df44c39915b196b182", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673323, "uuid": "747baa84-0fcd-4fe3-936f-3a546cac0274", "value": "T1BB0410E06742C425D4AF9679D477A6A7A833A21F9C18850D2CD2FF5B3D32347841BCAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673323, "uuid": "44fe27a1-acc1-4d6f-b8ff-710e39bb4b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673323, "uuid": "e7e59a76-0798-40e3-bc60-2e2177e8d8f4", "value": "3072:TWDGYPbtpBjsi8h9b2kfjF7iM+lmsolAIrRuw+mqv9j1MWLQb:TWVPbHWL9bF3+lDAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673323, "uuid": "d5f824ce-ac9e-4b7c-aa11-e8f1cf9def52", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673323, "uuid": "d65de00a-fd27-413a-89b1-86ccc00fc683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673323, "uuid": "6e895f5c-6b7f-41ca-9017-78bd06d3d95e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66927d61-8506-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784639796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784639796, "uuid": "4bbe4fa0-9296-464f-9f75-d9754a6cef60", "comment": "Malware payload", "value": "14efedb8e3efcbafcdfd100df06f3d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784639796, "uuid": "9d187a72-41c2-49a7-9cca-b435712786b7", "comment": "Malware payload", "value": "bdca0bb61dc8d0bd9032b80f0b00082841ca395636a2ff9586323a61f76be93e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784639796, "uuid": "61be748c-ddfa-4e7c-aba6-26898d6af804", "comment": "Malware payload", "value": "e180813e8f07d90487b603f45db4874d2c7add49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784639796, "uuid": "1d449db2-9c51-4f80-8ec3-dddb73f963c6", "comment": "Malware payload", "value": "9d7ba721fe8c9f059fc1a59c753f750fbd6a3c70672799c1e7409a164a28834b2fbb87ffb0c89000af7a863a847c4bb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784639796, "uuid": "8a5d285c-b1c9-489c-b9c5-76c237888521", "value": "T11514C5067F519EF7C86FDD7306F58A0124CCF46725643B3A3274DA6CB91A98B09D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784639796, "uuid": "9405cf6e-25d0-40bc-a426-56967e4be31c", "value": "3072:ETbvRwdnPgFqZtONbbM0iQr8q4LddEMdK:E/6PKGONlL8rdmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784639796, "uuid": "5a09471f-bdcc-43d8-b5d6-bfc4139f2efd", "value": 198876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784639796, "uuid": "0d531465-5699-4b78-a583-8f5a9dc162e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784639796, "uuid": "15c41b80-5dae-476c-8826-183134f1d664", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc13a3d-84c2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784610817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610817, "uuid": "53b547fe-4976-49a4-9140-89e8d4f09324", "comment": "Malware payload", "value": "eaff45e154f3222249c7f4354a03f717", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610817, "uuid": "0a15e701-2377-4f4c-a6ee-c0c6b7eb60f1", "comment": "Malware payload", "value": "bdfa7fb1b72cfc5e5221f2d6093b06fd877818eb301157d837504f8902dafc8b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610817, "uuid": "b4d801e2-b198-4a28-8151-ca50ddfc8d2d", "comment": "Malware payload", "value": "16da81d52cf6b699734f2cdec1b7c6a4084aaaae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610817, "uuid": "4c51d070-080b-410d-b004-cb0761a2f704", "comment": "Malware payload", "value": "44b0e0074825b5c4434fd53fce00d49ff390ee60d67c99581a230c7e265c66906ba8a1aff54dcf771ec0ecd284e16534", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610817, "uuid": "8497b324-26f8-44e0-ac4a-d94dca97b164", "value": "T1A13152DBB471A012F687C958B07CDBBD79464B7F11711610900BDE23A1B9598317F72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610817, "uuid": "21ab1311-97d8-4a52-aebc-fd22541b8a65", "value": "48:KmxlRBR7dRPRNLRpRTFUR7REql6Y564ibAW+63E6X1YpmtbMja:vP7jpN9HBkNEqkYo4ibAW53jX1Ypmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784610817, "uuid": "b0bd6d52-e8be-4742-93c6-21771f64a7b2", "value": 1698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784610817, "uuid": "ca77888b-3659-4d2b-9f2d-f4758570abdd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610817, "uuid": "d77c1501-ebbf-4b4c-ab4f-ff72520d9485", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b45a99-84d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784616732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616732, "uuid": "bb29df41-5060-49db-a9cd-b0454e9794e4", "comment": "Malware payload (Efimer)", "value": "6a86c5968f6fbf7c38f47ce423ca891c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616732, "uuid": "3cba38eb-a894-4a48-a831-6fa58bda92f8", "comment": "Malware payload (Efimer)", "value": "bed2ef4a7eda0ae05e5939006205b4e4adbddda5f9572de645f868ab90c19714", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616732, "uuid": "5a39f9d1-1501-42cd-8984-5db4c48e1cb3", "comment": "Malware payload (Efimer)", "value": "b1c66643af8c5cb5c3c6492054a6bf8c029901f0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784616732, "uuid": "2f727516-15e1-4f30-88c8-143342992545", "comment": "Malware payload (Efimer)", "value": "cf6d26c0b54b076d25eacf21bf2dadc5748309665533cbed840b0e30f647a090f52aa4cc4d4ac1b21665f8b57f3fdaa5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616732, "uuid": "4d848105-63c8-4ef1-bcde-34793b96a930", "value": "T188E633149BE110FEF9739538C9F256A6B0B5B4E62732C8CB0AB487B16CA31D18D3D653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616732, "uuid": "e083d6c4-e907-4935-a776-2eb6873bf51b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616732, "uuid": "10c0dbba-e159-4eb3-95b8-4418c64ac4ca", "value": "393216:IgfczO42WRA/FQmqrXMCHWUjXscuI3/PGTAI:IgfgzRA/ymIXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784616732, "uuid": "bb50756c-c24b-4668-8a88-0f52980ac6d6", "value": 14304058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784616732, "uuid": "5fc919de-bf6c-4854-8400-e69631dee514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784616732, "uuid": "f9c744d8-a7f5-4543-a5f9-16aa3b0b797b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42de9e1e-84d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784619979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619979, "uuid": "8f3dc5e5-254d-49a2-829f-430396921ad7", "comment": "Malware payload (RemusStealer)", "value": "2e7caa05bb47fbb30e38d27b680a2103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619979, "uuid": "ee627f94-8930-4f86-b77a-06f2b6e70dca", "comment": "Malware payload (RemusStealer)", "value": "bed430e99076c2de9f750bb5e1acc60206d201c90770af64b63f96e2b1c27be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619979, "uuid": "b3b03625-3a11-40e2-91f7-2a9319b00f36", "comment": "Malware payload (RemusStealer)", "value": "9ba61c17817877a3cb8600564410979cda106839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619979, "uuid": "faed2086-45a8-43c3-81c2-956375aac38a", "comment": "Malware payload (RemusStealer)", "value": "fc68d6747aae54af8c6551e199695271a6ac819d68dea0833fbdbe46a39cd5a471aa029cb630185fd4fe64014df64719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619979, "uuid": "e1bacbca-5877-49f5-a6eb-6e4ba47a3e43", "value": "T1C1C55A17BC9149F9C09AA331C9775296B771BC490B3133D72EA07A782E767D0AD3AB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619979, "uuid": "7f187777-cd8e-4ab4-a47d-9450f2bfd83c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619979, "uuid": "b0033ea1-99cc-4362-acd3-ba9e928033c4", "value": "49152:Fvz+NsEr/7DOWFSdj99jHId9S4M1YC+xu:FvCbO9/fFSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619979, "uuid": "ba20e723-f5f0-4915-8201-616886c2eeb3", "value": 2629480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619979, "uuid": "5676fc3b-d0af-4c01-a6ef-10d034932334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619979, "uuid": "e198a39e-15a4-41f7-b449-d0a4f49b0edf", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975b65a5-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611101, "uuid": "eeadbac4-0815-4a87-9407-6dfed13b33cd", "comment": "Malware payload (Mirai)", "value": "0de203aba4f2c2749271344e1934f3fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611101, "uuid": "a77f4645-9e65-4daa-b8f4-c8ee5474fdae", "comment": "Malware payload (Mirai)", "value": "bf237640d3c51687df288217abc2b25d7d43ea81780323b94a39b000f4bcd3cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611101, "uuid": "c1c9e658-4121-4988-bf58-c17c108ef63e", "comment": "Malware payload (Mirai)", "value": "714ee53eddb979fd0fa7f70d6f254bda792c6483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611101, "uuid": "91b3879c-2cbd-41da-b940-db68a35a88fb", "comment": "Malware payload (Mirai)", "value": "f89e60cd51693dce2461c720601c24527442cf18776436c5c389e176a38a70bed7c9b62ae79b27db49422b38c66b9b8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611101, "uuid": "54e9dab3-3e25-40a7-841f-3b000027237f", "value": "T1B3739E23C8A61998C25C42B8B170FF3A6773D91056536FF6059ACA7AA047EDCF8093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611101, "uuid": "4fcf3abd-f1de-4369-bcc5-4aa979e595a7", "value": "1536:8/D/lVA7lbCyOyo+gKoJ/U74svhQC96I9hIXG:879VU8yOyo+noylvhQNGaXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611101, "uuid": "b87839a3-fb63-4426-891e-830544220a85", "value": 80380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611101, "uuid": "cc276834-1a68-4ba8-8f88-f88452b5cfe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611101, "uuid": "9698f63c-3d9f-4bf2-8fe2-163b50c3586c", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb7d2e8-8556-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784674329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674329, "uuid": "24feccf3-b694-4438-93a1-d7e291a62897", "comment": "Malware payload", "value": "85a032fedb8609b1bdc827115a5f5804", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674329, "uuid": "b3a70740-e1f5-4c5e-b98a-1c2347af59a8", "comment": "Malware payload", "value": "bfca8d582b0e243642dbb6f9cd945fc4f2c60d33e17062e8438c7820ac1372fa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674329, "uuid": "67a5819c-2fdf-4109-bf23-4a2bc8927973", "comment": "Malware payload", "value": "b1019c19f9bf41b61abaa63c56089f76a8ce8884", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784674329, "uuid": "f3d2d42b-f498-4c39-8d6b-10e91704983f", "comment": "Malware payload", "value": "739726f74d501b80e7da86e6fefec750cf5173df1ef5207b0f09ad7ba855832f33e5f7d7fc113567dd837f39aec6555d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674329, "uuid": "8b3512e2-bb06-439a-8bbf-15841e745ed1", "value": "T178E6331D66F002EEFAB3403CB9E25555E22AB8665771C6E7837887615E4B3F4483E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674329, "uuid": "66c05c96-fe7f-4c66-a4fe-a696c951c729", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674329, "uuid": "57e7d96f-eca9-40a6-924d-e6ecb730c7e1", "value": "393216:xSaRocDpGBZh4OHHcDxdaXMCHWUjXIcuI3/PGTAI:xSyoceh2DxUXMb8X9H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784674329, "uuid": "f4bd32b6-f2e6-40d9-8e10-bebdb499d591", "value": 14305430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784674329, "uuid": "886e98a7-061f-42ac-ab2e-a85c55d215ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784674329, "uuid": "1362faeb-beab-4d97-ab3d-db03a5cecf9d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcff89d-852f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784657629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657629, "uuid": "b0854bfd-1a4e-4cac-88d5-dbc59c3504f8", "comment": "Malware payload", "value": "edab72cb6f66886d3a46f811bdbb0223", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657629, "uuid": "3278d87f-c7a7-483d-900e-657bbee19b23", "comment": "Malware payload", "value": "c11dff9d27ab5e6ace1d3124b73e0b0c53698a780bcf276a2dd832018ac81006", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657629, "uuid": "765ddf0a-ee4b-4e14-91fe-0e65a6d56e96", "comment": "Malware payload", "value": "d9db03f1640e11f7b41a54969251cc0215407b8f", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784657629, "uuid": "85429fdd-d5dd-4c02-9c70-0c09723f407d", "comment": "Malware payload", "value": "f07aed3363d4f443cce4931200d2cec23a813893d58c28e7e9fb77fae8457770dbdcb792ddeb8b572800cd44274aa46d", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657629, "uuid": "89689895-36b9-4f68-b847-fb2271f3cb4b", "value": "T153F7338443958714D0CB9FFD217F1EE3EF271EE0A365A0AF06A68535F5984A7C98824F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657629, "uuid": "97695428-38db-41c6-95e5-d1c26be64634", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657629, "uuid": "f99f45d4-4d96-494a-a64c-2a186453539f", "value": "1572864:LLdkvJ2IrFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7n7:L2vJ2CaABZVPArg/bXeB7n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784657629, "uuid": "0acf6b9e-541a-47f1-ba2c-40cb257cc00d", "value": 73788453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784657629, "uuid": "35f79ce8-8435-4f88-895d-d3f701abe8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784657629, "uuid": "2d7a9d4b-3ffb-4d63-bf16-5ae839a74e05", "value": "Arcane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f50ae2-8503-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638367, "uuid": "fbb305f1-4bd9-4605-9064-8d1fcfbd6ee2", "comment": "Malware payload", "value": "339b8e4ebbabf758311df19c20bb8bf9", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638367, "uuid": "3c315e84-0f5f-4517-bd33-0cdc3283140f", "comment": "Malware payload", "value": "c169def52ddb42d1d8db954e2d8c77a8faad74474df430a146e4373871bd93bf", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638367, "uuid": "817c20e3-edce-4035-9ec3-bb9e12b71a30", "comment": "Malware payload", "value": "c52cc84ba9fae071ede70fd476909c066a045a11", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638367, "uuid": "cd97b65f-1b67-4578-8b5a-37c217babe67", "comment": "Malware payload", "value": "2a6d3044ae138fd9953c66bfb1d0bbee67b804c270957f4805fbdb74a5e4088f12e25e480dbd8c336fb0c89b95309158", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638367, "uuid": "440191e9-83e5-4cd6-bf7e-2d0ae5c699d5", "value": "T16732095CEED121B4F22313DD77AB2969162451CB1508C4C0FE8CAEE47F07B9C9267A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638367, "uuid": "ddeefee0-7d75-4f69-92ff-478f6cea73ea", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzw9UfkUL49GgnZU1+tJ6T:sXX+/DV7k/3xkULYba+tJ6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638367, "uuid": "a339c9c4-d13d-409b-b6d0-abd2841bf708", "value": 11860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638367, "uuid": "56f8a4ca-2c3d-4f32-bb59-4e668497e913", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638367, "uuid": "6f295f98-87e2-4bb8-a70b-987a6cec790d", "value": "futurebuilders4c.com.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836cd43a-8524-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784652729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652729, "uuid": "b559310c-2340-4def-87b5-3e3b247345f9", "comment": "Malware payload (Efimer)", "value": "44e296ec00810d1b248ffce5c86cac87", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652729, "uuid": "782fa943-b773-45d1-999b-8f84b5837354", "comment": "Malware payload (Efimer)", "value": "c23e50092e0741fcc9927eaa26c565d7238f0c72d5c960169cd7838b387ead11", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652729, "uuid": "7f11e852-8c92-4d07-9699-f429cb1db993", "comment": "Malware payload (Efimer)", "value": "37f82c0a6e1490e4dc86ab5b630332eebf83dac9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784652729, "uuid": "7a2c3acd-e82c-4095-9b1e-f1c1e3504c83", "comment": "Malware payload (Efimer)", "value": "92eaa3f68983df82293bfcd473e218d9f5066fe2a7c2beb3ace1af5eaf5ff46becb7ed85c849c22b1247cccb0d5f5a9d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652729, "uuid": "7833f6d6-6bcc-4677-9ad8-268f5de798aa", "value": "T1A0E6335896E012FDE5A3013D6C938584E1BC78714B71CA9F47648B9ABD632E08E7C72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652729, "uuid": "ca8be3c8-b65d-4ca2-aab3-e0f6efe056ca", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652729, "uuid": "899cd299-0eee-454a-bd76-77bbdd3838d2", "value": "393216:qUcEgU6jfLqC0eqXMCHWUjX6mcuI3/PGTAI:q3fLB0eqXMb8XMH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784652729, "uuid": "840bc4eb-0b45-44cf-bb14-7d35c89fe499", "value": 14266566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784652729, "uuid": "d6cb8e69-7f18-4294-b519-a255d1a528d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784652729, "uuid": "4de0b854-ae06-483b-90cb-a66235d8aa79", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc935a33-84ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614197, "uuid": "f0638f7b-b24c-47f6-9ad7-e7a70e4e74b0", "comment": "Malware payload (Mirai)", "value": "08492d1efcea454d6e8e4650ce6b39bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614197, "uuid": "8817ff12-b212-422b-a677-8038e925fd08", "comment": "Malware payload (Mirai)", "value": "c26c49402f1bfdf8312b1a32d7875f8817243b389940051adc18b89bf338591b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614197, "uuid": "3f29ff4c-72b9-4f3e-91a8-2bc78eb5b2e3", "comment": "Malware payload (Mirai)", "value": "eabae2dbd6c949ebc51c8d3aa2bbd685e600670a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614197, "uuid": "2c93246c-642c-4e9a-9164-10b931a961fc", "comment": "Malware payload (Mirai)", "value": "07a09b15037476a980997916aa932be5e1c8246bbaadac6ca1eb25bd36d6340468722121bdf699063e71d97b221a0cc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614197, "uuid": "2b0ee30e-e88a-4f21-90d8-c918605307cd", "value": "T1F19317C6F401DC7DF80FDABB4463690EB631E2615A831B266757BE53AC321E05927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614197, "uuid": "d2f09134-70a7-496e-8133-8768945f9274", "value": "1536:lQ1JsIO7ywe3iy5JjPYRggWnSPnK7wjkoLFWSKZRPD8bAjaZkH5S2gk0zjX5R2R/:lsJTYLWnSPnKcwSKZpz2OS9kqSGCJjGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614197, "uuid": "c46f3353-a7d9-4646-bbc4-d44c4a92d998", "value": 96740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614197, "uuid": "4f7bc0f9-3c25-4d4f-a5cf-5559f6d5b6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614197, "uuid": "f4bf0c0f-b0ed-4bde-8b34-805fe93edee3", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced9c25d-84d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784617637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617637, "uuid": "7d944cc1-63df-41ee-adf4-8959da0fbc4e", "comment": "Malware payload (Formbook)", "value": "8bc4e3b8f56ea642a443cd7c42bf90d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617637, "uuid": "b75dfbf1-fc1b-43ef-9efa-776c36b31e10", "comment": "Malware payload (Formbook)", "value": "c32312708ddb3969f7b569018700e54b7a1bebb9b411e07c272ca6391bab1cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617637, "uuid": "129b06ac-50c7-48cf-8970-eb7b8e57a11f", "comment": "Malware payload (Formbook)", "value": "8870516c4f76cfeb95f61b6198bab0fc9d320c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617637, "uuid": "e79a3e54-18c9-4bf4-a9c2-e13c1ec0b7bd", "comment": "Malware payload (Formbook)", "value": "dcfb07596754bb08e822a641e09b325afa1ff49d0a7d1db6cdac3f4adcd9696ae9bece1bc5c3cfb47394840b5242f41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617637, "uuid": "48604422-ac37-45e4-a7e6-c1fea3ec8270", "value": "T193251248A946EA03D55113749BB5E3F813AE1EEEE800D323AFCDBDEFB9319554C60152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617637, "uuid": "a87e1c4d-65f7-4b7c-874e-a89c25da0d49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617637, "uuid": "306a0367-878e-4406-bc36-c48b05cd75a3", "value": "24576:0svuuOQ8y1/tW+heCoKDdrvxgBbLpQFtH:0Gaoeb6d94bLpQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784617637, "uuid": "1e286c0c-27fd-42e2-93ac-2f76b5a810d0", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784617637, "uuid": "c765d410-fb77-49d6-ac4c-17b815de67c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617637, "uuid": "2828e22e-2a0a-42ec-854b-b7f9af1c11af", "value": "REQ Quotation Order Requirment SpecC6bvySVv90VNDEAR9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7527ee21-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784618345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618345, "uuid": "e8197eae-a9e7-488c-b6aa-d4fa0ca5a642", "comment": "Malware payload (Mirai)", "value": "9ea619bd796df0e1252c587cbb313197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618345, "uuid": "55c0d407-1ea0-491c-9599-3485db7bb957", "comment": "Malware payload (Mirai)", "value": "c354ef61b366b2e0989fc57af7e0ab64f7c4858ac54ebf473fc9560d0d9c8f28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618345, "uuid": "63a5489b-6c6f-4645-9b0d-783d8da723b3", "comment": "Malware payload (Mirai)", "value": "8335f3fd9f41581b5b0f6a76acfbfe1118928504", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618345, "uuid": "0a5150f1-86a3-4be7-b088-1020ee17b656", "comment": "Malware payload (Mirai)", "value": "bb9338fc15f45c5f042fd2b86b45bd8f95d4aaf46653887de4ef8e116188862eb3e70700dbec73fe2446cd9044e71118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618345, "uuid": "8b491fe1-eec0-4d3e-9c8e-8eccbf0ee5ec", "value": "T1CDB2E174FF80E9F1D738143A9778C8C6A3D149B8E2EF63252D7043609AA5840367ED9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618345, "uuid": "0acacd8b-2f91-4786-b0e0-b19281d2cea6", "value": "768:3zL4FRxL057kMX0+4QnhqM0okCSdQQeeus3UozMs:3zL57kMX0+XhqCydPxTzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618345, "uuid": "0c335f6d-f570-4448-ae64-061bcf729ad6", "value": 25144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618345, "uuid": "c44ce438-f5ed-479d-a915-126c3e073acf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618345, "uuid": "74fd6098-c9c7-441c-b15a-2148b7994b41", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f04c607-84ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784629341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629341, "uuid": "fee7b090-ac0e-4bce-ab7d-d5b41f0e6e29", "comment": "Malware payload (AsyncRAT)", "value": "24716e14e19d191b25146524d92544af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629341, "uuid": "a292c34a-8de5-4222-8c9e-584437db6b56", "comment": "Malware payload (AsyncRAT)", "value": "c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629341, "uuid": "c406a036-8f34-49f0-bad9-b5a006fd2160", "comment": "Malware payload (AsyncRAT)", "value": "069dcc1f535c674c90a389aaa07ede3e734281e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784629341, "uuid": "9aaf5584-8c88-4307-bcf8-bbab15108738", "comment": "Malware payload (AsyncRAT)", "value": "d5549a46a375e2019cf3cdffa702cac06764830c5321c5bdba25bc1b651bc016612d67ade939d4af159c05d9c5cc8106", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629341, "uuid": "b147400d-0caf-4de7-8f2d-ebe2a9aea5b7", "value": "T1DCA5BE14E3E811A9E463DA34CB51A333D6B178624775E49F0A99C30A1F77E928F7B702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629341, "uuid": "b22121c3-18d0-4d72-9951-8ad14b1a9a76", "value": "307f7e81c25ffd921ae92e385bccaf0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629341, "uuid": "1fc1aed4-2cf6-41f1-86e3-461a81983b5c", "value": "24576:Bgp5BNnvoCzuSiwznsebo1UsFonsbbHf1H2uAzlMfBNN0OzV6DNUOPXX3n5DpnFz:BgpNQCzziwuTAzlM2N+1ycnZlnm5uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784629341, "uuid": "2784eb27-ed0d-457f-8f8c-4018570b6459", "value": 2262016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784629341, "uuid": "c34b1011-9267-48b0-b68e-88b0150213cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784629341, "uuid": "5a999c71-c745-400e-897c-5d77fd080406", "value": "Swift Email Bildirimi 1_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf928bd-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613579, "uuid": "8c1447cf-ca4a-4cee-8521-e2f50e0d8924", "comment": "Malware payload", "value": "d082d0d3cd1e0983c905beb642ce7a2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613579, "uuid": "ff6937ff-961b-403c-aaa9-1dc95752ea19", "comment": "Malware payload", "value": "c5fce7e926ebe9765b7dc39c2e7904d4ad04ad79fb5837af5d053cc9003bb298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613579, "uuid": "0199fc59-f8ca-4cb9-b255-d647e544638f", "comment": "Malware payload", "value": "fb9577df31e6b68dd90f1b87c5bca4cbec0ff54c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613579, "uuid": "622b0c2d-d556-4ce0-a169-97a4c9fa3192", "comment": "Malware payload", "value": "49cb45474e69122a8debf968ababd0f2f96a375dbbaab4b32a45ecb45c58ee14ac7de77559f721efb852f6642f429945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613579, "uuid": "bb7a2270-f862-459d-8a9a-abfe8514cfdb", "value": "T182A3B50E2E619F7CF3A9823487B78B34E65C63D123D1C684D1ACD5002E7475E691FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613579, "uuid": "0e84578e-ea17-4dee-9598-f39056519809", "value": "1536:cZbBcTxZUOVHOZsZtHPkyiNFdHE4IPi4WLcFL0myXDg5bOoeJIbuu+:cZgUOVHOZsZtHJh65cyXQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613579, "uuid": "3da12549-952b-4be9-94e4-afb1cb5cba3b", "value": 101044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613579, "uuid": "c53c770e-0a28-4235-b6af-1f6ef097b39d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613579, "uuid": "2ea0daca-cff3-49e1-895e-f8d7618cc4e9", "value": "oXx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ab2668-84c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611372, "uuid": "46613017-c99e-443d-afc4-de793b056a47", "comment": "Malware payload (Mirai)", "value": "4b71dbcbeff18a5f9a70d2fec5c485be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611372, "uuid": "6b0f8092-5dcd-4eb1-b404-eb6aadedb72d", "comment": "Malware payload (Mirai)", "value": "c67cfe785914cbb29fc5470b49ec27e48d4d0554b06cc2bf78ffa0ffed7eb49b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611372, "uuid": "fbaed851-869a-4418-be21-32556493dfcb", "comment": "Malware payload (Mirai)", "value": "05897f9257c8e72707cc38f8247deb744980fa65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611372, "uuid": "28f0a80c-e105-43e8-a2ff-3076a45df1e6", "comment": "Malware payload (Mirai)", "value": "7a9a0cc8e33b5c83a950a2b08793e630a762c154fe005afda7687f0dda25194ed6a1129a4fa4b62f63d24eb117bf4278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611372, "uuid": "06754736-1d5f-4dbc-b9c1-5851bef3bbe3", "value": "T122F3F946B991CF12D1C211B9FB9E424A37137F78E3DE7202DD24AFA0774A4EA0E7A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611372, "uuid": "c510127e-2437-465d-9d67-db798d0c8b06", "value": "3072:XKxEuuCV5+UKXC8oXMb7CIRahkdO8amXigwRltFlMT:XKEuLV5+Z9oXu7CwaW8mXGRljlMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611372, "uuid": "5d2b16ba-980f-45f8-9165-0db834e0a588", "value": 159604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611372, "uuid": "7abc612e-17de-46de-a67e-1981c2d24c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611372, "uuid": "131224cd-5f8c-413e-92aa-e72ae7729edc", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb42e0fc-84d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784620262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620262, "uuid": "d4d2de3b-4ba8-4871-8f52-50c17cdc1e6f", "comment": "Malware payload (OverlordRAT)", "value": "27addb17de726ba7c3e0938ce1c7063e", "object_relation": "md5", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620262, "uuid": "38e0a03d-f6ac-4a8d-a4fb-544d1ac7abe8", "comment": "Malware payload (OverlordRAT)", "value": "c6856bbd7fdff4f2c068a73fee87f5498f69d5fe4f6caf5370e851811ef70a3a", "object_relation": "sha256", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620262, "uuid": "b70ca490-db5d-4702-b360-14e180238ee4", "comment": "Malware payload (OverlordRAT)", "value": "40617d93a616517d9a798c5871854a4db5c741a0", "object_relation": "sha1", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620262, "uuid": "c9fa20ee-a983-4131-b918-369a0481e034", "comment": "Malware payload (OverlordRAT)", "value": "525e6fe1acd856eed356ca58adc0c927a0b0d2693353c2964d63a33388b6ad4f6a94ed4dc1b29d6a9619aacefd3944d3", "object_relation": "sha3-384", "Tag": [ { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620262, "uuid": "9ce3decf-05de-4ff6-adaa-74c2fa91ff84", "value": "T121D633BF59127D6EFB1CC0D8C34BA442BF492E2C71560FC115DCD619E2B622A7249EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620262, "uuid": "623ecd96-f42d-401e-b08b-d21cd53b1354", "value": "393216:BYWc+5Db/3dU7XSsPHH1yJhISvvvSoQRcCYk:Bxc+5Db/NU7XSsHH1GhISv87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620262, "uuid": "be7e1fe0-9578-4a7e-9de1-94d1be7ec774", "value": 12901749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620262, "uuid": "8f8d9f32-c34f-4719-9724-4bb599b88646", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620262, "uuid": "b5ef34cc-67e1-4597-8093-97062dd66b7c", "value": "FLStudio2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a15473-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784611100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611100, "uuid": "d9ffef8d-6f6f-40bf-add7-c714d1ad2f5b", "comment": "Malware payload (Mirai)", "value": "67f32f92581dd5e89debab616dd4a743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611100, "uuid": "623c5447-deac-497d-b038-1df90fb1262c", "comment": "Malware payload (Mirai)", "value": "c698979288319d7c6fe63d5fef8e1ff4e010c58fcef2a269b477d5f72d1b292e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611100, "uuid": "bedd244c-c9d9-4303-826b-c685b3c85efe", "comment": "Malware payload (Mirai)", "value": "468a56f2d25698cde6d6a8996806ae39b5315d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784611100, "uuid": "3f880c96-ac17-4552-b76a-948a74dfce04", "comment": "Malware payload (Mirai)", "value": "4326f1b641abe593cac582e0b28ae28de88bd344c368b20a5e369c45662d2fdce634ccca071ddb30d5eff0df547a4712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611100, "uuid": "3cd4298c-2cf7-4c13-b0b3-f1d86800cf7c", "value": "T11DC338C6BB43DFB3E85310F001A75B354A32FD3A5836E995E3697EB58A125C0A60637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611100, "uuid": "4b0ca65e-ae6e-4034-a4ec-d286524ffe48", "value": "1536:YMAYkh+2Wp1Vx7cm9i6E27PRaJjWXaJ/x76FNThMh7QC2ERCI/Ir9S:YMAYkh+xbiH27JBKJx76FVhXIQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784611100, "uuid": "70b74330-eadb-4309-9288-5951cea17130", "value": 126968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784611100, "uuid": "7e6750ad-4e18-41c1-a9a5-7bfef4a219e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784611100, "uuid": "c50e42be-efe5-44a2-bc51-b27e903f96b0", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ff08f5-84ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784614074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614074, "uuid": "e790fcc8-a13f-4268-a4b0-6c60ac7d7f27", "comment": "Malware payload (Mirai)", "value": "a5caf456ed604c6dbe9e0697ad3c0198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614074, "uuid": "4982fb09-20b5-459d-9f35-8170232851a4", "comment": "Malware payload (Mirai)", "value": "c69ffce9a429978ff77884c6fdd1cf9deafc2c033c165640501d2545985f734d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614074, "uuid": "2a43dce8-61c9-41f2-8c7d-3a0408d0c816", "comment": "Malware payload (Mirai)", "value": "c2065cfb7d365323813f8661fea9f25eae9779ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614074, "uuid": "9b7f9a15-110d-45a7-b397-7bcc7b383a03", "comment": "Malware payload (Mirai)", "value": "34a9f313115b056a030b0c9a09c675e7cd0141e796293d749f9ce5982d73a325757f515af4b0341142cc6db113c4067d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614074, "uuid": "1c3579d8-0b19-473e-8e0b-5ca9d82d4e1b", "value": "T1F4B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614074, "uuid": "462becdb-130e-4f38-8e82-48fc48d07739", "value": "3072:Wd5b7djS5HECBQ1XezRRhFcDcmFhhcqpUN:Wdh7djS5ECvz4DcmFhuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614074, "uuid": "61fe6097-89a7-4b32-949e-751180f66437", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614074, "uuid": "3a59d5e2-105a-4ed5-b2aa-289bf55a5d11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614074, "uuid": "78162447-2a4c-40f9-b2e1-0867701128ea", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14063d7-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784615010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615010, "uuid": "1bff9393-6126-4139-911b-4e32ba8919a9", "comment": "Malware payload", "value": "d1d04fba3118f1bf7296091926e151af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615010, "uuid": "ba9602dc-1f93-474b-9107-044be96c33d0", "comment": "Malware payload", "value": "c6a65f9c166de99dfa06725fb940610fc4d20a5a3c6f3f7ef6c8c75af058572b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615010, "uuid": "befaabc7-1c5e-434c-84eb-138d3f737610", "comment": "Malware payload", "value": "53046358f4f81fdadb04f13d347500ada1e2b0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615010, "uuid": "bcd8d22f-618c-4c61-8c44-24c495f5c8cf", "comment": "Malware payload", "value": "17f069731be19efffff947526ced93492efabbb93539ca9a8f1f476eeabd54d910df6f2c0fb68e4b496b4026aa93179f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615010, "uuid": "e122430c-b80c-4d97-a0b9-693f94355104", "value": "T1EFC633A4F26409FBF5E7003DC652A43A7777B9220F71C59F03B499A12E637E19936B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615010, "uuid": "2b274a70-7735-44d4-95de-1995a46e8a77", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615010, "uuid": "4a625237-7e48-4641-b4f7-cc9c1279e24c", "value": "196608:5ctokh/f+2W+t2PKMmjdV6kh1DvgKaZca1pgyhMkMgQvK3ehQeH2dCkBtp88cWt9:5cHjW+tHjdl15LyFQvK3eaeKBpVtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615010, "uuid": "fe5a183f-02f5-4cbe-bf74-0047c6f31bba", "value": 12513276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615010, "uuid": "ed190016-42c8-4240-a1b3-e8ba921c316a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615010, "uuid": "f1a54f05-714c-4e54-b625-ba321b940d61", "value": "watchdog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3fc08c-8503-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784638357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638357, "uuid": "7b19250f-94f0-40bc-8bc9-9402bb0ac6b3", "comment": "Malware payload", "value": "e5c44f9c3297ea587b44199ccf44a4b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638357, "uuid": "42bcf4fe-87dc-45ca-96a5-7c7d22d41420", "comment": "Malware payload", "value": "c937bfa131001f827f4727b4b3bdfd42af26399c1e0cdf8d76642bfa9fc995ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638357, "uuid": "694f622a-853f-4b9f-a3b5-64f0619da3e8", "comment": "Malware payload", "value": "3798488d2d52ffda7f8611982dfe56273b66a169", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784638357, "uuid": "5725211f-9b45-4d7e-93bb-1bab408e3b2d", "comment": "Malware payload", "value": "eb7840f71e550206c3532b2899f0af44fd337e215c373dfd589453ff35963272c9d13db18237354c27f57335f6258d57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638357, "uuid": "96905a22-a0bf-4282-aef7-dc28198a2f92", "value": "T1C131049E607C1445878ACE01F0E58DE6732BFEA0D2AA7335DEC93F674189D643021AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638357, "uuid": "ee63ab26-e31c-446c-a8b3-aba3a005bdc7", "value": "24:uMYDfE2o1lDo5+K+BM/haeBe1bleZe2wNvu6fMKqo7+JngKgUDJG3G4IiBH9:yi1ehpo7yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784638357, "uuid": "8107311b-33e4-4b5c-8b67-0267fa79440a", "value": 1757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784638357, "uuid": "9b5c2eda-4bbc-4202-bd31-8ccf5f59848c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784638357, "uuid": "2e5b9163-1b1f-4a53-bad6-b71c6aab5afc", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e116ec-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1784613144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613144, "uuid": "3831ae3b-b93a-4af2-b23f-aa0496e7c37c", "comment": "Malware payload (DiscordTokenStealer)", "value": "0a6305a34dc79d625e78c0b893a32a4a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613144, "uuid": "55257497-f568-4f47-9a06-de15df1c1bc6", "comment": "Malware payload (DiscordTokenStealer)", "value": "c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613144, "uuid": "3c29a794-4313-4150-a968-f4ff27347eb2", "comment": "Malware payload (DiscordTokenStealer)", "value": "b36ae3b57f07bbfce698027a6e14ee5a331f3144", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613144, "uuid": "7f879485-72fd-4067-a79a-53160d477265", "comment": "Malware payload (DiscordTokenStealer)", "value": "6e2623f634af8c271131bcbd64661c9ff6c6fff2e8b76dc1256e2b76c62660aa45ebda5c34f391b806906c1a46a0be80", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613144, "uuid": "b8cabb5e-2f53-4e39-9628-856555467bcb", "value": "T18765CFDDD16E05C68C043FC9AC281AC75B6987728A74001937BFBE485FBB4BEC11ADA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613144, "uuid": "19974850-98e3-4498-a64a-3bceb2073754", "value": "24576:r/pIpyPl78WD0axcS6Lolly+KiGrt0C/I+8IjlRr:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613144, "uuid": "a0f85a98-a8b5-4cf5-a584-c23622044930", "value": 1527773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613144, "uuid": "87a2285b-9b75-4f30-a4a2-e577d3c11e5e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613144, "uuid": "335fb767-c75a-4262-8bea-27cbb8e1008e", "value": "Rechnung.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0270d310-84d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784620300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620300, "uuid": "b7655c61-ee8f-4c44-8440-8ce3b3710f32", "comment": "Malware payload (OverlordRAT)", "value": "861e3af88bf1bcac9caf72bf16fa02b5", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620300, "uuid": "ebdcd708-1a62-4f4c-8fab-f9aea46b0f86", "comment": "Malware payload (OverlordRAT)", "value": "ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620300, "uuid": "8a884616-730d-40a2-a1dd-3b24692842db", "comment": "Malware payload (OverlordRAT)", "value": "d0e4300ef05b840b0f36e198eb634b54a917761d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784620300, "uuid": "aaefa9cb-c1f0-4657-bce3-af8795d3840c", "comment": "Malware payload (OverlordRAT)", "value": "9a4009e2fe4683f8448a4c3222df84d09642de0c2f3e340cea102351b0b9cde0f785a64e4638690a6aa7893a8aa33ded", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "download-windows-update-live", "colour": "#993411", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620300, "uuid": "37ea402d-9d45-4651-8439-8d21f1902357", "value": "T127373328DAFE8E26EDF197710C66C23207B19D8F9250E3085AE8DDC3BD2D5B59645233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620300, "uuid": "176c94fb-4bde-4fd9-adc8-aed1fb13de42", "value": "196608:a7Aj+6Y+1fsKPuMMU7U7gHttex1UDOxlgQt6ZqXJTKQ8ayNH7oXiR6KpE+:d+12jRbteD2Oxl6ZqXNKPayNoQ66E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784620300, "uuid": "c38678a7-4181-4d24-a57b-393479261998", "value": 24100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784620300, "uuid": "f20a6633-e297-418d-a1f4-61ba9b07c5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784620300, "uuid": "ac886f55-b244-4b11-8ff4-9d8f789e2a3f", "value": "FLStudio2025 Crack_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24aab34c-84ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784628518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784628518, "uuid": "109e6b68-7d1e-4cd0-8d89-d860f040e9fb", "comment": "Malware payload (XWorm)", "value": "6dca6e421a358a9f275a682bd4b5b20c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784628518, "uuid": "07bca9e8-dbe2-4d8b-8e7f-af37851dd2b6", "comment": "Malware payload (XWorm)", "value": "cb7561e369f812da9398570e5b4851040deee1ef9fd236394d2cd3a0ce356026", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784628518, "uuid": "3aacd173-41aa-49ac-80de-f75abbf64174", "comment": "Malware payload (XWorm)", "value": "a1790b8f1b05a0b171850ce261cb04ae4543e1d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784628518, "uuid": "1eb3934e-4eea-43d2-bfa0-47bf857ed7db", "comment": "Malware payload (XWorm)", "value": "d8b0b63608fc0460591be4605900b182c0b7bd5922e0d8ba229a2fc347ecca709d249c923afc6839cc705979598e307c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784628518, "uuid": "3e0971f5-d17a-4195-b2a9-c5e16f013b64", "value": "T177A57B478094C8BEF186D076EE71B721A7590CB521DCE79FF836D288634592C26FAD23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784628518, "uuid": "384fc176-7863-4b9e-918f-4879dab80d0e", "value": "192:NKwWSJDwE2g6MEtFJOWS/lYjikhyhFWBW+T8cESpDtjaRDJVNI8X36Xn83kaWC43:NKWp6F+prg6/5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784628518, "uuid": "b9c4c657-7e30-4d27-b681-ee11dcd8d933", "value": 2263888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784628518, "uuid": "fde334e4-cec1-47bb-9205-64055786a72f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784628518, "uuid": "92057efa-c4cf-442f-9e5c-167fd24d800c", "value": "RFQ 6000223205.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fa73e4-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1784613240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613240, "uuid": "deaa2a23-cbd9-4851-ac23-66fdf2fe9114", "comment": "Malware payload (STRRAT)", "value": "3ed7d5a22f675b05f3c467a11b39a931", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613240, "uuid": "66c1f5f2-0aa9-4113-ac76-dfd71f5c6aa5", "comment": "Malware payload (STRRAT)", "value": "cc75bd30c623f080ee5dd003c2802a9c97a008f9fd6f4a1c4113a27b1242d290", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613240, "uuid": "7b514d9c-8ca6-4125-8aa9-5a7f7b9d810b", "comment": "Malware payload (STRRAT)", "value": "3724e7c56529257d9c6cf04b3bb4aae9d39e9421", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613240, "uuid": "e8427212-f651-4e54-801a-ce11d5e09d9a", "comment": "Malware payload (STRRAT)", "value": "2630e2fb75752f2df5eaa11e74ff8ebc311ff771040765c9675897f4a59e406a93b7da4927546bb1ea94c375ef2ae708", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613240, "uuid": "c9fefa53-738d-43d6-a4a6-2db052060a04", "value": "T1CAA30287ABFB1179E54E453AC1A2CFE46D63887AC8B857031B0616DD0C4EDED5220DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613240, "uuid": "0f4f77a5-686c-48f3-8711-4e16b664899b", "value": "3072:7nNSclyDWRe0ipfRLuYZdlHufRXAfuEC7lbpFI:7nNRyS00UR+JXGTC7lbpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613240, "uuid": "2e5d5bce-73c8-4e18-95ab-74526205911f", "value": 106324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613240, "uuid": "505390ad-844b-4ebf-a59c-4bcf992c44f9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613240, "uuid": "e4203e83-efb9-4d44-895c-52e6e2017024", "value": "Scan_doc:ORDER #PO996574620775800000.pdf(104).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b479f83f-84da-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784621029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621029, "uuid": "b855cd57-277e-40a8-8ec0-b5c3b91d1698", "comment": "Malware payload (Mirai)", "value": "563a0bbb8729beb3cbb8c50d803e5934", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621029, "uuid": "e86adb82-542c-444a-acfa-34137a7a7b85", "comment": "Malware payload (Mirai)", "value": "cc9e7f4ea9f653ae8abeb697b2f874f9c632743af058d2513668b317982de4c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621029, "uuid": "0315f005-b9c6-493e-9bd7-480cd07a127b", "comment": "Malware payload (Mirai)", "value": "eaa8a14cf13f88349f90a27664f17669333887a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621029, "uuid": "1d0c20aa-1dfd-46c8-8621-ef7252982beb", "comment": "Malware payload (Mirai)", "value": "78525e43694e8dee4f486799af944a05f28934ff2c006608b292c296f9b4f80f26f457a532213db9f13eef08153c3171", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621029, "uuid": "a8db38a3-e265-49b6-9a29-286c21ea5a88", "value": "T12801C2D9D1604A0040A9D52D32975554F431C3C7154B4F64BFBCB43EDB95E2CF0A6FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621029, "uuid": "a7ddaa23-e677-427e-b401-5906a1fc626b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaK1CdHgjC7FrCq5bFYXCWcfnMChX0BX:kXCKysE2hi0ziQvZoha6LQzGXsfMUmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784621029, "uuid": "57908bc1-d1bc-40b9-9bd4-7974b7961a21", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784621029, "uuid": "1111f22c-82fa-4bbb-90cb-52ef6ed7e74e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621029, "uuid": "40857f7a-b4d0-429c-ac9b-3fe260a04d9c", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c8f19f-855b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784676463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676463, "uuid": "0e770cac-e8d4-4d35-b243-f139e7464f05", "comment": "Malware payload", "value": "b055598062b9cbfbd5f61e76e8769f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676463, "uuid": "7b51e795-078c-4435-94df-ed1952910282", "comment": "Malware payload", "value": "cd52cdfa71d798723e057c1d069edb77f4ed3e54ac7edc6e6a5a924d0567efe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676463, "uuid": "8947038a-e47c-4b82-81bd-a6cfb3d1c336", "comment": "Malware payload", "value": "9b662c185a0e40129716a9376db56bb86ea6a1c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784676463, "uuid": "f54c27a2-09f2-4b87-b5b4-ecc502ed1711", "comment": "Malware payload", "value": "54b8efff1d4a0d9c879467eeddb03728332898e06721a58bb9a8d20c12d1d212a165f79c1fe980e53a1d70cd953bca0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676463, "uuid": "cae78700-f254-49b8-8356-4cae8bec0726", "value": "T10783072AB9419F05D4D526BAFF1E538933536BBCE3EE7102EE141F2527CA91B0F2A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676463, "uuid": "b04cd2d4-8d9b-4a14-a6d7-a484cb8190d2", "value": "1536:gKnKCvaQPuYuOkY5PynmiXeShDIzLDPkENhTa9c2uZjllc2i1XrekZll:sCvaIJkOehdwDPkENhTa9chUdXrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784676463, "uuid": "72c7e9dc-ef16-4d5c-b9c9-bee47005fc69", "value": 84100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784676463, "uuid": "0af200bd-8190-47a5-9548-9406032c6c2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784676463, "uuid": "1c9fc645-c4a2-4bf2-a070-2836e78a5d7b", "value": "4Hep", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b360cdf-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613577, "uuid": "1a84a2bf-5a78-4b93-b3de-e562b5885207", "comment": "Malware payload (Mirai)", "value": "e04c6907248d7a7c1dc1ad88860bf691", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613577, "uuid": "89ca80f6-9f6f-4ebd-b613-f2c04bb94856", "comment": "Malware payload (Mirai)", "value": "cd82561ce031428ee795db124e8a0ec913e8456e30926e64e8aeeeaf2c372483", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613577, "uuid": "46e83ec7-1827-499b-929d-abef61895056", "comment": "Malware payload (Mirai)", "value": "6f8f3c7cc8b5f0583ea5a1097ec704353ccb6851", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613577, "uuid": "dcd0d1e3-7a79-4e0f-a58d-69d26161b859", "comment": "Malware payload (Mirai)", "value": "56bf534ec65fab7adb7fb5cfd8662b537f571297612005bf52e38c7612e355b01e59cb791b91389ff90f625902ff3284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613577, "uuid": "1bb59991-f4a5-4ce2-a17c-4de328072b3d", "value": "T16A63F96AB9418F16C4C5267AFE1D938E331317BCE3DE7213DE142F652B8B56B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613577, "uuid": "608f5d2b-3027-40b9-9b82-ba7cb446f3c0", "value": "1536:cgnRfzPrwj0VQsjlkvkcup3JwDyl1q1vfoZxAoMiw97yr1JYG2:ZTrq0OzMZo+qhfoJW97yr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613577, "uuid": "37eb786d-93ff-4a42-98ec-744324474859", "value": 71080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613577, "uuid": "aa9ec6dd-a885-42b1-b220-83498e41d44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613577, "uuid": "276f87c5-f89f-447c-8434-65d9ed44b77c", "value": "fjBe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dedaee3-84d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784617072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617072, "uuid": "efd2a5f9-4cd1-4205-a59b-04fbdec7814e", "comment": "Malware payload (RemcosRAT)", "value": "8ae5a0fc60e3961e0148527d22f5c8a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617072, "uuid": "1d77d65e-920c-41eb-87a0-8cda15de528c", "comment": "Malware payload (RemcosRAT)", "value": "ce81e2c7d1beb834bda8a59ac5cd23b9b2700a697dad0358f5837df214af995d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617072, "uuid": "f01dc6db-4528-440b-8f08-2fd7972219f2", "comment": "Malware payload (RemcosRAT)", "value": "1e6158622a5de1f4eb438b5980b83a02d28aa898", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617072, "uuid": "7c3f2cb8-db2c-418c-8f0b-0ffdfcf313ff", "comment": "Malware payload (RemcosRAT)", "value": "b41ceb3a55544e4f08fcbc6bb9d7793cda81f753143c33ab92109ded35b90283054b6a9c633a105fbf182cc2a2346f6a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617072, "uuid": "9976f832-b19f-4d2f-9ff5-b4057096ac3d", "value": "T12A87B8261F435AC5DBDD9D084CB9A2D682B950ECE5384DA30ADEF787EF98EC095603C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617072, "uuid": "87780538-5fd4-492d-b13f-609eec04a4d5", "value": "384:aK0Q/TVVhfHJONsyO3pEZ2AyhOknOsP9uqs/OPclmdfaJlHRQsZs6CRsqss1IwOE:aK0EgrWQuuS+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784617072, "uuid": "0fc5f1cc-a8ba-47e4-9836-10e6e4046813", "value": 37182186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784617072, "uuid": "d8e1841d-809e-4607-a5b5-f9059d0c785d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617072, "uuid": "294a02d3-0305-46d7-a398-9a448ab28454", "value": "Siemens -PO- 216238068.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1dc0a5-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615247, "uuid": "f619d2e7-6b99-4a91-b2ea-24c6f766cc7f", "comment": "Malware payload (PhantomStealer)", "value": "6b60638d7c0172f6c4fbfb203b1c45d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615247, "uuid": "2cc39676-d5c8-483a-ba7a-e305b19e9838", "comment": "Malware payload (PhantomStealer)", "value": "ceaa9aa06a16e30f4bb7766e90faa003b19146b3bcdce86f29c3527f648a170d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615247, "uuid": "c77ea57d-19be-4c09-a3f9-f9c808259e02", "comment": "Malware payload (PhantomStealer)", "value": "4dc479790d72f41e048670c85eb3360fe715dd5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615247, "uuid": "928e82d5-5ce1-4483-97cd-1e0a31376d9d", "comment": "Malware payload (PhantomStealer)", "value": "04c8f012cc8315cc50f8a59d04962e9f2302e752bd8184ee7454dcd94c3640fc0bcdeb83431c410e9137adb7cd5f6690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615247, "uuid": "32eec70e-1f02-4bbd-afc1-81a8359e61e2", "value": "T162F49C64B3F50859F1FF9B7495B54421DE32B84B9A38C79F168492AE0D23382EC64B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615247, "uuid": "8312447e-8c12-4bdd-8777-bfbc5a9395dc", "value": "12288:p9CTvqRSA2xQMpiy3O0Ve2k81WU0KkknWK:p9CrqR9Miy3OIe2D1Vkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615247, "uuid": "9bfbeff7-c8cb-4a43-b329-d81271ab66dd", "value": 764625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615247, "uuid": "0c0f8d0b-4f34-466a-a1a4-349f50c4f97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615247, "uuid": "e44dffdd-1afd-419a-9cfd-4ce1ad982c6e", "value": "ceaa9aa06a16e30f4bb7766e90faa003b19146b3bcdce86f29c3527f648a170d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c8e24c-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613375, "uuid": "95874c83-e07d-460b-87d1-14394b81758d", "comment": "Malware payload", "value": "cb7f1236593f6742d7774d9acf9251ed", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613375, "uuid": "5dba901c-207b-4b66-8c95-9e0679e3b8b2", "comment": "Malware payload", "value": "ceb43ec371189824c427e86f57ec5049ecf2d771318cab2953c62577b1a7c58e", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613375, "uuid": "6d4bfd63-b009-4776-91d2-167a5d40b326", "comment": "Malware payload", "value": "ff75d537e45c57a2c33e1096454533e2f5a79ec9", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613375, "uuid": "e7604387-ced0-468d-9d9c-a8523601a5f0", "comment": "Malware payload", "value": "972782bafd4005875ccc05e0b39b4968aa13845e239d73b8804c3769988c536fe9ff175709f88f8043f1e891e8b0f641", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613375, "uuid": "743f1acc-92a1-4939-836b-80fb0c0ddfb9", "value": "T1A8B429FA56179E8FD62A0E61F40C0309ECBCFC9B61D990B9AF484EB74D994484CB4D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613375, "uuid": "4a1a162f-c490-4b59-9d5c-96faa5be7c31", "value": "6144:oseklWbbf1G/jVYhwlvTKYC7YbsW5bqZM7haRUc9srAmHt9E2wwWFKH7iWyExP4O:3aOVQfYC7XJZ+ha59srTHpwBIHxxP4Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613375, "uuid": "3b843b8f-413b-4f69-a888-0e944eb64ca4", "value": 532498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613375, "uuid": "d28ea671-075c-401d-a152-dd33d6bc00e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613375, "uuid": "02a4643c-4137-41a5-a4fd-3b107dc07b80", "value": "ceb43ec371189824c427e86f57ec5049ecf2d771318cab2953c62577b1a7c58e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33366d7c-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1784613510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613510, "uuid": "65da6d6a-66a1-4120-aeff-ceea7d3818f8", "comment": "Malware payload (VIPKeylogger)", "value": "a18633f19697868f264baed6a589763f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613510, "uuid": "f530ac37-f82e-4833-ae38-65175bd7152c", "comment": "Malware payload (VIPKeylogger)", "value": "d08dedec567306066d4dbbd26a11e862dd96c5beb6475d8b0a434e2eb63aa2cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613510, "uuid": "4f839f78-0348-41e3-8697-cc4be967bf09", "comment": "Malware payload (VIPKeylogger)", "value": "7b640ac29093ebbab7b3d7dbeac4539f0e3c43cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613510, "uuid": "94986fa1-6af4-4486-9ef5-a53fcf0b477b", "comment": "Malware payload (VIPKeylogger)", "value": "16bca80d1280ede864a0d660028f2b6b6ca7f30fabc8886a65092d888ff4a29fb3546e094e67214454df103932c0870f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613510, "uuid": "21374488-63c5-43c3-981b-8ec8f132e250", "value": "T126A57BFFBFC906163392210EED413628D37C664E25F7411AF12999AFF3D9C48496BA24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613510, "uuid": "a16f2422-0642-407b-804c-43abcc850cf7", "value": "192:k80LhBt1e1aMb08En+qmb8GbBdDr0s0KdCcm:k8015gKi8CvKGXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613510, "uuid": "1a8feff5-279f-4c24-8211-e0cde2e45136", "value": 2081491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613510, "uuid": "4e8b78a2-e1c2-4e3b-9ed9-8ff1a1596b11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613510, "uuid": "f336d27d-71a2-40a7-84b4-1d304efdbe4e", "value": "20-07-2026 Tarihli Dekont PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bcf7c5-853a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784662338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662338, "uuid": "08d9d864-efa9-4430-bd9f-239fc14f5409", "comment": "Malware payload (Mirai)", "value": "6bedcd2ed905e12cdfd9c78458caf99f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662338, "uuid": "d595d501-3c9b-4b5f-b2e7-439d598b24b6", "comment": "Malware payload (Mirai)", "value": "d09734cfd61eacf4678a92e6b5a5f4360cf0f4405107af08a2c33040ee8e2758", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662338, "uuid": "2c516c74-fdd8-4b36-a884-558d120e609e", "comment": "Malware payload (Mirai)", "value": "bb532e0608beab484c62e8deadfcacebc804cfca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784662338, "uuid": "4bc5b4a1-c682-42c7-a1f9-3956bb4f7abf", "comment": "Malware payload (Mirai)", "value": "f31d65c7dead63d96462488c8ea4f802ca4e6548bc8eddf0a3ef356f2006fe0392a251a13e6d2c8d31f9950062bba283", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662338, "uuid": "3e20306b-36b8-4ab9-9ecb-4a04d74fd726", "value": "T16D3191E71162097C2E91D96B767E842572D6EA866CCB7F0CE9EC7DE8049DE0970006D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662338, "uuid": "9f4493db-ccc4-4b11-92b7-65b0bc22ce85", "value": "24:Iv3pHtFpzJLpANI15Tksp6KlJpnpm/UJp+6HpppfpKZsp8wgt:SXF9JLR5TJQUJRw/OU0bxUSiwgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784662338, "uuid": "6d158157-da9d-4394-bdf0-50555edbed8d", "value": 1541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784662338, "uuid": "419b6aaf-8b54-4a6e-9790-83b8e0695aaf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784662338, "uuid": "73721d63-6475-4226-9cd8-853a0ba93b88", "value": "cams.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5761c263-84a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784596391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596391, "uuid": "9a5c3a36-579f-4253-95a4-83189f1067bb", "comment": "Malware payload", "value": "6d53df1adf583a09e41e673665f819fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596391, "uuid": "e2c3f449-ea19-4f5f-9bcf-c73df6c9f3e8", "comment": "Malware payload", "value": "d321b7d4712744fe03084d7a54f53836279e19b9c35426990057991146e7d9f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596391, "uuid": "51dce723-85c9-4b98-aaa9-82d8f31d6473", "comment": "Malware payload", "value": "c00b727946875b5691a52d2cf55e7e12da1331ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784596391, "uuid": "f1058ab4-4b8f-4c5b-af52-2c42214edcb7", "comment": "Malware payload", "value": "cb767af8a2d9e6712b1bb5b63ba26696c2e86641c0387baf5d2f0687d9af92bc01431c1700e22210627319a353ed9cd6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784596391, "uuid": "97b927bb-be6e-4f1f-af23-60d5b6329e25", "value": "T199018ECA86546D0044AADA5D22EB5158F811C3CF1E5A4FB5BFEC6D3DEB95C04B03AF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784596391, "uuid": "bbe3f11c-3592-41bf-b562-d7fcca24774f", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaDjCGktCD5jCBn8CwFtx8CjX:kXCKysE2hi0ziQvZohaDj2gN1H8oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784596391, "uuid": "2d73a6a9-c699-420a-a9c4-d7bc9c1174e4", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784596391, "uuid": "ff7be7d5-6979-41b3-bdc6-6b0592684464", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784596391, "uuid": "e7a1600d-43d5-4692-8666-2bae47be1bb8", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3020a87c-8519-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784647865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647865, "uuid": "13127d08-0715-49f5-b4de-4431bf0a3459", "comment": "Malware payload", "value": "91e1b049b8ca984a738f81a4a6a5f741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647865, "uuid": "71048845-984b-4251-bd0a-c916dbc69bcf", "comment": "Malware payload", "value": "d3a77efd9b454c113b91535987010bf93df630ef63e51fbe599321e2bc399024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647865, "uuid": "a1f9abaa-ffe5-4ce6-8238-3dec1c7b65aa", "comment": "Malware payload", "value": "24046dcf126262b57647b9dc517d8630b9377322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784647865, "uuid": "83b04392-52c2-493d-8402-c51234e43f26", "comment": "Malware payload", "value": "2dea6307a405101b8286440992b5b40fa155a363d8b67e41c17976be1ccf26b30c53273e241bfab0c01a18b6f9ab82cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647865, "uuid": "6f519d9c-05bc-4ea7-9056-cc42080fbb84", "value": "T14CF512476AC300B1D46ACF30AC36A917E9ADFF8C8418D129278577AC617772E859FBC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647865, "uuid": "879d60db-53f6-46f1-ba53-16867f649234", "value": "1f3f8c789c301c932b0a390350ccbaa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647865, "uuid": "4e7c04a2-85aa-426f-9aad-f74b094cc2a8", "value": "49152:ExWumOENO+A/iV+eSAbfJdgwocjythgW02RDXMWtyEal/BrP37mRM3Sb9cje6VWV:OG3VlSm4woAytR0sD7tbcBrP6ME9UZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784647865, "uuid": "1fc11bf8-9a17-4661-aea5-adde2bd4f161", "value": 3621376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784647865, "uuid": "933353c2-6d37-4c02-a969-0c5f71864908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784647865, "uuid": "4c6520a6-2c20-403d-ac7b-d4a928a2b61b", "value": "AttackClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d379dd-853e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784664036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664036, "uuid": "e2fc0327-c6ca-42a5-afa2-d48f76f7b168", "comment": "Malware payload", "value": "be71d936a939e65ab5135e8b4c7ce73c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664036, "uuid": "3ac63d73-8b3d-4384-a60d-07981a0b2c44", "comment": "Malware payload", "value": "d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664036, "uuid": "ccbf40cf-b533-42ce-b034-440288bdd83c", "comment": "Malware payload", "value": "366f8c2aa78438df22bccb66e4c6971f988f7063", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664036, "uuid": "998cd66d-33b9-4c51-9fb2-70f913ee0a36", "comment": "Malware payload", "value": "f2c3127cb75830b6a20cf1bf091cfa813e8c0ca401c0863f871453eb32a18213c6fb91acea410b38cfc7f5a704d80c33", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664036, "uuid": "6c63de92-ea0f-4f0b-8f79-e2b2269284b8", "value": "T1F3011EC695006D406029C95E72DB2290B852C3CF1A8A0F787FDC2E2DFBACD04B026F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664036, "uuid": "a780ad59-b672-4b41-b2bc-4df228722af4", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka/CzSdUjAFCCLnC5NXCFG9MLCQKTuauD:kXCKysE2hi0ziQvZoha/wx0duXYtKTu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784664036, "uuid": "39f43385-5376-4d55-8e32-64dd63d00296", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784664036, "uuid": "efe0d291-8adb-4515-b44c-f6a0f2083898", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664036, "uuid": "5930191f-828c-4ba2-b491-a1b1789dcf0b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e8cd3c-84c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784612032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612032, "uuid": "b04b69ef-6383-4acc-85a5-aa425dc1eb00", "comment": "Malware payload", "value": "1f908a6cdc67d92f5d200ed367dcf786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612032, "uuid": "847bf1fc-447b-48b0-b5e7-d6c6635f916a", "comment": "Malware payload", "value": "d6450f1bf394bd2982f3639155e2f8a0af04afd4eacb049793a10a5a7c046a9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612032, "uuid": "34e721e7-1ceb-4a6d-b3a1-8fa8257d64fe", "comment": "Malware payload", "value": "684f3f0271dc10ce881702cfb162e562d562e3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612032, "uuid": "1ced7cbe-dead-45a0-abc6-ded1dcfe39d7", "comment": "Malware payload", "value": "e567ea9742c6c8fec043b6aab64f50fc22eb647b74c7ca0777f15eff0e290e6a9cea8a4345dc2e16a58d5024671f5ae7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612032, "uuid": "d0b942fb-5d32-42b0-891b-a0c61b0db553", "value": "T11683F82ABD419F15D4D526BAFF1E538933531BBCE3EE7112DA142B2527CA91B0F3A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612032, "uuid": "86a81e5d-2f04-4d76-8d64-0d3b45fe6315", "value": "1536:eGnMFQNEKuCcUIlkvkCNd3ccqDdGg86HcHNCEAX6YuCdyllSwieFg50uDc:oeE35gLDCl86HcHNCEAX6IdtQFgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612032, "uuid": "bface81b-972f-4348-9ccf-3f5dedc25082", "value": 82424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612032, "uuid": "2cdb616a-7068-4ff0-a44d-3bbf2b6da19d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612032, "uuid": "2c887b5a-4829-4846-ad65-ed9b8a42e0c8", "value": "U9Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85a3c45-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613385, "uuid": "a1f4f9b2-ab08-474f-ac66-dfb1b41dddf9", "comment": "Malware payload", "value": "66a73e691ff1532d57b6453ea0e1ee65", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613385, "uuid": "4baa3a62-c7db-4078-8c39-fc5fb20066e5", "comment": "Malware payload", "value": "d68b7e0a4df345c14d35eeb62902f5c1911c6094d2c8315127d1dfec3126c2ea", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613385, "uuid": "aa64be6a-79c9-4996-af52-0e4d5b41a895", "comment": "Malware payload", "value": "20fcd8d40bdbdb8f075ae68413854cf7126b2582", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613385, "uuid": "c7a03099-621a-4e6e-9703-ddf58ffbb0df", "comment": "Malware payload", "value": "796dd67974037c9c790c2ce84e42ad7804de9a3f5ebee006e2af5eee270b307e9c855b0cc3025448fd2016758fe18358", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613385, "uuid": "564c7fe0-5a8c-4e1a-a6ff-dd10bfee8c3e", "value": "T12BB429FA56179E8FD62A0E61F40C0309ECBCFC9B61D990B9AF484EB74D594884CB4D6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613385, "uuid": "804a9f8e-1309-4e8e-b0b8-2837d79e5e42", "value": "6144:osbklcbbf1G/jVYBwlu90/vC7Z5vXv3haRUc9srAmHt9E2wwWFKH7iWuExP43Rz:3VOVwIvC7j/v3ha59srTHpwBIHBxP4Bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613385, "uuid": "f7e9a223-4f8c-4040-acc4-0c1f983e13d3", "value": 532498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613385, "uuid": "be0d29c2-f39b-4068-89a5-37201ecf5a9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613385, "uuid": "d66b8ea7-0da1-4c9d-add8-e73dbf45c1dd", "value": "d68b7e0a4df345c14d35eeb62902f5c1911c6094d2c8315127d1dfec3126c2ea.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc28c66-8540-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784664876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664876, "uuid": "126ac1d7-ec44-429d-947c-13dfaa131302", "comment": "Malware payload (Mirai)", "value": "4043bba93d74924557d6c4ef50d32b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664876, "uuid": "2cc558ca-de70-49ed-b9c7-098b5d2f5652", "comment": "Malware payload (Mirai)", "value": "d71578b74b7d7d6513292e2d4cae8e8518f49e321fbed3d2812a6712da7dc241", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664876, "uuid": "28eb2e97-4dd5-425c-93d1-1002753283eb", "comment": "Malware payload (Mirai)", "value": "dbb64950729bacaf399d6bb4a4bbb859d2530214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784664876, "uuid": "8d176039-41c6-47ce-be46-d286dbd49ecd", "comment": "Malware payload (Mirai)", "value": "5c1c9620e1558a5a5c01751b303e8cc3e9a28fe6c8e49e6d4fbacb31f76bc0fdec299c85bbb7e14c8c4713ad869c4316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664876, "uuid": "a1481725-8416-4441-a651-a3c702660f35", "value": "T16683072AB9419F05D4D526BAFF1E934933536BBCE3EE7103DE142B6527CA91B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664876, "uuid": "e9f339ef-af7d-4635-960e-32d0f9f5e184", "value": "1536:5DnLNCSXuYuBkc5PynmsXeohDIzLOPv7NfhM7JBuxZllDMiQl8rvOv4z:lNCC2kS4bdwOPv7NfhM7JMZil8ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784664876, "uuid": "384a9dbb-7f7f-45b3-8289-f02b04d006b3", "value": 82520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784664876, "uuid": "3047383b-b715-47eb-be32-1bf2fd101c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784664876, "uuid": "3212d0a3-2294-4fee-9e97-a5f9520d3fd8", "value": "hytC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44aa4d0a-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784615258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615258, "uuid": "4768039d-b140-45d4-8f2f-02a37fffbbf1", "comment": "Malware payload (PhantomStealer)", "value": "b83f2d640ed55b66de5e77f5246fbf17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615258, "uuid": "8ce10dd8-17dc-4a5e-9a33-aa3caab66d82", "comment": "Malware payload (PhantomStealer)", "value": "d8ce33438a1a72f151854f7a97cd4fbfb8ddddb0ac6b2d9db5b2615d607f971c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615258, "uuid": "0d267d73-ebf9-4ac1-85e8-d34a80871cc9", "comment": "Malware payload (PhantomStealer)", "value": "916329cd4a462c390843c0541f47f2c89587d951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615258, "uuid": "9a400f6e-20be-42ad-ad4a-805160be267e", "comment": "Malware payload (PhantomStealer)", "value": "f451b2221528261619b323db2e2375725c7ac2c87d8b7987243014dfb146a8f4990e9018a7ebf302b3e247b3a67f2582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615258, "uuid": "57f6bc8e-aaf1-4643-b65a-f1ecefc62a5c", "value": "T123F49C64B3F50859F1FF9B7494B54421DE32B84B9A38C79F168492AE0D23782EC64B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615258, "uuid": "94a100a8-44e3-43f9-94c2-45940737e61f", "value": "12288:/9C7vqRSA6w2MpCy3O0Ve2k81WU0KkknWK:/9CjqRYMCy3OIe2D1Vkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615258, "uuid": "e2ed16c9-7e3d-4033-a80e-d37f7bf0f180", "value": 764625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615258, "uuid": "8ffc8bd7-5c55-4f06-a804-4b847ceb8f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615258, "uuid": "c09ea4f8-e6c5-4cbe-b73f-b029d867d85c", "value": "d8ce33438a1a72f151854f7a97cd4fbfb8ddddb0ac6b2d9db5b2615d607f971c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7e6758-8554-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784673469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673469, "uuid": "3f61dd2c-c78e-43e1-81d2-a313e32274c1", "comment": "Malware payload", "value": "efb65064775fba878366ee1cc9749c67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673469, "uuid": "5675add8-7088-4730-9141-4d37da071441", "comment": "Malware payload", "value": "d8ee53ef0d9134184542e57c74109a45047a6de148226e73b8f6579a1f09a2e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673469, "uuid": "600cf621-d5ed-46b2-bb3a-8c37ccdeb6d5", "comment": "Malware payload", "value": "046b89b190420bae3a3a323c5d5507b078220b7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784673469, "uuid": "7a3d4c36-2b99-4a07-90a7-23939cf58170", "comment": "Malware payload", "value": "ff7f016e63c588cfaa766985e696a57e4aeb324c27d73cade0d0c5cd2ff271f97bf3fbe1e99d47eec06e44d87afd8f6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673469, "uuid": "e343d874-d8dd-4e66-a470-101d7f35962b", "value": "T1C6E6AE01F3F842A9E5BFC278C5625517EBB278491720EBDF055489A92F33BD09E39362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673469, "uuid": "1b9a3471-f288-47a6-9b67-cc8d1223a73f", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673469, "uuid": "684d9594-777a-4860-82f1-a38acbc44cba", "value": "196608:7dvIyQs3CY9eO8OwcPFGUec4Ifzl7vlf4mAswlYQP:7drz7whr9ILxvlfz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784673469, "uuid": "8e6d39c0-c3a9-4c52-b247-0fa5db0fba2b", "value": 14880563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784673469, "uuid": "c1d5bac7-4627-41a4-9b38-aaacf0850ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784673469, "uuid": "da85a80c-6c64-43e3-bc69-cc66d8dc3f8c", "value": "svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d342d0-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613538, "uuid": "af5b58c5-f422-48c4-ac5c-0efb50bac4d0", "comment": "Malware payload (Mirai)", "value": "f5f12f2851f94f957390d45c7f6dbf6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613538, "uuid": "b16c63cf-3c09-4100-9194-0b38ba75833a", "comment": "Malware payload (Mirai)", "value": "d921ea0ed8d47dd3484f2a3cdd720889be5bcffdf0bedbe35dbe02dca081c591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613538, "uuid": "2a7955d1-bcd6-439f-8347-4d26794125bc", "comment": "Malware payload (Mirai)", "value": "b4fe89dd03e59d6e62e292d325842fe83e6fff11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613538, "uuid": "2bf19f25-5fec-41de-a996-7535ae809436", "comment": "Malware payload (Mirai)", "value": "5740586b0aa127fe769a4e9cec54be13f16a2bdcae8d2b25c6a648840ffa7e1a297b7f2f4bbf307d36872099429e0d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613538, "uuid": "f0f5be86-76f8-47ad-aa25-dd5b2587cbc7", "value": "T15F933B45FD819612C6D113BBFB2E328E372663A4D2DA3203DE256F22338659B0D7B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613538, "uuid": "77d0c19e-57cf-4c24-85fb-30e969d7016a", "value": "1536:m/t28jGKZPApdaOmghb87P+L0T5OWXffdyDKmvZq:ml28HZIT+77PK0TVP0Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613538, "uuid": "af4ffef5-4bee-4d22-80c7-77e6b227c058", "value": 92252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613538, "uuid": "4c178a26-4da5-4f20-af52-adf2f244b98e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613538, "uuid": "b3c2084b-5375-4efc-bc06-09b7e023a689", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620a5fc8-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784619172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619172, "uuid": "4c4753cc-5d57-421c-87f3-ed4ea7e15531", "comment": "Malware payload (Mirai)", "value": "72c5c0b294b5e4a278db4e5d76f1b4b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619172, "uuid": "ebe57a56-9db3-4254-ade8-a20a38ac2acf", "comment": "Malware payload (Mirai)", "value": "da081ec0df0626d6548a0f252fa9142e7450aadaca760299ef6e5716fd5d385b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619172, "uuid": "1255b4b2-b321-438b-b396-f3f9fbf3f077", "comment": "Malware payload (Mirai)", "value": "71f19bf3f72d04281839498857ae1bcf276ca546", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619172, "uuid": "de1002ce-2997-4423-925a-163570fc9536", "comment": "Malware payload (Mirai)", "value": "a099edf77e06fa7a1e8635088220505174885e02d5cbfe2e883ec956e85340c3098d3bca78a2efef7925bd8bccbb210b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619172, "uuid": "09b494e1-65a8-4427-af2a-31131c799b6d", "value": "T1FD043B5F7710CF61D729D9300AB3CB5656E926622AD28889F35CDE083E74349A82FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619172, "uuid": "13c3ecb0-ca92-4c2b-85cd-0e6aca2fcd40", "value": "3072:sNEbPJ+w/WsnjTp6t3QQCehHKRFuceI1DijG:sSfnjl6FBqL1e+MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619172, "uuid": "50acd90b-9b14-4731-8c03-de1734e78617", "value": 185004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619172, "uuid": "d7234557-c5bf-4ff1-a892-40cf2747c875", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619172, "uuid": "67146431-14e3-4ddc-b070-c79cdf0dbf3b", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01132aeb-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593240, "uuid": "c49d1af7-3f94-41da-92a6-bfdf36d235ea", "comment": "Malware payload (Mirai)", "value": "ffd36f2d0c0528990a3dcf2f8a94c5c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593240, "uuid": "46944c31-c9d3-4d93-b33a-bc96902f6d10", "comment": "Malware payload (Mirai)", "value": "daa5fdf5ba5227719e4435960cb10a339634c8406c71b09ce9eb7f5bc53cfe3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593240, "uuid": "72216971-f00d-4d08-bd03-0f8235e53353", "comment": "Malware payload (Mirai)", "value": "ca7f86d9baf89dc1b8af950acacc783c3c1534c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593240, "uuid": "276362ec-38f1-4c86-ac03-7887e275cb1f", "comment": "Malware payload (Mirai)", "value": "86452d2d5da04e3088bd50ecb66ba3708a60903d369883acd1922b3fdf9e016d467d5297218e4d3045ffab7cb0383c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593240, "uuid": "ac8affa0-fe03-4fb3-b5a3-8833aa6c172a", "value": "T127833B9AB4019E6CF98BDAF940224E0DF92163415B530F27A76BFDE33D620A5DE07C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593240, "uuid": "20802ae9-ccc5-42d8-8a34-59cba9068af3", "value": "1536:Qg8Bj6jeSzhScH6cfOBaXgkWkTO+FGOtWnkMtnzbBJ8RsV:iIScacfGwgeTvFYdnzdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593240, "uuid": "c4f0947b-135f-43ae-aabd-3947985db0b6", "value": 83860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593240, "uuid": "e9dd547e-c38e-4b4f-91e3-ba536efc4316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593240, "uuid": "a9102da2-3ef2-48e8-bd8b-44d5ed2a348c", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cc661a-84aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784600355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600355, "uuid": "c785b85e-4015-412c-9946-bd0f1917a1ca", "comment": "Malware payload", "value": "7957bf772a86d49fde270c135de93bf4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600355, "uuid": "d02f9cf1-8cde-4cd9-a74a-5a8b2e1f6d78", "comment": "Malware payload", "value": "db99e7a9d7ba73fbdcf2e0c9d6a7efb496beb29f87d00ddccff1825c641d1bf4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600355, "uuid": "a8536ba8-3683-4bee-9775-46f5ad632296", "comment": "Malware payload", "value": "466c9fadc4bdaff7422b479fdb77eace85a8e88e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600355, "uuid": "6d021b09-b4fd-4b95-aabf-14a0eb0a68bb", "comment": "Malware payload", "value": "4206ac85024045568013e686dd75c163e32485b72b9cad48b63242fbf38bbd5e33a64e2ee635914a86eca94fbcd58a1f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600355, "uuid": "1e8a034a-6252-46a7-a27c-3a855e6ef3fb", "value": "T18C236C651A857C149E99C4371D7E2F0CB9AD43E6320852DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600355, "uuid": "942ec5ba-6ba2-4ebb-ae07-d86bad38608e", "value": "768:CVEJVIhtMV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:YEJ2MGcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784600355, "uuid": "1de0aad7-e4a1-439e-bc58-720c54525ed7", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784600355, "uuid": "1d7a8ff1-3794-45ca-a101-8c9a2b8b5aab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600355, "uuid": "9ddb2ef6-0081-4972-a66c-615e01c4abc9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d572a57-84d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784617097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617097, "uuid": "7fda3ade-d989-478d-8807-5d9d009e32a2", "comment": "Malware payload (PureLogsStealer)", "value": "8101494f7c085a3185df3f7dfc8ba430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617097, "uuid": "ba41d198-e3cb-464b-92ef-1c56139ed0e8", "comment": "Malware payload (PureLogsStealer)", "value": "dc6c175fa649da5a41c2ec2f8c76156e53a2eb39b3df9f9d79952c417d76a65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617097, "uuid": "114af7bf-88e5-41ce-b52e-f8f4df2f1a1d", "comment": "Malware payload (PureLogsStealer)", "value": "70c58d38e0fa9fe5ccb7c3ce5f400bad65c24219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784617097, "uuid": "98d4b1e8-d1e7-4ce1-98cb-26a49ba7bfa4", "comment": "Malware payload (PureLogsStealer)", "value": "67fda520047b116537a6adc6eb9ed72d334d82e7c1475b82742127eacbcc552be1a7e00c7f7319e2c8c44876a52c2323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617097, "uuid": "8a4e72ce-3a91-4aad-bdd0-5c17f38d1a70", "value": "T1B105AF3A32924E21C14A1373D1C6491197EA864776EBFB0B328513F61E4B3EEDE47297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617097, "uuid": "339840cb-04b2-4fe2-8cf4-1a7d23dd0e6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617097, "uuid": "1f2486c9-0df2-4c19-9c9b-49e7af2c8645", "value": "12288:k45GKkpAJy5+egTL+cqGngR+0yRAYAQece/SOwOcsT0JNjVJc7:xeFyhgRHyX9e1ascsANjVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784617097, "uuid": "be97bee1-0840-4de9-a3bc-4757678de4d8", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784617097, "uuid": "77682cc3-d288-4e7a-9d74-c64d08bb2e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784617097, "uuid": "d29364de-6c0b-4a1b-9815-47d52567d35e", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.34538.23454.27002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33221248-84aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784600196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600196, "uuid": "aca72116-2bac-4c19-9ed4-f2e8db2bc5c7", "comment": "Malware payload (ValleyRAT)", "value": "41149b65e88f1807a83269dc1535f6ed", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600196, "uuid": "81619311-a544-441b-b90f-5152795912fd", "comment": "Malware payload (ValleyRAT)", "value": "dc745c186d00780cc85dd82adf4186441935ebc6547e375d778eaffb5dbe9305", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600196, "uuid": "a99c6f16-d210-4d52-b522-dff980d04836", "comment": "Malware payload (ValleyRAT)", "value": "fa6bcae7978bc960c587fb2682fa5ad156962e0a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784600196, "uuid": "913068e6-2ca2-46d3-a5ba-97eec9bacb9c", "comment": "Malware payload (ValleyRAT)", "value": "82ec93a16c389be3889ae8564f0bdcfeef054c9d4062207c5fbca6cbcb308fdcbebf525e7e48c97ca95043842f8e6090", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600196, "uuid": "c575dbf3-1f81-48d0-ac23-b75c28fd93b5", "value": "T18F8633E4BC8A2331C1ABD3B19646357DB02C7FE1BFA78C437AE03B281E726169075655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600196, "uuid": "364c6afd-a950-42f3-8690-76ccba20de93", "value": "196608:EK+X5nrYVBbqyTSA2EgREpbF1l3MkXloeNuH2iPupiRrey:0pnrYTqyuA28nDloeYWm+3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784600196, "uuid": "8af7d7c2-109e-4fce-b097-bed65cac6dce", "value": 8069120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784600196, "uuid": "ac881328-8489-4ab8-a051-e86b907c5e01", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784600196, "uuid": "40980ddf-94a3-4282-80b8-d708d0baf3f0", "value": "softinst.873360017.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82c6ab8-84cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784615505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615505, "uuid": "419683d6-2573-4dcc-b5e3-fc668a445d6b", "comment": "Malware payload (Mirai)", "value": "1aaf58fe338eac8e82c9ab51e761c900", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615505, "uuid": "5d38feb5-be28-442f-82e2-06a5db737423", "comment": "Malware payload (Mirai)", "value": "ddce145c358df4f6edf58ffebec7d43fbfff35e0d6495998a30a9d9f1ea31cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615505, "uuid": "dc39e709-a94c-478b-823c-8cb68ddeeb4f", "comment": "Malware payload (Mirai)", "value": "f37207a612561224eb9071b18c1a992e95c1cb82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615505, "uuid": "6e1c5ca2-6f2b-46c9-aa90-cff97bc8bcef", "comment": "Malware payload (Mirai)", "value": "3d87f3e6f6f818ca0b416c8b39e029ff6a78e038c2c0a5cb95d5932b2d835ccd0562fc4416932b77747e9d01fa013de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615505, "uuid": "87072434-9732-4809-9954-181f19152262", "value": "T13313F1A07B1CF871CA701AB7CCE649C31F9B8BB960FE1062128465A4E7C775254F8A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615505, "uuid": "37bf7fe6-7c85-4011-8a6e-bd0617e43b58", "value": "768:c/dVBulVIg/fHOBuYmzriKI0F4uVC/l8Mx309zdtipoesFhKU+fMFIdvVW29q3UB:c1mlVIgHgoriK3F4u6bOz6sFhKUCMmAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615505, "uuid": "7639da52-c81c-4771-b5a8-ccd1e2da2241", "value": 44764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615505, "uuid": "21002265-b5e8-4f44-b7ab-cc558a3aae68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615505, "uuid": "2f1c7260-b7b9-4b30-ad92-e3421142e24e", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3a20e3-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593121, "uuid": "c6af8389-a1ec-4d78-b722-d22791ce4de5", "comment": "Malware payload (Mirai)", "value": "3e97ffdb502d141d6852b4789d175ff9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593121, "uuid": "02cecb31-4c82-4dc9-a7f4-1f50fe1e4233", "comment": "Malware payload (Mirai)", "value": "df8048b1c8753f67cb7eaf49032434fcda89b3a5fb581ba1b002efe9a66098b5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593121, "uuid": "dc7ff647-5a45-4793-8561-1ae1d8ca820c", "comment": "Malware payload (Mirai)", "value": "c07b2c7c2246f85ddd2f636faf78eefc23c5b9f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593121, "uuid": "a10f97a4-9b68-49fb-bebb-25e915975725", "comment": "Malware payload (Mirai)", "value": "19cc9b1e1f85c3fba215789c66b2445f3414395ec2272987752edff0eb548be6abfbbd3ae6c6a4acbc098290d0fb1858", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593121, "uuid": "dc9f48ee-8f7b-4dd9-a675-1241a4eb00a6", "value": "T116310FCA2BAB56D93B7CAE22F98AC70D63485DD8A5207B84F5DBCD705DC01C36C08676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593121, "uuid": "3d392ba7-daa0-43eb-be0e-0e2d8397b062", "value": "12:3J3LAaZAQLAaZ6nREQLAaZENNIlvHBAQLAaZtEK3HQLAaZReQLAaZVHeqQLAaZ2n:3J3RnMaNI5EK6vjWE22wB9cW2HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593121, "uuid": "8494e59f-fc2e-4c49-8ece-55f3d6cbd6d8", "value": 1774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593121, "uuid": "6c74ffc1-5d41-4b4f-9685-4c5b371a21ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593121, "uuid": "3688a301-abf4-40f1-80b2-a0120d0fed1f", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126c482b-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784613455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613455, "uuid": "0a7d0f23-77cc-4777-9a77-d8614a8f8bfc", "comment": "Malware payload", "value": "a9a6055934c9f7b5c8a3a54db9e77a13", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613455, "uuid": "f8d830b9-7311-4a90-a945-b182182bfb87", "comment": "Malware payload", "value": "e008e80616533b9e83bc57a8c5f3232592d55d7fc84c3cadf69edafc771129a7", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613455, "uuid": "bfb3bee2-76de-4593-84ad-6faa6fb15b79", "comment": "Malware payload", "value": "3f4be419a86f8f7dc156fa3ddf9668726ad57421", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613455, "uuid": "820149de-9fcf-4705-be8f-77840483e470", "comment": "Malware payload", "value": "91234f5be66d8354189d69295fbbdfd7beb620fa86cd6b6fa7d1346387fcaa0bdbe67a32dfdd6ab6325bf5d21eeddef1", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613455, "uuid": "d3ef325b-caf7-4391-91f1-7ed5eaa56f53", "value": "T141256CFB03179E8F9A1E1D50F4080349EC7CEC9B61DC81F9AF458DA64AB555888B4EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613455, "uuid": "ab6d0a91-4b71-49f8-aa63-bc45011abaf8", "value": "24576:b7FV9Nb35if8RNt+lR7/N6OM4ojEd6n8xNSiTxxumJCWPSnxP4HG:3FVX5Q81eB4OM4ojEd68HxumvcxP4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613455, "uuid": "37791908-f869-45a6-959a-0e2f0738f113", "value": 1019496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613455, "uuid": "1d2b0f50-cad5-4b80-b1aa-f4a198a94f32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613455, "uuid": "13ce8aa5-e267-4eab-98b4-32dc4cbc3b9e", "value": "216.9.224.48.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2df1c0a-84dc-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784621939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621939, "uuid": "84e699a6-2933-4624-9dd9-1a805835d8ac", "comment": "Malware payload (CoinMiner)", "value": "a715af24a7f5a449a2c75aad22ea4699", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621939, "uuid": "81dd49f8-4bf5-4f7f-a9bf-d0209f69c869", "comment": "Malware payload (CoinMiner)", "value": "e0e37969dfd722c3036557fe6c3af6dfd70b5a55f496c9771c3e9dd97e648823", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621939, "uuid": "aa3aa947-ff19-459f-9cf2-7a1df37a8fed", "comment": "Malware payload (CoinMiner)", "value": "7b12d99f15742ac735a3934a560ebdbc00808dbf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784621939, "uuid": "5f7636b4-248c-4747-b1d1-14c13660df44", "comment": "Malware payload (CoinMiner)", "value": "4b360b2c0fe94eb9a9e941cd80955dc520b67f2f712706a5e0ab4505db79151928095a46e2f3717be6d35670b2407a38", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621939, "uuid": "8eda4c9a-a8ff-49a3-a1d8-74d9502e783a", "value": "T13F54120AF92356C8E053E2B582471E65F16E780E273A22F70F68B34E3AF1BD5457E194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621939, "uuid": "03bcffea-6ae9-4cee-aa40-fe90ff38e90e", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621939, "uuid": "1edd60eb-5590-4dce-b63c-7ac568dcd1c8", "value": "6144:qBfYxCV20SIugGCvOizuwhL+iXKMPuHknsaIL/dU2h4mMchI5qqmKIsQ6aZmzI:qBwEVf9ugdzpB+032Hk8vh4KBeIsQ6ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784621939, "uuid": "b33fdba8-3e7a-41a5-b731-fcc4964f903f", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784621939, "uuid": "b3a1a3c6-7064-4445-8f82-58cce9b95424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784621939, "uuid": "f1f693ce-377d-47b2-a027-3562c74f9bc6", "value": "LightCord-Setup-Win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2861c03-84c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784612516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612516, "uuid": "233f94fd-4c7a-4a29-8b41-62aa13525fea", "comment": "Malware payload (Gafgyt)", "value": "797a1b68e2da1546aa086a9188e5c873", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612516, "uuid": "4bb25949-bed4-48d6-8e07-c1d9724509d8", "comment": "Malware payload (Gafgyt)", "value": "e160c4bffcad769a84303bb423da28a2482bf1d024a3afe048ca97db31899dcf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612516, "uuid": "a61282de-6b7e-4480-8261-e78f0bc2da7d", "comment": "Malware payload (Gafgyt)", "value": "32feb80f7d358e6e387ef8c90ba2c5ea8b8f9c48", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612516, "uuid": "34795d80-8ddd-4694-adb0-d7649c130168", "comment": "Malware payload (Gafgyt)", "value": "c2dfc900ef1d3bc19eb5ec72a39043c65678bbf609c2663a951db058363d201d8d22e186287869dec8079ececf421a09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612516, "uuid": "5a64848d-3b33-485e-9c4c-5b72a8fab9bf", "value": "T1AF016FC64650AD108069995D729762A0B421C3CF56870FB87FDC5D3DFB9C914F066F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612516, "uuid": "407ff254-6333-4834-8599-4307e0fcb613", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaFCme/QCS4Mx7C92QWCGvpC0FauD:kXCKysE2hi0ziQvZohaF/e4D4MlbdJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612516, "uuid": "e9d9ec52-5d27-4e47-9a19-402e9443f279", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612516, "uuid": "e4f8eedd-0606-4382-b76d-6ef0599aaadd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612516, "uuid": "19a55b46-401d-455e-b2f4-1c022f9d146c", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de88be0-84e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784626843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626843, "uuid": "bc9e5458-84bf-4264-a539-4b67217cfd5e", "comment": "Malware payload (AgentTesla)", "value": "ce3d93a6bd9b3cb69ddffc6aee23816d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626843, "uuid": "9266d67e-f37a-4ea6-9a3f-a17ef30c1b43", "comment": "Malware payload (AgentTesla)", "value": "e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626843, "uuid": "573cfd5d-ff15-4075-a5f9-958417a5f63f", "comment": "Malware payload (AgentTesla)", "value": "9e5ca35403580c271a52bece0129bb2a5f33d48b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784626843, "uuid": "352890e1-6bf5-4cd4-846d-e509780ffc84", "comment": "Malware payload (AgentTesla)", "value": "f0e2373ed94252af086dc8f5a759d5f066195e9e7a5646dcccbc6e648f80de203a887a351b7145354fcc6d2fa06c85d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ikzwhpl", "colour": "#261418", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626843, "uuid": "57152db0-1679-4de6-acca-ee8510ee330e", "value": "T14B42C5EAB0E578FFFAD851BB441DD6F371E42C22EAA42508B43355F192E08A48067FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626843, "uuid": "e9cdf7af-fcae-4c3b-9ab4-1bbc963632c9", "value": "96:ZmAZCoZ2SI6nslcLfU5EYanHXzgn5Tdbcj3ME5tEHrXK:bZdZE6E4u2Xzevcjntd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784626843, "uuid": "a62ad805-e5b0-4ea0-9aba-ff0d8de217fa", "value": 12005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784626843, "uuid": "10c042ad-bef1-4123-a9b8-be6eab12495d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784626843, "uuid": "89a467a5-803e-4d77-a33a-83ed1fa1037e", "value": "Richiesta d'ordine PNCG-0027392026.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667b2b7e-849e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784595128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595128, "uuid": "28322700-6125-4be0-93d2-3cd4a6ddb181", "comment": "Malware payload (Efimer)", "value": "a23a2fbb43f109cd663fec1fd01b9a0d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595128, "uuid": "ef537c15-0de7-430c-a225-59ee3d6b031e", "comment": "Malware payload (Efimer)", "value": "e296f65108930c6e5d0fcd0ecd4654099dae322ce118e25fbfe01250dc8e1c29", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595128, "uuid": "5fce657d-7a1c-4a60-8e02-94b0e8915ad7", "comment": "Malware payload (Efimer)", "value": "ae6c74c8decffa1e2f121d0470729f91ba9fa1a3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784595128, "uuid": "0d205341-44d7-4b2d-ae95-a4f7b39e50f9", "comment": "Malware payload (Efimer)", "value": "72a8948ccc2398f0b5810f8f2a06b8e8fe5c1803efd4c0af39159d84fce0972fe90293c3223926ef127f2fe1fb011abb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595128, "uuid": "8aec53d7-5602-480a-b9bb-01256ed8d72e", "value": "T117E633585AE511FFEA73803CD9E225E6F191BC662730C9C747A88390EE573D8897E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595128, "uuid": "22725163-c615-4f47-b004-060f2bef9901", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595128, "uuid": "a066171c-ce93-4cb3-b997-f79ce136d59b", "value": "393216:Tl9X5739W3ij5er2egvfTv326hCABvsFxXhnDlXMCHWUjXgcuI3/PGTAI:TvpBW3tZgHsF7nDlXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784595128, "uuid": "8a0cdb0c-8076-4b0b-98a9-07b75f1d1d12", "value": 14311071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784595128, "uuid": "32be44d4-75ce-48d2-aaff-58b2db53176c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784595128, "uuid": "58459e08-a70b-4407-ad96-fe05b2ddeda4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fe8375-8500-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784637157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637157, "uuid": "03962b5b-39ab-4faa-9595-871731ba929c", "comment": "Malware payload (Mirai)", "value": "a4d3c51850110a2b232c25356053dc35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637157, "uuid": "90c493d0-e2db-416a-b217-d02b921a5187", "comment": "Malware payload (Mirai)", "value": "e445be61e479ed0f4a8c27882fb8f093ba406c4cfa97e71a567dbd121c7b7169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637157, "uuid": "fd7aacd7-750d-4c12-a309-9c006647a249", "comment": "Malware payload (Mirai)", "value": "38a7b52d9e004e37431690e3851dc8791a2580f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637157, "uuid": "b7f95611-cd00-4a68-9d45-718756bfa719", "comment": "Malware payload (Mirai)", "value": "410a7587948aa34b20755cf121781ae93b63cf1851e277d744573d7cd3f0d4cc1a93eff165d2e6d5a5c6179c1aab35d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637157, "uuid": "130868cc-a8a9-4242-99de-402552b4af8b", "value": "T11214541A3A12DF7FF56D827047F78920579876D63AE19584F2ACD70C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637157, "uuid": "7f0ba9af-2504-49ef-8afd-beec133634d4", "value": "3072:Tx+SzdBLGPjioIIS4BNDnwaiS2ik9AyfFYg8z:T8SdBLGPjiYNnt2PfFZ8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637157, "uuid": "989cfbb3-d7b0-4359-a729-6a32562beff6", "value": 198844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637157, "uuid": "73101732-6f81-485e-a265-cec8958b954e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637157, "uuid": "daa54a4b-ce25-4d5c-8afc-d5fde50b91ea", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ad6005-8515-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784646399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646399, "uuid": "f1b622d5-418f-4c85-92b9-00d08e6dc90b", "comment": "Malware payload", "value": "8b77514ae8bd6dd67806015946e4c947", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646399, "uuid": "36293a05-532e-4659-9658-26f1341bc47a", "comment": "Malware payload", "value": "e49654463f2bac6d9ba8c240cb55434d67cf0134764e81d4c474b3169a5a4927", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646399, "uuid": "c7a195dd-8082-45fd-94cf-1a14334cb8d6", "comment": "Malware payload", "value": "6929083fa74fe6cd7c5eb2e2a117328e037c926d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646399, "uuid": "a60754ab-6f5f-4c96-bfff-b93c6b8b010d", "comment": "Malware payload", "value": "7ffdd577d16e35379f3363c3104e23888fdf1b553f18f7bb6c10a7bb28e48279690ae5c28a93ec6ea9548cff0f622c07", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646399, "uuid": "8414b04b-93a8-45d5-a204-0848e5263dd6", "value": "T15CD02BA67421003289CDC86F9696D19C318131121D43B63CA0336637478D9B4E07AFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646399, "uuid": "a7de3373-e802-48f3-b6e8-e909133a2c87", "value": "6:h/qVzB+QFnTAJ3lqLeBsAQEafrFZZdEe5plVyQJfRX50:5HQFn8J3lfXafrFbmgpT1tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646399, "uuid": "bb7cd66a-7f3d-4601-babf-47e2bb415bf8", "value": 284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646399, "uuid": "8d4ae990-d383-4f01-ad84-21cc67f10aa4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646399, "uuid": "71b3466b-6fcb-43c9-8d92-0de20bd98b4e", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc29be3-84ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784615679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615679, "uuid": "1e6ab655-edec-45b4-a68f-ed2140d63537", "comment": "Malware payload (Mirai)", "value": "2c584909211fe47043ef1362257f3b80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615679, "uuid": "4fad9753-62ed-4d96-b523-1918ab213b0c", "comment": "Malware payload (Mirai)", "value": "e55600e83cbebcf3ea1f4c7b28534cd6dd2e2546ced6b0999e8afb9765108966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615679, "uuid": "b286bfb7-2888-4db4-be9b-e1b4e3c01d16", "comment": "Malware payload (Mirai)", "value": "52198522e0953e82b2276a7378be3071cbe70a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784615679, "uuid": "4e34057d-47fa-465b-8320-490a77bfcf94", "comment": "Malware payload (Mirai)", "value": "0c18bff4f81c90ad8b79a2b0abcee3cd25257f758a149fe75af9392c6ba845bb18f2cfe6b3e1a71b06aa5f55ce7d02fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615679, "uuid": "88030068-2522-4e6b-ada3-532fb753dc30", "value": "T1A7A32946FC814A21C5D512BEFA1E318E331357B8E2DE73229E149F3173866AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615679, "uuid": "f5144323-c33d-4858-9744-5b0d9e94c277", "value": "1536:AAnky0uOMdiA/5JHa9yiqppkGBEdQxmQ3k7/axrlOXzD4RidpSxfVwv7fh5GYWMq:gxL+ppkYU+k7/axMpSxfVgbhULMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784615679, "uuid": "45bc18f4-e8ea-49bd-9dca-c15e44c5dde1", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784615679, "uuid": "363a59fc-48b6-4690-b1e9-2560d2c51d84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784615679, "uuid": "c339ed23-33f3-4333-a41d-bac7b9907d6f", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8cf5ad-854e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784670919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670919, "uuid": "f5234666-aa9a-4e7c-a381-dd09f5ee6863", "comment": "Malware payload", "value": "9c45937d5493547ec8bd429cfc7175a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670919, "uuid": "24295848-09bb-4c86-802d-7d0ce1e496e0", "comment": "Malware payload", "value": "e55977d62b523894693b08e9a9113f777f3667ccb05d8c17f1fde6b46b46d959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670919, "uuid": "dc081526-a76e-43ca-befc-5d4b9f460013", "comment": "Malware payload", "value": "de348750ce64104bff7a73b626bdd93cf4b1ddd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784670919, "uuid": "ce1c9189-3033-4a20-a561-b8814bb00f11", "comment": "Malware payload", "value": "70845068fb2e7f19319c91e467c4eb628c626024543dbf4da475c0a04f5221ba252dd43602b7a314d730771c310d788c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670919, "uuid": "49df60cb-05ea-4c43-a323-4b4fbfa13a4d", "value": "T1C5A3E90AAF611DBBD81BDD3705BC070234CCA617716837793678D528BB8A54B8AE3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670919, "uuid": "309b7d64-9fce-4a6f-90f5-571ffc4d4a01", "value": "1536:6NZ8nh7M7He34Xf6SvAz8mjqauqKcU5orvvtQ0IfVigjWUdgUa8kG:hhkHe34XiSIz8aiSUHVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784670919, "uuid": "bf0c9a23-c7cf-45f9-9ff1-d31a89b56d3b", "value": 101284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784670919, "uuid": "7f379b02-e842-42dc-82f9-619aa7c824a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784670919, "uuid": "6c08e710-4886-488b-bd7a-b414b8592a50", "value": "oDh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307dcd4b-84f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1784632833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632833, "uuid": "ad6e6e1b-72f0-4064-9d6d-d0f4afc98e08", "comment": "Malware payload (XWorm)", "value": "391ed6003e6c86968292dc8ac9733cf1", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632833, "uuid": "e4f7d2b8-38f0-4f59-b5e2-c77b0b403ef2", "comment": "Malware payload (XWorm)", "value": "e5720090ad89883afd9444c7330e7fd0fe37403b2fc66fe6709e56a57f0938d2", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632833, "uuid": "86892d74-a018-4e38-8a21-0fc02d4f897d", "comment": "Malware payload (XWorm)", "value": "c38a64c11538ae2206e64852fbf3ae897770596a", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784632833, "uuid": "4d988e66-8f24-4b0a-b5f9-b0d88a534bf5", "comment": "Malware payload (XWorm)", "value": "cf81f3be0ec360bf76c60b864fa7b230a53d8801923aef61027633b8e7302a29fb1a54dacddc08629400d75ed6c092ce", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632833, "uuid": "b8665911-973e-468a-b643-901c946a9418", "value": "T15D513B53F1A7560EF1CC8C3E375BE2120495225FFB77548B5E4CA9E174D80226B05153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632833, "uuid": "70ffca89-2d51-436f-b681-bf5533ed4fdd", "value": "48:zl87+VWjSNx0W0qf8StJGVW8o7pqw5FkTog9pawIxIdE+RTcrsb08tt:zlDVWjSNxjxeVeBOp2x0RTcrsb08tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784632833, "uuid": "9e3ef26c-b193-4f12-999c-47631aa8d5dc", "value": 2904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784632833, "uuid": "aa51f7b3-ee02-44fa-94c0-8dbff6cf21c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784632833, "uuid": "de557505-853a-4fec-b012-af921fed2df7", "value": "rfq.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972a16ec-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784645890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645890, "uuid": "01cf291f-d817-4a26-97ba-de4fb35335fb", "comment": "Malware payload", "value": "6d6f196d147c989c3600f60bc557d4f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645890, "uuid": "1e55f1f6-8143-49d3-83ff-081932dfd152", "comment": "Malware payload", "value": "e60d7a3c7b85036f7b63c754c9d3f41b7c0e7a4029a4876d59685eb17392d204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645890, "uuid": "ec5e9e9f-19c8-497f-9fc6-10b85dc0140c", "comment": "Malware payload", "value": "aa01cead8cfa6bd5b63f6b5736956bd3260c4ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784645890, "uuid": "85c7b73b-e0a8-46da-9736-bbc3282a6692", "comment": "Malware payload", "value": "8639fba61fa1ebbfc41198456d167d68f64320d89c9a1a766859846036cfa0979167671a624f7e8c9be538af9c6c1210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645890, "uuid": "95343c57-8740-4844-b63a-de7eee54bb42", "value": "T1D547DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645890, "uuid": "5bb42334-4246-43c5-a292-7bff11cff5a3", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ4:cqYUQuVDt0TZEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784645890, "uuid": "c3c1ff44-918f-494c-be57-322bfc476474", "value": 24838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784645890, "uuid": "f4f0d8af-4065-4202-accc-b82c0e733a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784645890, "uuid": "dc0006dc-89da-4a61-a713-9b8b84605285", "value": "e60d7a3c7b85036f7b63c754c9d3f41b7c0e7a4029a4876d59685eb17392d204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e174f48-8501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784637634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637634, "uuid": "8d11ea01-5e92-48d1-8947-24cfb76d29d2", "comment": "Malware payload", "value": "038f391f0a118c68be71b9f79e830041", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637634, "uuid": "d100d532-4c0d-4c0b-92f6-6c65ed5bc9e7", "comment": "Malware payload", "value": "e7698729d586d96bba52270f1430733e74bb42094e1d018149cc3898fbd43c8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637634, "uuid": "ee9abdff-425d-415d-8b40-f546106136a5", "comment": "Malware payload", "value": "6e261d6c88b72f89cbb0d789ec4b7ce6b8a59fbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637634, "uuid": "352e2ea6-5fc5-49bd-9c53-a93b635b3201", "comment": "Malware payload", "value": "41a2ce44b04453242ddff93d792170a20ae96b206f28c3e0c0715356b0c3740ea013b0e9fe15c1f884f8a1d511de9bd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637634, "uuid": "f373e13d-c0b7-487c-8b48-9bf022d29688", "value": "T15AB31786BB43DFB3E85300F102B74B254A32FD3A4837DA95E765BEA589065D0A31637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637634, "uuid": "eb83739f-4465-4eee-aac8-55f7964bd868", "value": "3072:mrCmkT1s6Fuw+m2fajBBk8CpUy/Ghlvk:mc+mOXpUy+Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637634, "uuid": "6969bfd5-7680-461c-b8f8-d344bbdbe397", "value": 114528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637634, "uuid": "f3f7b0b5-2eb1-4a1e-aa64-54fa5e17dd16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637634, "uuid": "5e04163e-3ea3-4bf9-9d2e-a507a21c8a78", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41fb010-84d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784618532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618532, "uuid": "9c56f12d-0028-4393-845f-11c7f2e937f9", "comment": "Malware payload", "value": "efbd128a3848fcc22e0aa0764e2e9711", "object_relation": "md5", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618532, "uuid": "69f36f3c-11f5-48ee-8ab7-9eafb369b6ae", "comment": "Malware payload", "value": "e7ea16e2e4e5b04606cddc28baf53cf400eea46fb1d7be39c55ffd54711b3c2e", "object_relation": "sha256", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618532, "uuid": "e27aeb0f-ac6d-4196-8a46-6b76ecce6a63", "comment": "Malware payload", "value": "b4d1afd1f5db1822fc7e59983ddcfc30adaba131", "object_relation": "sha1", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784618532, "uuid": "975f81fd-7ae0-4aa1-9ca9-a1d08ac5272b", "comment": "Malware payload", "value": "a331958601faeaad8fccc755a1911b9577e746f00e7cf6249889d114408465359b441f3ac130175a73256d515585c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-107-229", "colour": "#8066CD", "exportable": true, "hide_tag": false }, { "name": "audiosnws-com", "colour": "#BD19E6", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618532, "uuid": "ee00889b-76dd-4ca6-b6a2-a4b43b2b64ee", "value": "T18FF4E035BBD71C9A2E672557F0F1A043DB68D9D3222101EF72AF0779434D94A811BA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618532, "uuid": "e4f5759f-ec15-4d05-9f75-bb1657364ec9", "value": "12288:Gwl0aDl7ZVoL5KVMKOeCAFkR+722BQGhUyr+LR7yxZ5df34Ozl6aHkDH53wOj:6aJILYAA642pGhJqLRIDf3xPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784618532, "uuid": "c8bef303-7dfc-4ae2-9dd5-365c5f767f79", "value": 733832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784618532, "uuid": "05926471-20fd-4d80-b9d9-8346939e20a8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784618532, "uuid": "52cf655d-9e85-444b-9ccd-4b66a63a62f1", "value": "e7ea16e2e4e5b04606cddc28baf53cf400eea46fb1d7be39c55ffd54711b3c2e.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d7b780-8502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784637989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637989, "uuid": "1212b71a-8a0a-4f7d-94a0-96711fb42f47", "comment": "Malware payload", "value": "be249aa0b67c5efaf7e7305a20698578", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637989, "uuid": "48e1c515-0bf9-425e-8a9e-f196296e51a2", "comment": "Malware payload", "value": "e92bdfec111dc08ce166d5e248d1e29cace468e5fc5f3a2ba003595a4e6350b7", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637989, "uuid": "d415c56e-3caf-43cd-8331-f23de1fbefba", "comment": "Malware payload", "value": "30badad4a11f1e0b9f23f7220e19d14c21c4502c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637989, "uuid": "89886aa5-de61-4cd9-afed-80ef9fe86641", "comment": "Malware payload", "value": "bedb326285627ca4140adb788a5b1092dc6beb5c0807692350b24a10c9ac21eaecc5b75a64f7c72fcf0f40afdba6e469", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "fivebellsinn-com", "colour": "#1B6F70", "exportable": true, "hide_tag": false }, { "name": "futurebuilders4c-com", "colour": "#C926C1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637989, "uuid": "ea3d618e-300d-427f-8fca-b33cf43c2a0a", "value": "T1D511C2611BDB8B10F2F64B34BC7C97011D303D888931064D078B252C4C62A248CA6F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637989, "uuid": "5843f92a-c6c3-47c6-9fe6-c4c673f8a5e9", "value": "6:4xtiSOjr/czKlFcnlj+SEEgykQLPfBMlpInyglKV6SaU/k1ARokJxt:8ouEkCikQLhMbzgOMf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637989, "uuid": "216805ce-9418-470d-9cc6-8a1aa005af06", "value": 1046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637989, "uuid": "000c4f98-c7fd-4b46-ac02-f95b1acf2a74", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637989, "uuid": "1d54bf88-d09c-41ba-aa66-4fe6590789d5", "value": "imgset_81362783030328 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2242db-84c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784612904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612904, "uuid": "509b8112-41a8-479d-b270-831d2a80ac6a", "comment": "Malware payload (Mirai)", "value": "b0568cb5e337d0a8c29d4b80b35d79c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612904, "uuid": "4a2432bb-2eff-46b1-9df4-79e4825c4a6b", "comment": "Malware payload (Mirai)", "value": "ea1627819f81c2f1d6e673c4409333a938368116e765a7a06b6990798211e063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612904, "uuid": "6c945b62-d4da-4c3c-8b37-d72f34b7db2e", "comment": "Malware payload (Mirai)", "value": "5a87703f7e84893716a657e51f338db6343851e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784612904, "uuid": "e2143d60-e254-48a7-9462-1789c87c2e1f", "comment": "Malware payload (Mirai)", "value": "28681421ed12f0d5e819f382b2ab3883f64a41c6d3ca28e0838f162dba7a410c5bda6abb9530ca25258e86fcc111a295", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612904, "uuid": "1bc9c98c-d130-4b2b-bbfd-ab894d85e0a1", "value": "T186E32A0379C1C9FFC897D1F44BFBA52A8932FC2E1935715A77947E921F09EA02A1D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612904, "uuid": "100c41ae-5dea-4641-9341-43c3babba6d1", "value": "3072:bZApCj6MnEuTAc3dVXPE9qACM1woaj6kOMdQq7tW:75NO9VSohCttW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784612904, "uuid": "38653eb3-efcc-4c25-b6a1-156f0a54c69c", "value": 152448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784612904, "uuid": "8de3abf0-826a-4722-8839-e72b17a68830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784612904, "uuid": "f3745d9d-1034-4c04-97bd-f9b98cb6f459", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862454c3-84e0-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784623528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623528, "uuid": "7f90c8b0-ad11-45d1-ab1b-72e0c24a391b", "comment": "Malware payload (PhantomStealer)", "value": "6c735f94a08152b159105921c627678c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623528, "uuid": "fb180c88-3226-4854-9648-292e993b34b7", "comment": "Malware payload (PhantomStealer)", "value": "eabdb21c2a0243e8d7ecbc87062d8dd692f9a1e3f5984dd5ea772e8f6fb14488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623528, "uuid": "d9c1dd99-629f-40a4-b3e6-f87b60e8b583", "comment": "Malware payload (PhantomStealer)", "value": "d006940da31e7ea60a6f06df3ce86324126b2f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784623528, "uuid": "727f36a6-73d2-488f-9f15-076136825c74", "comment": "Malware payload (PhantomStealer)", "value": "2f1fa6ceddbf1c47bd6e8ff8ad8657ae770efc605558bbbeb45c287d017de5720e1993dc9ac3eca2750f20a675ee2f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623528, "uuid": "10cde6df-386c-460c-837b-2155e23ae5d2", "value": "T182D5BF55B3C866E9D462DA349714E332C2B1B9634B76D08B4A9AC30A1F77D924F3FB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623528, "uuid": "98f25ff4-c42c-40c4-82f7-6b3ace4a1984", "value": "592f2a4e38c27b54ff57db9c30b12a37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623528, "uuid": "8d7f138a-57af-48bc-a12a-7018262679ca", "value": "49152:FnwNCtHNEBabmTNbt8IAgrFIQ1sO4B4xz6GNsxIZPC7HPk695biM4KMvwwdpB1O4:NtH2BuG/6GNsxIZPC7HPk695biM4KMv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784623528, "uuid": "bf53b1f3-8a90-493b-856e-863c17b7d89b", "value": 2993152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784623528, "uuid": "e9f4e02f-ed34-4672-9a89-87de50b52fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784623528, "uuid": "9defe3d1-3906-4288-8700-03e49a3b206e", "value": "Ad_NEW_ORDER_02606001pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42adc858-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613107, "uuid": "3cf66ab8-74d3-443e-825a-d67de6d76641", "comment": "Malware payload (Mirai)", "value": "bb6c18a872e6aad4c50bef545cb3b9de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613107, "uuid": "1e1f285f-4a57-49a2-bcb8-de35cf4cc349", "comment": "Malware payload (Mirai)", "value": "ebe73b95d9b5d924ef19c2fb556ff88d0a6295da67c91099593205210cc3f9bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613107, "uuid": "74a65ad7-9255-4cd8-9321-b6dddaa3062f", "comment": "Malware payload (Mirai)", "value": "121daa668a0b91f22a0001721a00eb20edd3691d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613107, "uuid": "1da46def-c408-4659-a3c6-25dea0c1cc28", "comment": "Malware payload (Mirai)", "value": "f64791c2c761d75450ffbfc7c51d18bb8d02b99790026b1f1bb7eada339e7fdc1b4ec6d746a72c51702f293d0fde8189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613107, "uuid": "0f11eaa9-9b02-4cec-937e-581af043cac0", "value": "T12BB3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613107, "uuid": "6ce0b917-a17c-4a80-a694-fd66e228ec35", "value": "1536:KEkWi8LiZECcpHOWWJDman5Pd1Oe4a/7QhfUxI+E7OTeVutW/HeAB090xC0n:44i50poRb/EhfUQ7OTeEtW/c0xC0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613107, "uuid": "45cbe4a2-2df9-468c-a6f4-ea51feb4927b", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613107, "uuid": "51d4bead-50ee-4eb7-b83a-eb7a9024c2e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613107, "uuid": "51b0b953-7b3d-4700-b5fd-ae55dcea343d", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b2d03e-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613026, "uuid": "c6aa672f-9609-4af7-87fd-f28e845a7d89", "comment": "Malware payload (Mirai)", "value": "c0593ddf5c39258eb1f876f3dbc4e6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613026, "uuid": "6de5f918-019f-4870-bbee-520698d8aeb5", "comment": "Malware payload (Mirai)", "value": "ecd48e585d767d48436611c32cde8150c75c640ffee1b19363801315bab2cd37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613026, "uuid": "9dcad1e9-adaa-44a9-97b8-b23520c3e7e8", "comment": "Malware payload (Mirai)", "value": "ca896ea98cbfb2b905fb20ed0c0a29e7129ae657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613026, "uuid": "1ae632aa-b17c-4605-b764-f59c27eda57a", "comment": "Malware payload (Mirai)", "value": "a5b6b55e39341625e006a34b0167cf92c212ed03fe500cbbc74719a1ae5a11b04977c8f4938678f83b0e39a49b4cb25a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613026, "uuid": "c3460ae0-4a99-44b5-83ea-d8d171900498", "value": "T16213F17C72219179F4ACC4F6027D47C3DE364BCB8501DC0BACDEB447A9AAB55396A2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613026, "uuid": "4910c320-fb2d-4f8d-824f-3b9ffe3a7be3", "value": "768:Yc1hOmGJrKGLknuCxzEgzZg+QA7rUGTyObFpCA68ucvJY1FHMgLLLNJmBWPJgGlo:YYhYJrKGgnxzHDQorUGe4pCA7ucvJYMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613026, "uuid": "fc391d72-b785-4029-b674-82bf3a944d62", "value": 43288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613026, "uuid": "0a4eef1b-64ab-4c0a-9807-40223875f805", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613026, "uuid": "bb309b0f-8539-420e-a747-c1031846ecea", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645027e4-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1784613163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613163, "uuid": "723df743-92e6-41df-b991-f77e4cc9562c", "comment": "Malware payload (PhantomStealer)", "value": "a6fcfa65f7cb6c76c21adf39abe32759", "object_relation": "md5", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613163, "uuid": "d2b7a564-6f6f-4070-a925-5633b2f6b60c", "comment": "Malware payload (PhantomStealer)", "value": "eddb2dceefe6b8eadc8556697efefb528965da714d1a09e356d7deb788e19e8f", "object_relation": "sha256", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613163, "uuid": "08b826d7-54e5-42fe-ab28-758943faf977", "comment": "Malware payload (PhantomStealer)", "value": "aee47aa72f4eb157a219327e52751dc909fb5985", "object_relation": "sha1", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613163, "uuid": "068329ff-46f2-4cba-bc36-b1b2732992e0", "comment": "Malware payload (PhantomStealer)", "value": "d48d312f227d191e60a6f46b225ede20a66a68ef15ae39e26391daf56e5817e5355158129b126bb9bf15f8e21ada251e", "object_relation": "sha3-384", "Tag": [ { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tourtrade-shop", "colour": "#9B5CD2", "exportable": true, "hide_tag": false }, { "name": "xambby--tourtrade-shop", "colour": "#9780B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613163, "uuid": "eb508607-240b-4750-a877-3e2e35913b60", "value": "T18C45743AE65CEFF4C72D11F141873D021168AB56713A89ADB4CDC158BF2A7508FA68EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613163, "uuid": "44338550-bf0a-4796-92c1-b2661beb3590", "value": "192:hqJ2BgDLB3FxAyZgD/glv5IDH5XNS6IydK/H5Ee3PrhY3P5d4P+CX1VMPuy:T81FM8bIDH59RIydYH5p3DhIxiFV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613163, "uuid": "e422a874-0c58-4f2c-8633-9fc0fb173cf8", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613163, "uuid": "2fc4b17d-29b2-40c8-ad63-9d632410ab11", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613163, "uuid": "118bf527-7cdd-4f0d-9e9e-14a81c55a2b9", "value": "852000031.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b45782-852c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784656328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656328, "uuid": "26360b5f-e4f1-4297-826b-0f5ad25d2c34", "comment": "Malware payload (Efimer)", "value": "0a635961383389c90b59d8104d1a70cc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656328, "uuid": "6c7c85a0-f6e7-4904-a03f-ec7b2f5b9162", "comment": "Malware payload (Efimer)", "value": "ee313cc02f4f644e2a80a407a4971faa06df65ac484d1bd0f57e62eb2c55d8bd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656328, "uuid": "bedfa778-1981-417f-9524-cd6836c43a78", "comment": "Malware payload (Efimer)", "value": "709ea37c2d8c2bc532b065d95af124d9a7dab1c1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784656328, "uuid": "65fcdfb3-8906-4689-ab41-21b74829de06", "comment": "Malware payload (Efimer)", "value": "8f6573fdb11e2675988ddacde9ff7fe9dc74e8f05dd8301a481c02c20e015aa9d3221979969af480728195af1179ff12", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656328, "uuid": "e5833b9b-10e8-47a3-b691-b61cfeda67ec", "value": "T196E6331867E502EEE1A7553CE8C09A86D659B4B65B36D9CF4B6C93C5AF072E0003ED23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656328, "uuid": "1c21d096-d3ae-4e3c-bc7a-ea010592fb60", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656328, "uuid": "a96f4bd6-6506-4ca5-9227-4beac58390bc", "value": "393216:w2gYrl+sB7tTYWRdeDZRJXMCHWUjXocuI3/PGTAI:bgu5ROgdeDZRJXMb8XdH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784656328, "uuid": "8e54be22-06bc-4f64-ad15-83d4e3a64496", "value": 14300513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784656328, "uuid": "1804c8cc-1905-4c28-b822-0a4e17abb331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784656328, "uuid": "7a6b0226-6032-4aba-9248-137aed81e44a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33515115-8550-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784671493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671493, "uuid": "637bd0cb-4c59-4870-9b5b-a243333f3898", "comment": "Malware payload", "value": "1a669f1310368bf8fa9478ede9632a9f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671493, "uuid": "b9acec1e-6429-45ff-9f57-9b0ac5484d12", "comment": "Malware payload", "value": "ee5c5c69bb1c0d961dff49dd3bcfcef923406e1c2d80b662b76c611cd6fb94a3", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671493, "uuid": "730260f2-3e1d-4874-a010-2a53c9920373", "comment": "Malware payload", "value": "aefe7a849a853eaff1979268d64864ff85eabfff", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784671493, "uuid": "a1da22a5-68c8-47f7-8b44-64fc407a716e", "comment": "Malware payload", "value": "ad6c6ae13d5c43a98c734fe05588e5cf37d67ee0773c22f72eaad717d89ace8cb45a09bf3c70faaa452ed37db2c38340", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671493, "uuid": "95344bf4-593d-475d-9e12-484f46bc0f74", "value": "T195068E03E2A250ECC12BC17D8A579672B631B82DC534FE7B9694DF311E31F509A6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671493, "uuid": "179e223d-afb1-4c90-bf34-69a97926d002", "value": "69d04b283251e75ebf7bdd628fba938f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671493, "uuid": "b3659fa6-f6c1-4a3d-bc45-e92d8ca22917", "value": "98304:n1DLMVtjANF8oC4xEyrTVhm8bILHGWCv5IjjPmgDfwR:n1XUWXC4xEUegv5IjjPmgDfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784671493, "uuid": "afedec40-3003-461b-9c92-5856ad192c8f", "value": 3876576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784671493, "uuid": "54ebb498-8e83-4e4d-aea7-4b70a8a85b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784671493, "uuid": "6ff43866-ebc8-4606-aee4-9d2907f34756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2a3630-8541-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784665119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665119, "uuid": "7ea4eedb-a045-46ec-be32-aba4bc8d30b4", "comment": "Malware payload", "value": "752db4b87198eff1979ebf07156b20ae", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665119, "uuid": "ce2c8fe5-1651-4281-b9f6-44b45d8d19af", "comment": "Malware payload", "value": "ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665119, "uuid": "fb6a0d89-13e6-4529-a115-5f347a555d54", "comment": "Malware payload", "value": "674fcfc27b430a88091475991ebb8d96a4d81fae", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784665119, "uuid": "4995495d-8114-4780-b0a9-212448471812", "comment": "Malware payload", "value": "cb4c8f064b1a320a1a04be747837697ffb7836a804c2caef3a40f2fd6994e1032fb5ec25ed906c696ef5b6a600db0e0a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665119, "uuid": "cea1c032-d7b8-403d-aa70-6a886a286ea1", "value": "T112C4231637A9823BE1C66734902CF3848E287C6C6F1E18167275715E1DB33E0DAB2BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665119, "uuid": "69bfe2f3-bce8-461d-8618-af456dfe10c6", "value": "12288:eIRrmyV1eJvNIGMevuspubrA8oDqT5EEbDWJWlH+oNQ99oD:ZTmdLPpuv5EEyGNQ99U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784665119, "uuid": "61d76ccd-2fb7-41d6-adc0-ef410ab10bd5", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784665119, "uuid": "5edd2f0b-8595-4843-ac56-f73ddc2e29c7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784665119, "uuid": "08e77174-5646-4cc9-af1e-4882e6b4a4e4", "value": "malware.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da314f4b-8514-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784646003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646003, "uuid": "1219a0c4-e3ca-419b-82f4-60719cf6c6da", "comment": "Malware payload (Mirai)", "value": "448ba09e54af0197023998b7fde8c9be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646003, "uuid": "69f99e96-01b3-4614-b169-e06211026cec", "comment": "Malware payload (Mirai)", "value": "ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646003, "uuid": "0134d8f4-339f-4f3d-a6b2-42d99f9024f7", "comment": "Malware payload (Mirai)", "value": "221f4d4c06a01399bd975f18da17c07b82764925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784646003, "uuid": "ca43b574-84f2-4497-b75b-e5583ba570a4", "comment": "Malware payload (Mirai)", "value": "3af66f5ae2440dd88e513ec5d927ea95d27fee799294b24bd99351f10fce2bd68bcab6b70218bc89ed0fb760420a107c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646003, "uuid": "451d9617-3f07-4b1e-81b6-4b13bde3bb9d", "value": "T129934B46BD81DB42C6E82376BA5D82CC332603F8D2EA7106DD265F6137DB81B0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646003, "uuid": "5a8b5ed2-1fdb-401b-8189-23d3ddb276ef", "value": "1536:8N8/F7AHaT6ZVyEpTgxLuUstaESnYBdQFUBhazHA+Ho1Wm2od4kT4z5En:h/LT6ZVHGxLuLtaESnYPQFUDazHkYoPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784646003, "uuid": "86ba5d48-0d43-4a44-b6d3-069da8b8c1eb", "value": 95552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784646003, "uuid": "a34eb81f-5a31-49b2-b1ec-07a4d293458f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784646003, "uuid": "56e7fa37-4bfd-4d38-8144-3a7c3220063b", "value": "ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1328d2ce-8527-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784653829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653829, "uuid": "090aefc4-656b-410d-8222-f3e6317b9481", "comment": "Malware payload (Formbook)", "value": "ae58622241092d9ba1d2426a875119a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653829, "uuid": "3453b41c-2f17-41ac-81a7-a9b571f5ea06", "comment": "Malware payload (Formbook)", "value": "ef8f821a54f3f07ae8036c005c7656aa755f8078de6c70a1a8f72ebafe35fe69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653829, "uuid": "ba942316-270c-45fd-92ab-3584179276c1", "comment": "Malware payload (Formbook)", "value": "514853c657defc7e450cce08e5884fce6c0c1066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784653829, "uuid": "adb96549-42bc-4645-a31b-28b2186d5fdf", "comment": "Malware payload (Formbook)", "value": "e50ff1a7718b9bd02037ba40c3b2c8d85f954d0c795d76f2aa9910bc593cd9cfe8766ae6d8327b77df0f3b539e8126cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653829, "uuid": "644baf92-46ed-4892-9241-86eae44c4d6f", "value": "T1AF35014023668942D0F68BF6B8B0D37533651DCF7DE2C3964FE95FE738192C2A568292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653829, "uuid": "9d0ec58c-d62f-4d69-9bbc-e6ec702668ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653829, "uuid": "127f4487-2de8-4336-9d1c-5dfedede5f36", "value": "24576:rcIp50gogxSEEAvVBs7NyS8FNU1RwmFwhoVMeU/mQd:rcIpzxS6t4NzDRnQoVjU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784653829, "uuid": "fadd58cf-fdc8-44ca-84a6-5b86ad2c0663", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784653829, "uuid": "6dad59f7-abfc-4e66-8156-24e7e77b2389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784653829, "uuid": "f5a3bb88-fedc-43a2-be3a-caed161fb7fb", "value": "Qot22019260721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7bf18f-8508-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784640879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640879, "uuid": "73e2c125-1993-4ed5-86e5-2ef6aad77249", "comment": "Malware payload (RemusStealer)", "value": "c24d4bba80891e29e8ebf5b3de1198b8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640879, "uuid": "29504012-597b-4c55-9082-fabc852ac874", "comment": "Malware payload (RemusStealer)", "value": "f3156f37607b62971c65a95cd5bd186d2d85194cb74119d558526f97424ff238", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640879, "uuid": "61094daf-afbe-4d3d-a8cc-5bee4e2e858c", "comment": "Malware payload (RemusStealer)", "value": "5e7b10eefa232fe86bf0adb90893c31069e94016", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640879, "uuid": "9da50d42-00d2-4697-926a-bf53efaafd28", "comment": "Malware payload (RemusStealer)", "value": "af19d87f8c1bf39ca5723f673389e6156c525f52edcbe450afc7aee37106ddb7fe71fa601ecdf4be233bf8d05299ca8e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640879, "uuid": "db8ea76f-9e12-4808-86a6-3c16ac1415aa", "value": "T124D54A17EC9148F6C099A33189A29256BB75BC080B7273D72E90BB783F767D05C7AB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640879, "uuid": "7bacdcd4-9f95-4335-b3e5-4504bff6b64d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640879, "uuid": "377c5976-3b11-4370-9fa4-addd7175afef", "value": "24576:h7/4YQlyRsfRHoXxASOu6GITdBQ6V+U0R8pKl9GxYa3p/vAoBele5I9DPKf4Rhl8:h7/TGy2JHuASOueTPbcB9BwiVOxLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784640879, "uuid": "cac34573-cbd5-4bdc-b76d-4c4b73e8c7b7", "value": 2818416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784640879, "uuid": "354410f6-c94c-4617-8e5d-4107ed194406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640879, "uuid": "16497f5e-60fb-4557-b82b-c0ed5ebbdc7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe31453f-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784613421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613421, "uuid": "e8fd73a8-4ce4-4164-acd2-f11055162ef6", "comment": "Malware payload (AgentTesla)", "value": "9f5fa3246b5936c6806347326de7afaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "imffy-com", "colour": "#2D2BAD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613421, "uuid": "a41e2ab8-4728-4fa3-aee1-0674531cd3cf", "comment": "Malware payload (AgentTesla)", "value": "f381f7921febb94c83884340f058dc80132ff399feef7ffba0eab1b05323f02e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "imffy-com", "colour": "#2D2BAD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613421, "uuid": "55eeea5e-02d9-432d-89c1-e70ed1fdd43a", "comment": "Malware payload (AgentTesla)", "value": "e53dbc77d356fc07c8cde83fc65be8568d7d0db4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "imffy-com", "colour": "#2D2BAD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613421, "uuid": "59a45af3-39a2-49c1-9857-85fc237fc322", "comment": "Malware payload (AgentTesla)", "value": "060985333ac7901651966d3095a8e4b75befe00b98adc2dccef2bb6f3531f9758fa3ead31199665deffd0816bd655c9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FAMILY-TRIP-BOOKING", "colour": "#55F01A", "exportable": true, "hide_tag": false }, { "name": "imffy-com", "colour": "#2D2BAD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613421, "uuid": "346583f5-c81d-438c-a2b2-2283a3520897", "value": "T19F21964AA40A9E0459A701F4F48775DEFC10886A825C146072FA8C494B08178739E72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613421, "uuid": "3056a21d-9cb1-48b5-b86d-71100ea29f5f", "value": "24:laNrBwJbI7nDTbRkp4kX81K2epSUabhqeBpd4eiUn06PiT1drt1iGmm128PNDzh:lSrV7nDTlkqkM1KNclbhbvi4VPe1pt1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613421, "uuid": "71640313-2b42-42b7-87b4-84d8ab6a6181", "value": 1366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613421, "uuid": "48865782-0fa1-4d8e-bdd9-3ccaeb4ab56e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613421, "uuid": "050c136e-d7ef-42c0-9e7a-1cfe2383e549", "value": "f381f7921febb94c83884340f058dc80132ff399feef7ffba0eab1b05323f02e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e024a2d2-850b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784642147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642147, "uuid": "d99e2e94-ebf6-4c00-af95-ee9b9b3e42a9", "comment": "Malware payload", "value": "2b8aee36442f48f26ea8fa756dfb086b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642147, "uuid": "4849d1e6-eb80-4372-af6e-a184c9825b20", "comment": "Malware payload", "value": "f507ac7d23bb4e553de1397a3c5cfe49738d55482f6d03675cad7a347609a517", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642147, "uuid": "414c8dd2-336c-4eb7-bb2a-624891e8f72a", "comment": "Malware payload", "value": "651f996df543845edc39e1a93bbd46d62335c323", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784642147, "uuid": "45e44ca2-d82a-45bf-bc54-8d8373e8a251", "comment": "Malware payload", "value": "e790beeffd53cf766017528ca3df4c8c2148fcfc6bcf10b47889d8f45d8a56c123e25c2c4da3bc9112442d6fd69ba31d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642147, "uuid": "afb37a09-973b-46b1-901d-5545359e7816", "value": "T14CD381A5F2DA1CCBE65582BC42D5E222763CBCE103039B974A2456334F9AFD37AE0547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642147, "uuid": "b5b56f5e-68ed-45f5-8efc-7195da1816c1", "value": "14b2c1037c7b350f17a09784b21d3824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642147, "uuid": "6f01f4b1-44cd-47d7-912b-4e89bdd05786", "value": "1536:cM6gABASeJ4/H7d3ahKY48BY/+eAcMd6GtRC7i65pCM9MCUj2LW/KfABkxwvgu:cM6fAxeH7RahKlssbMBSi6HCYMCA2LVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784642147, "uuid": "d18f329d-be88-4cf0-ab68-804a509664d4", "value": 130364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784642147, "uuid": "cb240e83-fd3b-4358-8fcd-360310544390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784642147, "uuid": "c59e0bc6-8ddd-4633-bab2-dbe3eeaf62d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02aa64b9-849a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593242, "uuid": "c42fdaad-38b2-4e00-8dda-b67ffdaf768f", "comment": "Malware payload (Mirai)", "value": "80077107ca71e9fe5aa10be23e2d2b0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593242, "uuid": "97e9e6ff-5357-40d8-ad06-f48866c24a0c", "comment": "Malware payload (Mirai)", "value": "f56343d2afffab61cfb5eca2a2b47a133a1f936843eba0d061f0ddaaf89d26ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593242, "uuid": "695d6fa0-b75d-4092-9ffa-dad5e319303b", "comment": "Malware payload (Mirai)", "value": "eeb3b5c046c7aaa37389684d14e914eb7139c269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593242, "uuid": "0eafd57b-323e-4519-9dde-fcbf093003e6", "comment": "Malware payload (Mirai)", "value": "66fc80d3828562429bb25443a62816563af5bd8d6250e44866ac11d109809bb5940dccc0347e5e009e9a3b7860495ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593242, "uuid": "520bcd3c-7981-4c81-aa90-b6e5eaea3efc", "value": "T19B733AC9B5C3F8F4EC040A392177EF319E77E13BA129DD8BE7D96623A941342941229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593242, "uuid": "3691d9f1-2eb6-4ab4-963b-9ca604545cb1", "value": "1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WRouZbqeqVr5g:9Qu3umbutmUl9lIlkeJoT2hJymeMlite", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593242, "uuid": "f71a9b94-b18e-4e62-849a-f068f0346407", "value": 79600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593242, "uuid": "c1b5f286-c899-43da-8008-be54eced42c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593242, "uuid": "90168d59-aaab-4010-ad05-573cc0338262", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148ab4db-84c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784613459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613459, "uuid": "7be31dc8-54ed-4fd5-8dff-6e5d162cb61b", "comment": "Malware payload (Mirai)", "value": "ac2d8f2f66d479f5b93be0756bda2370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613459, "uuid": "1eae1aa4-e58f-4a97-8298-92dd00529e84", "comment": "Malware payload (Mirai)", "value": "f5da1dbae5783d577deae9325824e55b3f4a3e0c46d20b617927eaab2d43aac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613459, "uuid": "985a2866-f183-41a8-8a00-485ef105d6df", "comment": "Malware payload (Mirai)", "value": "970be29751a1c975e4f88dbba50b2f2f94794de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613459, "uuid": "bb13670c-a3c7-4c06-8e3f-3d1021f1b5d9", "comment": "Malware payload (Mirai)", "value": "a201990b7b060201dde94d09516208ea53668d0bbdacf1d59663e36ec0f61cb8d0a7393eda190b46476130edde78abf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613459, "uuid": "794be199-bded-4d42-bd6e-a31b3099b9a4", "value": "T14D04F889BC419975C7C0D277FE0F0149331A97E8E2DA7306E92C0BB27B8781B4DAA755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613459, "uuid": "cfe9b104-597e-4715-a966-18a984e2a02f", "value": "3072:+l8zfP7ubrLL05R+HXUxFnr2x5CKtbB9fUv3WffM4EYXikYVnQP:+l8zfeLQEHXUxFnr2mcPsv3Ws4PXtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613459, "uuid": "a41b3dad-c040-402e-9437-6333d32c557a", "value": 177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613459, "uuid": "8887708f-152a-445c-a321-d0b0042ecd98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613459, "uuid": "5244e39b-7a4b-4203-b887-40598e40bf46", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6401ec1c-84b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784605432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605432, "uuid": "ea210545-2c07-4ef9-b29a-5035623ad812", "comment": "Malware payload (Mirai)", "value": "927df5bb8cf28f405f40a6bdb0e8d0ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605432, "uuid": "217ab973-af17-48e7-b3bb-83ac0ffd64ad", "comment": "Malware payload (Mirai)", "value": "f76ea26f6031ebd63e849b1c41bf6a6255d8291e47482617557fd73154ce445f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605432, "uuid": "d94e81c1-b5d7-4193-85ed-a765d92cdef6", "comment": "Malware payload (Mirai)", "value": "b6a46b1086dddad647f980c7ed127b9082033d60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784605432, "uuid": "f5dbde3f-7176-4531-8ed8-24438df688aa", "comment": "Malware payload (Mirai)", "value": "3e95ce18034b84d20b4e40c13717df9cab8bfacc9121755eacda4cbb799ca3a9601312626457c45c75c7f2c16bf036aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605432, "uuid": "1f6f2ad3-734e-42fe-a621-c378fbe6ea4e", "value": "T183E33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605432, "uuid": "de597aa7-6e86-4744-a1d9-3b112bedda00", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdV82J:sqlhEFZBTqPoLmpMguHcUlVUHalw7WgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784605432, "uuid": "12717369-7b20-4a76-971a-e1f7a2982bf9", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784605432, "uuid": "07287885-1396-4526-af31-86ebf752487a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784605432, "uuid": "b27f7448-2df8-4d00-81d5-8341616730ef", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd20a8f-853a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784661981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661981, "uuid": "17665766-fa80-4b76-9e6b-41a9c8e6f055", "comment": "Malware payload", "value": "e115e8a4e076c18eaf69e4fe5d9b9e6c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661981, "uuid": "30be3840-d9fc-4f41-8e21-f0a4ed01feba", "comment": "Malware payload", "value": "f7acfe65513a021e5f0a4f9f21a7e04f02f15261d4acc0971ea04565c4ceac2a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661981, "uuid": "ce3063f3-5bc5-4dfc-9768-bb5cc255884a", "comment": "Malware payload", "value": "e86a4abee801ea512b80897e5d0642a57c87ed1b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784661981, "uuid": "751e8190-f5fd-4f44-904e-e467a41efa59", "comment": "Malware payload", "value": "412f5e290535b35739836a8f16426d9434ac67c88610fbbc60c65a3d4f230cd370a0db96e1ceff2e81543cf656f06969", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784661981, "uuid": "69dbf5fc-2f3d-4b15-849d-1689e40a39a4", "value": "T1BB235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCB3CF68C4A69D9109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784661981, "uuid": "37a18ee8-f3a6-4baf-a9a3-e3becce75271", "value": "768:e+z9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:e+Ucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784661981, "uuid": "6fe8d6e5-726c-4940-83d1-b79a93c32edb", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784661981, "uuid": "a5307570-73ac-4747-b07b-6a6189e11d64", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784661981, "uuid": "c1d2ac01-5e50-4fb4-968a-e8fb74ae1c2e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dceacf-8498-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784592466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592466, "uuid": "eb993801-e99c-4c41-8c16-a3f7e703ce4d", "comment": "Malware payload (Mirai)", "value": "4c098d592658807f5d880fcbac9a9b49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592466, "uuid": "3ce51917-f34e-45d7-b0f9-3a40070a1a4e", "comment": "Malware payload (Mirai)", "value": "f7fc5c3daba8d328b54ee98c69b1e28c78a7f3d7c25485db40f85b6fd49071b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592466, "uuid": "1599b0d8-a8f6-4669-ba5d-88234ec3fd83", "comment": "Malware payload (Mirai)", "value": "382b615aa3e18f7cc7c2c1d1a3c8a36062f378b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784592466, "uuid": "f7cca3b0-9211-4746-9b22-fcfa24d2dd46", "comment": "Malware payload (Mirai)", "value": "17318d1d78c8f6187feeb1250ac1cae08fef09189d350715ca06a17212534dba281590e0d5ba4ee2a648683ee2f074e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592466, "uuid": "e0bebea4-7a28-412f-b7c6-00b527887303", "value": "T10C630902B7044F47E8A31DF0217B17E1D7EAFD9216A4F284720FBA9481B1DB37945E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592466, "uuid": "221dd4b9-d320-4a58-86f2-d7ddab733966", "value": "1536:IEExhPfYX3oXaMlYCgDEGur3znHeQm6AXwte:rcHYzCgDbmDeQm6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784592466, "uuid": "a1625367-f973-4b33-8eee-c6bb6137dc41", "value": 68548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784592466, "uuid": "c481cb90-8945-4236-b20c-a39de114c5a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784592466, "uuid": "499b5502-a81f-4077-8daf-efe12d5886e0", "value": "nullnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b795c72-84cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784614786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614786, "uuid": "dfb55b1f-a000-4502-aee4-aff6e7a52e2b", "comment": "Malware payload", "value": "535ec55dd03c574541c9f6a5266fefad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614786, "uuid": "b568db98-e03c-4d00-a02e-22977df0380e", "comment": "Malware payload", "value": "f808b3e2570a2446b1483274e9aaf0d235580dbeacb2f129d5b52adc745a91a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614786, "uuid": "2a7e932e-9b5e-4d0f-b8cc-2b81cca1d545", "comment": "Malware payload", "value": "e2b318b2e438414f775ed35251e9e72fc2e0d7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784614786, "uuid": "b33c3f88-ada1-4b76-936c-0391ced3e599", "comment": "Malware payload", "value": "d925a0696b788673fba595540c2d692cab80afd834f1e1cf99d283aacdcbe02f607771217c4d783c8870d79d4b10191b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614786, "uuid": "1ab49cec-a435-4557-a129-04c6e25ce4c0", "value": "T12D74F147FEF035E9E12A523D84644A16E736F4BD06348E1F036C426A2F2A6D15E3AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614786, "uuid": "69568f92-ee56-4c0c-ac12-98ff6223c08c", "value": "4297a474b14e3cad25d81fc08ef8b7c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614786, "uuid": "e83e7585-c417-4555-bcd1-d031b4d73e25", "value": "6144:XVzk6qoefnPoDjo4ZYOVKS2bwJz8RmQf0WIiEnm2j7ZvINkn0srBQVkhHdZ:Xu3gDjoOktsORmQf07iSvN0hs/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784614786, "uuid": "f000b699-ec9b-4423-8677-1f407a0981e3", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784614786, "uuid": "5484ecc0-ed26-4b4c-b54d-e01cd36f8220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784614786, "uuid": "baaa39ae-69a8-4374-9a7e-fe17e15184e2", "value": "535ec55dd03c574541c9f6a5266fefad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503601ff-84c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784613129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613129, "uuid": "00b2a1c3-cdbe-42d3-8558-5b84b4628009", "comment": "Malware payload (Efimer)", "value": "04a003540748c7c208e292f3e4244160", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613129, "uuid": "11a791e6-83a1-458a-861e-22b511a94bc9", "comment": "Malware payload (Efimer)", "value": "f83fec41b795f41a4f722a398d81739b36d95f0b1e684b906b76c75318cdd6eb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613129, "uuid": "e0702ef6-3594-44a3-a86b-cfaa1db4aa1b", "comment": "Malware payload (Efimer)", "value": "487dfc90ec4877d96947cffb7958119a367f9b80", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784613129, "uuid": "07c9b951-9798-4e74-b698-5ef9ba4dc643", "comment": "Malware payload (Efimer)", "value": "90f12b809e31d40bc9662de582858aa80e323fd26ed21af7c376ed18525e92f050e990109abfef690c2e8ba99ca2c49c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613129, "uuid": "c1eb01b4-9fa4-464b-8c6b-73c5beb1cb15", "value": "T130E6331C66D002F9E673907EFEE29166D6A6B83E0B31C6DF4AA453A17D570D0093DB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613129, "uuid": "84779d63-54f1-4821-8d24-20809534e27e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613129, "uuid": "0d53f2de-f325-4743-bd5f-1b03165b6ee9", "value": "393216:PUri6jJ6Fk7vvXiB1TrLLxXMCHWUjXjcuI3/PGTAI:PUnjJsk7HifP3xXMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784613129, "uuid": "929a7fc0-1c09-4ee9-8620-45abdc476623", "value": 14290925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784613129, "uuid": "83704c72-47aa-4bb0-8ea1-a3820280c515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784613129, "uuid": "18eb82fc-8917-4f44-9345-ffb072b4a717", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de4b054-84f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784631138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631138, "uuid": "b7c429db-3417-4cc4-9275-b4b27888e60c", "comment": "Malware payload (RemusStealer)", "value": "f3928de3a7dbea514cc6bb330c06d768", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631138, "uuid": "b28ce7a3-b4b6-42a1-b954-2514e2e41cc0", "comment": "Malware payload (RemusStealer)", "value": "f98e46fd4392e8f862317cf7a7ff96f92ddbb8f6399d9ba89f55e34bc131fe89", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631138, "uuid": "5d6f0c2f-232b-4ec0-a97d-38b9553beb8b", "comment": "Malware payload (RemusStealer)", "value": "bb8c037d2e29159ef475cc95ba4ec29b314c7293", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784631138, "uuid": "e00461ed-56c3-482b-bb8a-4aef5eb28380", "comment": "Malware payload (RemusStealer)", "value": "ad777049b96623d8aeb92892b747c13c3eea020af53f4bb64caa63ce619869f4b710ffd26aca8effb996e99efad447c8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631138, "uuid": "0aae8e4b-f925-462f-a909-032360538fb6", "value": "T16CD54A07BC9148F6C099A33189A29656B775BC091B3237D72F90BB382F767D05D3AB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631138, "uuid": "6cc44f99-d860-42aa-9bf6-aadbb4cb553d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631138, "uuid": "b8c4b129-3c3d-44e8-9049-5a72bc08379d", "value": "24576:UpjJBp7eoaGZLseWtH4wnESSlulP1/hESJ80JNgHVn0d4xvAoBele5I9DPKf4x/7:Upjv5eeZgeWtHlE7UF1GSHJNIzyVY4s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784631138, "uuid": "e6bf1fda-75c0-4522-880b-7ca225942c28", "value": 2823528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784631138, "uuid": "42a05ecd-59ac-402f-83ae-d7dffd05a75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784631138, "uuid": "a431b255-035a-4d2f-ac7e-87ee5dd8cf6d", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baef4e41-8499-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784593122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593122, "uuid": "2ee24fb9-82c8-4658-8e71-893914421060", "comment": "Malware payload (Mirai)", "value": "3aaff2095b760ca4d7b751bd41fa1ae0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593122, "uuid": "f5e5d086-5c6c-4cbd-b7ea-fb6075c1456e", "comment": "Malware payload (Mirai)", "value": "f9b929cf16581d825fe88d676b5114e50d1b77daa4488d15ab0e3fd71bfb1796", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593122, "uuid": "cb0fc0db-6c7d-4512-84c3-6d9bf5e52a55", "comment": "Malware payload (Mirai)", "value": "2c742ff117af70367a846f84da68adcac474c4ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784593122, "uuid": "2738e214-27cf-474e-9079-a3072f8c235e", "comment": "Malware payload (Mirai)", "value": "3df94c340e2fe52e1b7c366b5ac898097df7a1a6a2db61d9ad9ac2231896a330d18c889b1c7f7a950257f0aef78fd3bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593122, "uuid": "d282ccff-247a-40c2-92e6-ef7e50a951a2", "value": "T1073112C52B9756D83B7CAE12A98A8B0D534C5ED8A4247B88B5CBCD725DC05C37C08A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593122, "uuid": "bb97fab1-fda9-48a5-9d2d-52e67590474b", "value": "12:SAaZA+dAaZ6nRE+dAaZENNIlvHBA+dAaZtEK3H+dAaZRe+dAaZVHeq+dAaZ2N6Z4:wrGaNIpEKIvnEEkkwBtcE2xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784593122, "uuid": "bd293f15-2a3a-47c2-a20a-1e5191f7bc86", "value": 1761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784593122, "uuid": "dd3d335b-914d-4a5e-bbfc-8ec2cc1e7104", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784593122, "uuid": "c202edb5-c230-4e2e-9acf-ee06a48a4450", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a59bbb6-84c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784610918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610918, "uuid": "d72644fa-ee75-4629-b8b8-4ab93fb32114", "comment": "Malware payload", "value": "1e18b8803dfd73c3bdaeb864cac518cd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610918, "uuid": "29a104c1-7b57-4e64-bdc6-373aa8701f78", "comment": "Malware payload", "value": "fb135ab48d8d8568e3983afbfc70ba4651f77d4e5af89e09e6fb62157bb43eaf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610918, "uuid": "01e93b93-3e17-438b-9fc6-a2a2f1d318e1", "comment": "Malware payload", "value": "30f9dc79b93d60303c388cbdef2c83a287647f7a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784610918, "uuid": "a8b0b512-5816-4bf3-bd29-40572c83bb07", "comment": "Malware payload", "value": "446ebd7e3b7472c77876b89f8d2bae526db55fcf2a3c6328f4e89ffcba37d875fed186832c0e11c0ce8b600e0ace5092", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610918, "uuid": "8be76ceb-6b7b-424e-a99a-72e62e1e0d1a", "value": "T1088285BD9F60F9D45A19162B38E20D447610C077A2AC16BFF9CFB2260F5E5382E9D816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610918, "uuid": "3acd4ec5-e491-4f6e-9f96-c8c1b80f4426", "value": "192:8OYYUVG+nlI31Bv/03msROeczEKskxjp0Ai4DrQCLKDTyo:nUbIbv/2pROeczekFB3QCL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784610918, "uuid": "147f52c9-214d-4437-ac06-4951d23e80bf", "value": 18993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784610918, "uuid": "bc236d7d-5190-4a70-8916-0173c51d44b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784610918, "uuid": "1d6fcef9-2804-430e-b55f-c28181e390dd", "value": "update.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cf87b0-8535-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784659929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659929, "uuid": "85f8f97c-d70d-4cfd-8a68-e1cf3d6d512b", "comment": "Malware payload", "value": "3eb6186b67791934b8e94d9ba5324abd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659929, "uuid": "d97b2820-ad9f-4c77-89cd-151baa15c1a1", "comment": "Malware payload", "value": "fbc50ceb7446e4fca98ef34e5cf46ab650bb41f4abd1b93aa58778abe09155aa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659929, "uuid": "333c651f-7f2e-4d81-87c6-a321cdd15910", "comment": "Malware payload", "value": "26be56d9632f4d36cbd7cf59970a5e45a1c43254", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784659929, "uuid": "4e7c674f-b14d-4b33-802a-6bd8bdb60c42", "comment": "Malware payload", "value": "33a42eff6956b26598691cf5b46cffc3e230eb15e8cfe25cddf7d5d020be4b0411e64be9faf9805e63d8d8c7f8896644", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659929, "uuid": "094be07d-3cba-4e4d-97ec-8cabdf8f77e7", "value": "T12FE63348E5E001FED6F3913CEE724559986970F24B71C6EB5BA8C7A1AE071E18D3C782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659929, "uuid": "0bcceff6-ada3-45af-b20d-0c1a568fedf8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659929, "uuid": "9246fba4-49bb-4966-9fd8-80902225e7da", "value": "393216:3GwgTMT6EFF+ZTx+s6TlHU8jXMCHWUjXZcuI3/PGTAI:3axEFF+Zd+s6TlHU8jXMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784659929, "uuid": "737254db-1e1c-4c5f-8f03-f36b5c0a5e78", "value": 14300526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784659929, "uuid": "9c0b965f-9fb4-48a5-81ed-5a86a207183e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784659929, "uuid": "b041f8ea-1262-463f-8e5b-515770d9855c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6f7fd8-8509-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784640930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640930, "uuid": "78a651ad-dca3-4919-9b44-3bf0958e86c9", "comment": "Malware payload", "value": "1b2cc5599b05ddf407b1407efab60da6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640930, "uuid": "60eb0db0-31b9-4b76-a6e5-c128dcfd8df1", "comment": "Malware payload", "value": "fe13afa397992c572566b4d7dedee115c56b8fa290b1905e72930a0eb7091395", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640930, "uuid": "d0ab71b3-b7ee-400c-b874-b6c87e00b91e", "comment": "Malware payload", "value": "3806739380e6a6115b25995a97382379c2ce06e4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784640930, "uuid": "26111087-cfbf-4ffb-8a08-7e52c64ff49f", "comment": "Malware payload", "value": "f56f9b3a037f5d33641bf4361a8330989459b1777061d4ff8ee4d18a71a7531c72be5b5184dd14171f5c7e0c2c40bac3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640930, "uuid": "2de07e73-f47a-4777-af58-019ca07b7291", "value": "T1B8236D651A857C14AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640930, "uuid": "3f5e84e1-825d-42c6-aa24-966d2521a14c", "value": "768:LXRWNGxVl9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:FlxMcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784640930, "uuid": "cc6a333f-ec25-41ce-a80c-aeac84687c8f", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784640930, "uuid": "efc0db8d-405e-4f9c-9f3e-a87dea1aa2d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784640930, "uuid": "3642bc59-c32b-4036-84bf-5745c67d73f8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88295e7d-8500-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784637275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637275, "uuid": "4d0903da-ee6d-491f-8f99-c4485ae796c1", "comment": "Malware payload", "value": "f5e7a31ac012cb0ea2f7740aadfd6575", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637275, "uuid": "0ccd1e6f-44b6-4a04-9908-0fb657e60b2f", "comment": "Malware payload", "value": "fecc4f4b9c5499d9bf2a65fcbb149a2ee751a183aa92c531d91dbaf79c24157a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637275, "uuid": "42ffe5aa-a014-4ebf-bd2a-3a66818f7ca8", "comment": "Malware payload", "value": "d46f999475dd0584992ed4c37079abb04ed0be84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784637275, "uuid": "000d1506-05e6-412b-a2cd-e5acbc715f4f", "comment": "Malware payload", "value": "7e60c2858bb3c482e12975b31c9cd5a2a3a507284b9d7a2e04c597ea414fce261cd9dfc25d9c0176fb0c06b66253cf01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637275, "uuid": "06ced9b3-c7b0-4a63-b1fa-c931e156c575", "value": "T1C9236C651A857C149A99C4371D7E2F0CB9AD83E6320852DE7FCB3CF28C8AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637275, "uuid": "e7b93d69-bf96-4df9-afc8-7debf5a8b2e1", "value": "768:KVEJVIhtMTA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:wEJ2MBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784637275, "uuid": "c25d11c0-038c-4303-91e3-966d86df329a", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784637275, "uuid": "f3b476c0-703c-4fdb-a687-a1cc18b155d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784637275, "uuid": "1b028d49-0a29-4698-aa6a-22e4dfa3243f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03abade2-84d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784619014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619014, "uuid": "af3ffdde-d1f6-4a3c-9534-6ae9c7b0aa40", "comment": "Malware payload", "value": "50707b2a25b2ef3db39cc4bb819f0c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619014, "uuid": "70a125a0-0d73-441b-bd13-3b457805d137", "comment": "Malware payload", "value": "ff5b4879a98c33c464a16defb7e96776af7698c3bdefc6a282f2f086fd7f6e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619014, "uuid": "bca40484-c27b-44e8-a5b0-6dceb13b408c", "comment": "Malware payload", "value": "8ee7efac7d84765013f2423c4f65faf7159fcacc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619014, "uuid": "209b3473-be40-452b-89d2-ccebb817a45e", "comment": "Malware payload", "value": "3d5a6e9ee34458713d037d4bdedf95a59050372a83212bc8fc832146623cbd9e1672ee37f0f996cd7d1603ae8775b2b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619014, "uuid": "2248d351-72ed-4d0a-b468-c33bc7cf4123", "value": "T197E68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619014, "uuid": "eea85eee-dc30-43e6-9485-4224b7891e53", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQQ:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619014, "uuid": "32d8230f-080b-40e7-bfc7-ca3421daa3a1", "value": 14450688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619014, "uuid": "99e2657f-423d-431f-9087-4d181fe500ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619014, "uuid": "7ad2d305-6dc1-42ae-8167-4a7aff5eb824", "value": "ff5b4879a98c33c464a16defb7e96776af7698c3bdefc6a282f2f086fd7f6e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df55fb54-84d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784619812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619812, "uuid": "fe13b786-180b-41fc-b605-ae03c9c7f3ad", "comment": "Malware payload (Mirai)", "value": "90fee5db66f25432db7de90461f105ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619812, "uuid": "134ed53c-92c0-4e61-9d1a-218d3e9460cc", "comment": "Malware payload (Mirai)", "value": "ff5db5caf6782f99d432fcb8f183fdafb3646319ffda1f0a4dc9d71c8b8ea072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619812, "uuid": "d9002de2-95cb-4d84-909e-e19c16fabe07", "comment": "Malware payload (Mirai)", "value": "edbd8775adbfb4ae147df7bb233dfdd94634b943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784619812, "uuid": "3c600b85-652e-4775-9e60-455ed000f2ad", "comment": "Malware payload (Mirai)", "value": "123611f33ece89065f6f665e687cdf1352df48855b2d428f628650eb6521f1acee5905fb4d872fc3463acd64d4572a91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619812, "uuid": "2c93be5c-e5c4-412e-9dac-ee92879f50ad", "value": "T11903E125F6565D8AEFAF6EB40E0B698333A80F557B828F913840F3409BD7419A60A1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619812, "uuid": "d7f50895-e395-4ec3-a1bc-e35e2798abbc", "value": "768:UEXYoVrNVGrBC/Zzr8vcrEqkPdrvWHtnw56chrC55lz412pWcJ4uVcqgw09+:UEXYoDCCukr3kPd6Htnw8HR4vcJ4u+qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784619812, "uuid": "d88a65d3-3992-45f6-b388-34f77e8690d6", "value": 40164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784619812, "uuid": "b0b29d9e-226e-42ee-98cc-65eb803ff9f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784619812, "uuid": "caf99f7b-abee-41b3-a580-b6d9434fd334", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }