{ "Event": { "published": true, "date": "2026-07-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-25", "timestamp": 1785024181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ee5e92c1-afda-4bb2-b7ba-4e9b8ab9cd7e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d837797f-87f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784962968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962968, "uuid": "31033ea2-3f2b-4489-b498-4e834f59d2c5", "comment": "Malware payload (Mirai)", "value": "497da89ee962fa330a18c8c54c3e0f67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962968, "uuid": "1df71dc1-07d7-46f3-97da-3db9ad0853c4", "comment": "Malware payload (Mirai)", "value": "0013a3f4dae59239c000133f4eaf50e7b741cdc9e9eebf9b728026508572c464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962968, "uuid": "51ca942b-21d9-406d-b0c6-9d3d11f397be", "comment": "Malware payload (Mirai)", "value": "54f4e0869329e7e372ddd08f456345ba13fa6f08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962968, "uuid": "8d5c5034-9924-4c24-bc8e-0ee35c8c0815", "comment": "Malware payload (Mirai)", "value": "afceb25e4a9255644a9ec69d05715a8d2d7d9582eb1e84d0606bcd912ffa428fe76fa5e5fc6ea5ce006c516ada29088f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962968, "uuid": "90aa743e-ac12-4d36-b879-9d6ee3783317", "value": "T1E614855E6A328F7DF268C73447B74A34975D22D627E1DA84E2ACC1041F6434E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962968, "uuid": "c1251a9a-49e9-43df-be7b-9838e9874efe", "value": "3072:wvPDi/i56MvG4jOn9HvJSdzyRZ1IA7pS7jtqjr:wji/i56oG4j6RWyZzdS7pqjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784962968, "uuid": "5874b710-13d8-4c4c-95fe-879a2e9f9dcc", "value": 209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784962968, "uuid": "4179780a-4aab-4f5a-9e5f-73f68353ea85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962968, "uuid": "ce82548a-4b73-4b4d-b0c3-c2304b0d0456", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df9c5b0-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975621, "uuid": "6cc5e688-a695-4eb0-b71f-21d5e6ab5dfe", "comment": "Malware payload", "value": "6eeda6bc4f2b4732ce7f84970b7a444e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975621, "uuid": "437f27f0-5896-4be2-857c-41390969924f", "comment": "Malware payload", "value": "0049f68018f501e28ac8bd7d2f60f1a1fd2cdca995b6b615c21c6deb1e68d407", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975621, "uuid": "d09f0a4f-cfe5-4cab-bf13-e27b5ded0514", "comment": "Malware payload", "value": "ef823e5d06a35737b53420ead8874e25c1beb29f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975621, "uuid": "799c59fb-4475-4538-a659-eeea57524092", "comment": "Malware payload", "value": "e44f9f595733546e4e4af1f5e05c28e0452cff6f591f99f0e750b952abcd1dd4f10bd5799c309de8ea3e18a102124772", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975621, "uuid": "630578dc-1ab7-4cac-9c6c-a8b2c683976d", "value": "T1EAA16DC5C8EC7D5BC1B756F530A80DBFAA1C0D6756A95B0EB860E64A080578FF950097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975621, "uuid": "93e6532c-cf4f-4626-8071-8e41afb1007e", "value": "96:zxAlTOKInqh1KR9Xvg4ob5pslEQfz1u3dSA3:zMOBY1KRVvglbxGA3gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975621, "uuid": "e914bdee-5eda-405f-8ead-1402d696f934", "value": 4868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975621, "uuid": "d0d340b0-ec0c-4873-87a3-77b3f3a5ae59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975621, "uuid": "8ac28245-23d4-43f9-b5ae-2e91a9c81e31", "value": "images_20260725_085716.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f912c08-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972671, "uuid": "24123764-9e51-4056-b15e-3d2e77105891", "comment": "Malware payload (SalatStealer)", "value": "dcfa838bccb8d683e124b106fdb8a75b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972671, "uuid": "196d4ea3-4060-4977-988f-345d54c055f1", "comment": "Malware payload (SalatStealer)", "value": "004ee466e951b32eaf7d0e611050efb1d9f9261c64d69ffc9d8c6a84836fc365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972671, "uuid": "5ace7fe3-b402-4327-aad1-36591653ad56", "comment": "Malware payload (SalatStealer)", "value": "a3a4f47b5f80bf063630354d7f03210bc2ad27ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972671, "uuid": "6013d42d-ca69-4e42-ac1e-0960ab1b809b", "comment": "Malware payload (SalatStealer)", "value": "46ea2ac7499a050a51cada14a101d89ecab7d418da7b38bbd7de4d3a233127ab6bc0072d6190f7d4fc09c953d4285f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972671, "uuid": "0b086d0e-0da3-4d45-bb6a-9ca03380c40c", "value": "T1254733916EF241F1CA5C0A3D059A23312BE616078862EFDF9F2675E61FB01D365738D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972671, "uuid": "d131e9c4-5fb3-423f-b3ed-33cc01fa5b15", "value": "736dc31515b4e24cc548929fe77877e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972671, "uuid": "2b17711f-c8f4-4c48-a447-dc29174bdbde", "value": "786432:DV8GzJqO9QqZXDfuguXZpad3ad3ad3ad3ad3adH:x1UYfhMpccccc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972671, "uuid": "0c2f76ad-7bc0-4dfa-b444-aaff30c6eebd", "value": 25534624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972671, "uuid": "9b49ecfd-3494-4ca6-9911-5834837986cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972671, "uuid": "1cd31393-bbcb-49ee-950e-b84a0da032c2", "value": "004ee466e951b32eaf7d0e611050efb1d9f9261c64d69ffc9d8c6a84836fc365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da15384-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975701, "uuid": "d087a66a-2a68-4280-bb7b-8b2329f49880", "comment": "Malware payload", "value": "4ef89596dafd785a4ad16f3736f20669", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975701, "uuid": "0959fbd5-5598-439f-85ae-cf13c2a5e3ee", "comment": "Malware payload", "value": "0053597eb40b68fdfe49805adf07b36b465e7344a6810a83c8a5d3c859158b6a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975701, "uuid": "aa1c4e95-b013-4eeb-870b-37840b3acd2d", "comment": "Malware payload", "value": "87711ebd13a83d2bc01fe288bf83ea1695fcfcda", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975701, "uuid": "131bbc55-c82a-472e-acd2-bf56b425c194", "comment": "Malware payload", "value": "bcedecfac209c3795043aadd78aff3f94a7ba0c0611e61a34e1115201c3f0f24a011f472b9e221f1d74032deadd45f1f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975701, "uuid": "22095477-e3ef-4481-82a8-fdc6136b56e7", "value": "T1CD62C0513B0870E3EC57F1B4399B5F86B22C35476F93216BCE36ADDC5A603118AF2668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975701, "uuid": "47b71c15-2a53-4f31-8c5f-2621091bf7c2", "value": "384:f/WjUk8RB7ff+dkoC9I5pyAbSUdYf1c/a:f/WjUBRB7ff6/kaLB4c/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975701, "uuid": "359621c2-9596-4aa1-b3a9-ccf8e592fdff", "value": 15603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975701, "uuid": "91380bda-53b5-4da0-97e9-57e03080ec52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975701, "uuid": "9ec03f77-043e-4c79-beeb-f25155afe4d6", "value": "images_20260724_154903.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ff99e7-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972703, "uuid": "ce1b5fb9-8250-4f54-a790-50b66885608d", "comment": "Malware payload (SalatStealer)", "value": "24338d2e35bd0bf40aee61ed5f54b48a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972703, "uuid": "51a623f7-9fee-43da-a0e5-7b0392c68796", "comment": "Malware payload (SalatStealer)", "value": "005fa4606e1c5f4e382a302d5da1a00a8204316848a2fa7e58600b2faa52f12a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972703, "uuid": "d08727b9-02ed-4e51-ac89-c633c61faf5a", "comment": "Malware payload (SalatStealer)", "value": "bb7417b595c0a11330d3fa73a1a252743171b014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972703, "uuid": "99dc07ee-971d-4b8f-bddd-d21f8e492063", "comment": "Malware payload (SalatStealer)", "value": "0a5cd0e7a5a8d0d3784ff8bea9884b94cd5b001bb5d010513b3dff0ec3fc17a58ea8048d68ddc7751aac0f4d0b34f2e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972703, "uuid": "a1729fd2-3dc7-4c13-b307-faed8cc0bfa7", "value": "T138E53378570F9188F61F95F2785C71F84796A11A64DE8F1A0E225B100A3C8FFA1C6B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972703, "uuid": "b1afc8a0-68a9-4af0-98ac-4b78b818c09d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972703, "uuid": "6fba420c-ef14-484d-b309-06eb716ce7f7", "value": "49152:4w/+uU1CaXh7SKpTXk3H44bd6aaH713Ar+h0lhecXflKung7wAxeZ/E0ZDjzTkQ9:4PcWh7N6yILounFRE+jzNHwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972703, "uuid": "e36024c0-2dc2-467c-8fe8-6b3c00aa4f0a", "value": 3292160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972703, "uuid": "a524ec5d-6053-425a-a0cf-a14acf0b8111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972703, "uuid": "17da4448-fe46-446a-b6a0-108366490d02", "value": "005fa4606e1c5f4e382a302d5da1a00a8204316848a2fa7e58600b2faa52f12a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9aaf7a-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972720, "uuid": "84f9858d-c3c0-45b5-8199-ce323f6dfbe1", "comment": "Malware payload (SalatStealer)", "value": "04e0c05f989f7f60892b0c1670dd9ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972720, "uuid": "8bda5660-9601-463b-9fd0-e9da343f279b", "comment": "Malware payload (SalatStealer)", "value": "007256dae6b6239ab6774958cbac6ceae190df52278bc66e18ed05764be811c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972720, "uuid": "1d32bff5-ae78-40f7-83f0-7427ed7641bd", "comment": "Malware payload (SalatStealer)", "value": "643ea8c1b966e2987714187867e2c664ed54e7cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972720, "uuid": "fe8d23d9-902d-4eaa-bb39-46fc83c305d0", "comment": "Malware payload (SalatStealer)", "value": "9230b662722ecac700f71c18dc3d6f2ea41af9714359c53474637358693f1214162f1359c0cfe06a5a1e76baf213679a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972720, "uuid": "efa9d284-6aff-4ec7-9397-28d056fc483d", "value": "T134F533563D6806A0ED5281745EC186C86A9CDFC5EB0B63CDF3A66887F2C353E7242CB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972720, "uuid": "4cba0cfb-f637-4ca7-9048-bacf4e5b5131", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972720, "uuid": "30dbe3d9-f744-414e-982c-49ac68344193", "value": "98304:iI/DY/nw7a4xV+OhOje+pMK6MlsZUkJfAl8wqc:iLwOYV+O0K+9sZBIurc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972720, "uuid": "ac3966ce-932f-4e13-9a64-fbd2489bac72", "value": 3622912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972720, "uuid": "6ee296e1-45a9-485e-b9d4-0d391be40ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972720, "uuid": "5a6c3362-de69-437e-9a4d-bc09851e3500", "value": "007256dae6b6239ab6774958cbac6ceae190df52278bc66e18ed05764be811c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a18c21-87c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784941323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941323, "uuid": "7fb375c7-009e-4071-ad88-a7b8fafecd20", "comment": "Malware payload (Mirai)", "value": "835ac1161aa181b006b88540bb3897a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941323, "uuid": "38a1f2ce-77d7-44e0-a78e-1f54121dc8f4", "comment": "Malware payload (Mirai)", "value": "0084f4881d925ab8d9638e5c66277952a99f2461e3a0cac34cd2bb61d7ca6742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941323, "uuid": "ccd4d1ce-df4d-4a07-b20f-742e1a473c60", "comment": "Malware payload (Mirai)", "value": "44bea756dc9019f51d632b559a8e468dc863f261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941323, "uuid": "7162677a-2d32-44c2-abc4-0178e92b7c68", "comment": "Malware payload (Mirai)", "value": "280c6c69e81d98ad5e16031f54e720841f4e9d5e82db8bd5ba3e2d8363472304f7e681fbc7ba48dd8b773a626e3b86e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941323, "uuid": "a75437ee-860e-4054-8ae1-fa12e1114e93", "value": "T19F733AC9B5C3F8F4EC040A392177EF319E77E13BA129DD8BE7D96623A941342941229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941323, "uuid": "3509628c-9754-4ad9-845b-12dd26dcbb1d", "value": "1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WRouZbqeqVr5x:9Qu3umbutmUl9lIlkeJoT2hJymeMlite", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784941323, "uuid": "f767a1ec-6e5e-4b5b-a1dc-da4f57c6d083", "value": 79600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784941323, "uuid": "329c7939-bb1c-467c-a958-a99bbed9685d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941323, "uuid": "7eb04b24-bdea-4939-8d98-1d1e78273307", "value": "0084f4881d925ab8d9638e5c66277952a99f2461e3a0cac34cd2bb61d7ca6742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cc150f-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972711, "uuid": "ac9e1ad4-caf9-40e8-bdb4-ba136e2623b8", "comment": "Malware payload (SalatStealer)", "value": "154776e2ade2e0ef31b5e2752f30f6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972711, "uuid": "e49e87f0-12ac-4b42-bde5-f8ed8d463c2b", "comment": "Malware payload (SalatStealer)", "value": "00cb8d48f2571613e9bd7e9ef93986009cb5c075a9079f10d274910128f5bd40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972711, "uuid": "1bb9bba4-70bd-4e6c-9a88-9702d1e397ec", "comment": "Malware payload (SalatStealer)", "value": "2546041339221f6fed8ef9e6645b509b1703e1f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972711, "uuid": "6dc72036-78d3-4832-b288-4db0c85c36f1", "comment": "Malware payload (SalatStealer)", "value": "15be4a8e37f33d3ee2f1ed9a7034eb8ebd67c350ebef6b927aa6b180ba245f1d8fc54730f53acc1e669c862df769ba75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972711, "uuid": "ca678e90-173e-4337-95f7-9c1db45f7202", "value": "T15AF5339E8C1E7D99D56B80FA4F1934C3F834DB972E884DA395E6437922AF436840C1BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972711, "uuid": "7db01828-d464-4966-b779-e4ce3810c958", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972711, "uuid": "44dc6703-6606-47d4-a825-5966f90d016c", "value": "98304:utsTgTTBDc9ZkwPlQFA2f9o2mHVuFgM4QURsPMSr:DsdwPlQFA2FodVuz4p4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972711, "uuid": "da78b007-82d8-40c6-86d3-e246e8c10d92", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972711, "uuid": "ace094c4-47f9-4fe9-a791-6d1a1ef3439b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972711, "uuid": "7eec7236-af59-441b-abba-72c0e74f267a", "value": "00cb8d48f2571613e9bd7e9ef93986009cb5c075a9079f10d274910128f5bd40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82d55d0-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972766, "uuid": "fca5e180-ce65-4152-8c28-d9f49018b4c7", "comment": "Malware payload (SalatStealer)", "value": "b570ca54a362a61ad5237681c90e1523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972766, "uuid": "d81a5255-599b-4522-a7b2-ce11eb83c500", "comment": "Malware payload (SalatStealer)", "value": "00dc46d870422064f4f0570db6774034349e5927eb32d0d1b784475d2f77294a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972766, "uuid": "f8280ddd-826d-4b5c-a92c-a3bedbc4cfb4", "comment": "Malware payload (SalatStealer)", "value": "0f775839b75fa9f00a671526912b1f37224c2309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972766, "uuid": "6fcc9d2c-ae45-40d6-b392-29711e6734b9", "comment": "Malware payload (SalatStealer)", "value": "a0b0315565e08cb54a3fe93fc7ae040f36f93345da330d0fd487b696d4e9f95f27b2f2fd122dd2fdb8fdb045b06fb998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972766, "uuid": "0841717a-b477-4194-a0c4-9e82df2713b9", "value": "T16BB63319A1D4FCABE3A2A934C842E71EE6757E349FA0534716B8756C1E3B36C942C703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972766, "uuid": "38235358-7651-42ea-a883-967099d911fd", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972766, "uuid": "818eca3b-9ec3-474f-b9ef-bd9e083c2454", "value": "196608:R5Wt8TapgjwePwgmrFO+WHLeKbvkb9s3SjD+306ZEKgBlUc:m0azuwgmrFFQCKbvkJ+SjyE0ErR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972766, "uuid": "ec8a283f-e384-4827-9ed3-8a22d5dbb613", "value": 11383837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972766, "uuid": "fdeea6d3-ff49-4546-81d2-4a673a790dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972766, "uuid": "81ce8c5e-9d58-44f9-8b53-fe81f81ff60c", "value": "00dc46d870422064f4f0570db6774034349e5927eb32d0d1b784475d2f77294a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b052e55b-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972779, "uuid": "008dae0c-6b61-469e-acd2-1fdf8320178f", "comment": "Malware payload (SalatStealer)", "value": "534e81996c3cc467ac4441170608b58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972779, "uuid": "5e16f58b-74e5-4620-859a-d021b1692a13", "comment": "Malware payload (SalatStealer)", "value": "00e5c871d833b8b97bb7401591044dd92a52c20207e2f693d99e9175c9ef7e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972779, "uuid": "8b1d64b6-3214-44fc-9c97-8e98fc2508d1", "comment": "Malware payload (SalatStealer)", "value": "7efc420a311633cfd04c53d3d6b82c48a961e28f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972779, "uuid": "3f19b68f-a7d0-4dbf-9d62-f36c76253449", "comment": "Malware payload (SalatStealer)", "value": "11f0619d28d67ccbe947547c6a8daf6d0e90079e6e323bc38b453177dd0fa01ca7f509cf8bc4a040b052f5da56157c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972779, "uuid": "23e2bd5b-ef1c-45fd-959a-25834936d11c", "value": "T10CC65B11FADB95F2E903583140ABB37F23315D048B28CB9BEB547B2AF8776A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972779, "uuid": "ec6c47de-b034-49c5-86ed-c03723baefac", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972779, "uuid": "ac942be3-839c-4d83-a85e-32bcbb3ccf54", "value": "49152:/dW5VdWGXvfPaY2m/4dRiLC2CFg/kOEo/+BY14yuRdmNPTa2WXpQOSkj1PSkT91m:g5rP9/4DijCEks8yNtWZZ1ukI4vDEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972779, "uuid": "8b7369eb-82ae-4ae9-8176-461b6745a797", "value": 12573184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972779, "uuid": "eea29486-62cc-4d2f-abe4-e832effa1be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972779, "uuid": "67fff345-ab60-42d9-889c-3b1f61a904fc", "value": "00e5c871d833b8b97bb7401591044dd92a52c20207e2f693d99e9175c9ef7e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad45a03-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972824, "uuid": "fe48cdc1-654e-42b9-afad-e2ecb57829b8", "comment": "Malware payload (SalatStealer)", "value": "abe1f41e3fd3c7e3dbcc986426f694dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972824, "uuid": "cf9a1e5a-9a00-4a2b-a69b-6b8571ff46d8", "comment": "Malware payload (SalatStealer)", "value": "00eca1a382560f46f042bcc2fd972dddca20768d3ec13448f5d43bf5d5f54002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972824, "uuid": "db7e9843-f2ad-4ecb-add0-358b463f3245", "comment": "Malware payload (SalatStealer)", "value": "cdf1bd4877feb374a146ae2015089735672ae3cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972824, "uuid": "0a7676e9-2c74-4f58-b422-21f373f26985", "comment": "Malware payload (SalatStealer)", "value": "698e4867ec206f14447138a2fbe3716557d0c855ad9fcd6d6104275f4c3ed9f95b00d317c508b9905964ce13c3fa1788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972824, "uuid": "1b75478a-1043-4ca4-bda4-556abf21f37e", "value": "T13AF633DCFDD62BBADE930A75142FF3BEC6A16D044016DD2BCB4B9F01A86EB102549D09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972824, "uuid": "c22191c5-bb4c-406f-b92e-32954b789bd3", "value": "c6ce7bbaa9576c5777008f08fe45624b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972824, "uuid": "490f9822-e654-4096-acdb-8b94b8ddb1dc", "value": "393216:OeCBA82tbs90rA0shYbBsS9PXoUKmgnDaWD1DV:O92tBgYbBs2Yrvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972824, "uuid": "d014afb5-9992-4f46-814e-57de962bc1a4", "value": 15960656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972824, "uuid": "a5ace484-9a84-4c13-9db7-74db5aba11f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972824, "uuid": "adf3c9a4-0a11-4b97-8df3-319ae44adce0", "value": "00eca1a382560f46f042bcc2fd972dddca20768d3ec13448f5d43bf5d5f54002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babda0bf-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972797, "uuid": "43e9fdb0-41a1-45a9-a2fb-5af6a2752766", "comment": "Malware payload (SalatStealer)", "value": "e5ca659a13cad28aae3f8494f600d74c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972797, "uuid": "265178d3-3629-43be-b2ef-0228507845f6", "comment": "Malware payload (SalatStealer)", "value": "01b5e2711d157c6aec9a981bd3f74d9153aef5789f3463e3de472e4cf05ca990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972797, "uuid": "7efa4fd6-8462-41e3-9476-0155a0d128e3", "comment": "Malware payload (SalatStealer)", "value": "008d5b3a18717ab342553380be3b4e058e69fa73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972797, "uuid": "d8daa62c-4cd8-4592-8cae-304218aca8cd", "comment": "Malware payload (SalatStealer)", "value": "b88fc00a772fee1fcee99f9949bbf95db9d62de7d2afe8236b857a68bddc5a0095fca44cbfdc314598ffd985f795f000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972797, "uuid": "09a29c87-8b22-49e5-af2c-c7546bc154aa", "value": "T1B1D63304B3D55CEAD6A7583E89A3CD46DBA3781E9731C5DF83E427C11E631D28A39E20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972797, "uuid": "b47f5513-6118-4c30-8fe7-6cf40c15ae34", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972797, "uuid": "0346632a-be89-4eea-b2b6-d4154050fa12", "value": "393216:7eKWW4YVi1Ko0BH85vz5ch1+TtIiW0VQk6c:7eKJpO5vze1QtI27D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972797, "uuid": "b3496109-8358-4fad-8415-9ca0e6346917", "value": 13620816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972797, "uuid": "ee8da3ed-3caa-4208-aa1c-f0bce3537268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972797, "uuid": "bb16d888-545b-4cc3-be16-a0f27ac3d6d2", "value": "01b5e2711d157c6aec9a981bd3f74d9153aef5789f3463e3de472e4cf05ca990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06170974-883d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784993110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993110, "uuid": "28e61949-f7a4-4e7b-a2ac-127f3f0dd525", "comment": "Malware payload", "value": "f1a3e2d69b1603c4fad4f7ca3c0c636f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993110, "uuid": "a7d59856-5621-49e9-a0f3-2ed6c4b80e56", "comment": "Malware payload", "value": "03fbe28952333121819f552dd1b32556bd83fa9400e08946da76c8e759fc7d83", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993110, "uuid": "2457f542-f946-47d6-8304-14c51aa31fa6", "comment": "Malware payload", "value": "3d982b536f2d869e113764bed3027cc3a5b16046", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993110, "uuid": "7118ad5b-13ae-42af-bc09-2e286cb96777", "comment": "Malware payload", "value": "dbe10e6ab52a72c1e9fc036bbb2a61160cafe02c115e463ca8c8c72c91f5f4f3618a7a4ccbfad71dbf9552609f765aec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993110, "uuid": "b533a29f-27d1-4994-a634-642ac8db43b9", "value": "T102C28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993110, "uuid": "db0388a3-cf20-4aad-943f-c6cb50256c73", "value": "768:O8vCB+25j6es8RN69FYpMSUpi+20qUpi+20YQX:O8l25JKd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784993110, "uuid": "64f7fcbf-c4f5-47ca-8740-9637ef10f7b2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784993110, "uuid": "615c8b67-fe84-4ba7-be9b-c8599ce5814d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993110, "uuid": "e8e6329c-8498-458e-8069-e05a7c079462", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14d3fb4-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975358, "uuid": "3f3d183f-ab45-4c95-9b35-5974fabf98e6", "comment": "Malware payload", "value": "9540c1de3bfa58db20579f5f7a10bb84", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975358, "uuid": "8ecdec39-f8a7-4588-84db-4223b9dfb339", "comment": "Malware payload", "value": "0551e4d2d74a6f27c73675a25efa3395bd0a0c6b3ed2cb7c55c2339300698a88", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975358, "uuid": "ca0e71fb-f466-4fab-a1bc-22083c6fb60e", "comment": "Malware payload", "value": "a08628326dac0c92697b06131b056f64198b434f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975358, "uuid": "cb02aa2c-9a0c-4f80-9447-1177e72fe896", "comment": "Malware payload", "value": "3b5aabba27637a580cc8e298ff6806b1fd66d2f47aaff3b3c5a13d5dfd7aad86222800265e87c84fa525d91a7e26a38a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975358, "uuid": "1b336634-9ce0-4a92-835b-3c4e80e6367f", "value": "T15F62D0FD03E3ACBAD5A8187A6456233DE71218B1E48D3FA443BE7608DD0C21089A91DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975358, "uuid": "91db4be6-8944-4395-bb2e-e0528e6bea03", "value": "384:NCoyynsNlMewnVI3sJgfKnaTDg9UgZ7TwmtKJBhm:NyynsvenVIcSyaTYUghGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975358, "uuid": "e7227083-d057-4303-8f05-04a0fe2edc6e", "value": 15043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975358, "uuid": "29ce9017-c329-49ba-95a4-949731e19727", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975358, "uuid": "9dc84e6b-5165-4e7f-b07d-0042f1815bd5", "value": "images_20260725_030940.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7afca0c-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975798, "uuid": "99220c83-895a-49f0-b529-8b442eeb939c", "comment": "Malware payload", "value": "6b5def3c7a1766bb5ad80e2512e0530d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975798, "uuid": "ade2a369-a07b-4e1f-a8dd-fa41e6381536", "comment": "Malware payload", "value": "0553f3b996e73485d6b3e91123a438a2828006cb619ecb4205e48a025f47ea3b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975798, "uuid": "2ce7df53-aa79-4ccb-aeee-b7ebdf92a8b3", "comment": "Malware payload", "value": "1bde4d72c72794b4b4004f78c33451d36ff16f4e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975798, "uuid": "0a3116af-7c9d-4a88-a9c9-3c7a87f8b8fd", "comment": "Malware payload", "value": "1d38fa85151fdf2bb03d874087951770a0df5152357cddae46bc086fcf0b0347458182e9a155b73fa302fc5923ee9b9e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975798, "uuid": "0afc12ef-b15a-48da-ace4-3e5420e9ca5a", "value": "T185029F14D19D4E7BC431BB69706058426DDABCEC20919F07E24C8CE7CACB6B7362E566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975798, "uuid": "74f66268-562a-4d1f-b0bf-4bb4076560b2", "value": "192:h3ZL2LDJucYGRZDv7y44ZCQIM4ab5R/18KlgjyLWXOzjc/u:h3ZxcYGRF7xqqRAGezjcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975798, "uuid": "cf82c32c-b195-46b5-9b1e-20a4d30834c1", "value": 8464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975798, "uuid": "dbe64517-3be7-42e3-bb9c-4565292fb941", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975798, "uuid": "0d4730ad-e6b0-4f79-b6ce-93611b315b6e", "value": "images_20260725_102934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a6ff21-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784981566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981566, "uuid": "37eb0d36-b4aa-4477-b74e-23f2c64dcac8", "comment": "Malware payload (Mirai)", "value": "df39716535e8bbbb24eb5b77b9ca17a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981566, "uuid": "891d0821-651f-4762-9383-fb4d4a67231a", "comment": "Malware payload (Mirai)", "value": "055fe758fb12364dfe789edec50d3f3440804acf22f0500f23f3086b105aa7de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981566, "uuid": "e8a562de-1e35-42d5-8e20-1adb2b3daf17", "comment": "Malware payload (Mirai)", "value": "1040422817a729bc66a46f20cfe3322c49bbff72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981566, "uuid": "5cb288df-f8b0-4f44-a88e-4496bdfdc0eb", "comment": "Malware payload (Mirai)", "value": "99529a172212092eeb19c76cd899039a15bf831fd78c23b19c3975c492a88e9c2e7cf8042329420d407def5dc0de1eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981566, "uuid": "42424f0c-9053-4cd4-b4c5-0bc93573bc54", "value": "T1B8D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981566, "uuid": "08eb063d-eb50-401e-9914-955d82fdbf5e", "value": "3072:5WbCJEcdQ29RHrmP71xmbdspxYNWtrcVhQT4y:5WREQuRHrmjebmo4trkQcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981566, "uuid": "d3a8a1d3-beab-4b0c-ae65-1417fb27d1f0", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981566, "uuid": "afba9ecf-1aca-40f6-94e1-7336d6ab6f82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981566, "uuid": "21de44fc-439c-4beb-ba4d-6544af05a9ff", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78983cc4-87fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784966243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966243, "uuid": "c8d3f834-f573-461c-9bd2-33fd18b6e38f", "comment": "Malware payload (RemcosRAT)", "value": "9dec2bad8e0c0e050dd1452dfaf2cfad", "object_relation": "md5", "Tag": [ { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966243, "uuid": "1d39fefd-c3c8-4c08-9a41-b688906a0cce", "comment": "Malware payload (RemcosRAT)", "value": "05ab5b9587ad208c856d958cefe07c52b12925535cc7abe1d660216594c7a913", "object_relation": "sha256", "Tag": [ { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966243, "uuid": "114c10ed-6d99-4914-a521-cf2fad1d66a7", "comment": "Malware payload (RemcosRAT)", "value": "b03d0177b5fad2eae61b0fa0294c958b31aebab8", "object_relation": "sha1", "Tag": [ { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966243, "uuid": "374d5142-eb09-418e-9375-7ecc6ff6b201", "comment": "Malware payload (RemcosRAT)", "value": "a51d9bae16673268bf5c366d2094499612ec15bcca69b5d5377ed1bfb90661b2e5eeba23a4363883f183ae47a78700ec", "object_relation": "sha3-384", "Tag": [ { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966243, "uuid": "d1f55d24-3649-4e27-86d7-1fa9bb0267cc", "value": "T1F7A423C977B51681F9EEA0889BC95F9DB2CD0C3D7D70486248C8A8E0B6596F7E4320B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966243, "uuid": "a5651926-b1b5-431a-97ae-d89898dc234a", "value": "12288:QPFFESQ09TSP3Pbu8CVOe74J+c8vwzrioy9Yy9BD7teJx3Rn:QfQ0R2zu8Co+c8vw6oUTOJx3Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966243, "uuid": "2b7b5d1c-9569-4475-8b60-96708b1d3f70", "value": 491746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966243, "uuid": "27af75ea-fa5a-4f01-9694-b1b7f0b21a63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966243, "uuid": "1d02cb2b-19aa-48e0-ae92-3433d5dd82e8", "value": "FINAL SHIPPING DOC# INVOICE#PACKING LIST# BILLING OF LADING(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad59506d-882a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784985230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985230, "uuid": "4d72c12b-7fa6-41c7-b7ff-e2b096816863", "comment": "Malware payload", "value": "a2bdea7c0d790cae048f7df7f7e5f466", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985230, "uuid": "ed83c02a-756f-4c8f-bd3e-5c3fa8776dcc", "comment": "Malware payload", "value": "06852ad0535a3a331176b7a15cb37e78745a6d75007ded0475272fc3a2bcba14", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985230, "uuid": "d55aa80b-9d92-469b-b994-cee30a06d1de", "comment": "Malware payload", "value": "ee5d08a7f89cf556fe250ba501e134b6286c22fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985230, "uuid": "9926acc2-69ca-44be-bffd-76466d0af1a0", "comment": "Malware payload", "value": "5d77d15062ba0c204d14c27e87ebab3d8c226c6b4584b086e67c003eec979e302876b2134074303246059d63852d0671", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985230, "uuid": "7bd69460-828f-487d-be5a-4aa7cd6c894a", "value": "T19D136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985230, "uuid": "b9f2a575-b124-4f98-be2f-d2ff47cc2843", "value": "768:YXRWNGxVW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:MlxNco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784985230, "uuid": "83462a36-c7c9-4563-a198-830ebe29631d", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784985230, "uuid": "228f8dc9-9435-4aba-9b7b-6ddd7f4d5291", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985230, "uuid": "bd71d17a-9482-49ba-82f8-758fd2a5d647", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305348a4-8837-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784990604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990604, "uuid": "a52b2b59-b5e7-4df8-8f17-d1e7155c5735", "comment": "Malware payload (SalatStealer)", "value": "b67c8964f2cfa9ed322d586d8ba8089b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990604, "uuid": "cab0494e-7b1b-4d61-8fd3-75cfc22d49f6", "comment": "Malware payload (SalatStealer)", "value": "0696fd2ed2a522cd1ed53e2a99adae2c79db3ffc993c20155d936f355698f485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990604, "uuid": "313ebda1-4a24-4408-b738-1ea1aa3e2be5", "comment": "Malware payload (SalatStealer)", "value": "689721272659366fd6530e584e885d928fdc8677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990604, "uuid": "052a043d-d6c0-494b-90c1-0a0d317fc975", "comment": "Malware payload (SalatStealer)", "value": "a0bdcfae32bde195a2dadaf6a7a7c7f451199fa066de40d2bbde386ce165fb10e2ad5acda10d96d99c8f80ce39a663ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990604, "uuid": "4573d3e3-563e-4d56-a958-79e7f6e77d5f", "value": "T18DC6BE07ED6915E9C1ADD13589639262BF717C885B3123D32B90F2293F76BD0AEB9340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990604, "uuid": "8f0360d7-2bf1-486c-bc56-1c8cdc59a901", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990604, "uuid": "5cbc1030-9581-4b34-b30d-a726eb875685", "value": "196608:SZpZcB8x0XaLuspHJvr+0VDn8VorsdxJHx:SzZcYOaLbHty0nvA5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784990604, "uuid": "2e7a7468-e4f2-4752-a7c9-fec2c186695e", "value": 11844440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784990604, "uuid": "e396a689-17a8-46e2-928b-56dbb51ca8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990604, "uuid": "edb9a643-95ca-4f05-ad29-abd2404a2b06", "value": "Setup-BjZKjHEFFwNynaFL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd2e10c-880e-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784973148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973148, "uuid": "7a67e592-a09c-40cd-8cf0-ecf54fc158fb", "comment": "Malware payload (SilentNet)", "value": "cf8a618ca474e307258e5684f7ff5883", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973148, "uuid": "3e0aa863-aef8-4a23-ab4a-c7bf6c3ba798", "comment": "Malware payload (SilentNet)", "value": "07184fbac051fa466bef99d386ae177da9ed3d50e879683c8425609f42e304e6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973148, "uuid": "e8038040-4482-424b-aa9d-8ae2bb0dcaf0", "comment": "Malware payload (SilentNet)", "value": "7136abbf5c3f29274aa5487e346ff75d04e18f95", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973148, "uuid": "cc846afb-13e1-4931-a3f6-67ede4fa3bd1", "comment": "Malware payload (SilentNet)", "value": "0bc9ca5ba1574baeb049701f912be3a86f00a5af618a194aa98a2fc71236f738c53a48041a31f1a501153f76c9454547", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973148, "uuid": "e232eb09-a68a-4926-ae9f-395ee6cf005c", "value": "T10B94238134B1023DF082157BA5CA9273CB0B6809EEA65763DFAF407F6F36D80B919D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973148, "uuid": "bf903fd0-4359-4dde-8658-5d6d1f88a961", "value": "12288:iYrXrzryyWigvPeXr/dBTBN4hP5K/yzmq3rwBIHJm:zHryytgOX5qKynrNHJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973148, "uuid": "60063510-2130-439c-9825-1dbb6cbc7b49", "value": 416414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973148, "uuid": "cc2c443b-74f5-40c2-9f29-e2aa7224dceb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973148, "uuid": "1db42f74-6a62-4ae4-878c-8cd3d7b32e9d", "value": "Krypton-Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d0962a-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975304, "uuid": "d2d1ad3b-eed6-4b19-9fe7-6312f849ddd4", "comment": "Malware payload", "value": "dc1d41f8a47a978dc2392be4f8dbf0e3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975304, "uuid": "c6a32823-2a31-462b-ac6d-e1e846e172c2", "comment": "Malware payload", "value": "0737f37e7906395ef64a029fc5c59788b4e9ea142d212ab1f33de9cffa2f4297", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975304, "uuid": "ea1bf1c8-3291-4a27-8540-d5e0588582ba", "comment": "Malware payload", "value": "b4c11876e3cfc216da794309246689aeb32f8a63", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975304, "uuid": "930ce478-ae2d-4863-92b0-342f872560af", "comment": "Malware payload", "value": "41b57cfc212dd5b93b6db8f67f24636a8de81796ac1ae106fd3e567c67d23701425bdbd638dabf66f5b7396157994aab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975304, "uuid": "188c842c-9a8e-4f5f-8163-7c25e944aa87", "value": "T1D472D135C25B613B88F67976B8272FB4D05B0D46B02ADCF1F518F2885C28203AB18E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975304, "uuid": "998a2bee-6a34-43b4-9e12-137eb15f3784", "value": "384:36rwyoZvg9Q3rYqOUBTNzcI57TvMPZxRTTkims84pVuV5B:36rwyoeQb1VCI57Twgxs84OV5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975304, "uuid": "a356731b-fb1d-40e3-a547-101e9412002a", "value": 17045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975304, "uuid": "883b2527-c573-43fc-b27d-696478c910e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975304, "uuid": "5d4ff2d7-cb60-4b7d-be74-abd7feb607b5", "value": "images_20260724_180455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a89bf61-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975159, "uuid": "b49c1c7f-77a6-4ce8-a098-259584a2f7d3", "comment": "Malware payload", "value": "50e90bc3eb0c539496cc129cb5ab93d1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975159, "uuid": "554d596c-1d65-4e60-94e3-db075084657d", "comment": "Malware payload", "value": "07ac073adc713327eb4b3948d0824aace99771051aa3f94d951bc9942d08f653", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975159, "uuid": "8fb98c78-c92f-4de8-9c87-af4e47e4cc9d", "comment": "Malware payload", "value": "152e57ccfcdbe3b80049eaa9f50f9b14512bec4e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975159, "uuid": "ea0a1764-7043-4003-a48a-b2a2d49e1f73", "comment": "Malware payload", "value": "537d4cc4d76faeb34e1fdc0bf4e8d2f8af396ce0d8705ed922c2da4efea1146bb5ce752ba654b62e339252b9d3ac8954", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975159, "uuid": "57680fea-5d7c-4c42-b0b8-4dd7fe2e80f6", "value": "T11072E1B2BC5124C9AD7325FAA4319EB994981DFA33C358C1DE168F2FB4744738C25583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975159, "uuid": "4b353d06-7ae4-4591-a6a1-6a0555aa7d9a", "value": "384:5uztm3E6k15LjfXlGseyFZ7+h5Y0m+WC520Lp:uhhXlfAWCrLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975159, "uuid": "c4ef879a-ba17-4abb-b944-a1e429c7ce93", "value": 16204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975159, "uuid": "f2285db6-ed38-481b-8c44-3cf46f0aa64e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975159, "uuid": "7fd171bc-9132-402d-8193-f33aeff78347", "value": "images_20260724_133807.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a093a83-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784973843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973843, "uuid": "cb1e01e2-1e7d-475d-b854-b38247c7005a", "comment": "Malware payload (SalatStealer)", "value": "11b0e224ad2108cc24be3918299c2c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973843, "uuid": "43589999-fed6-4486-ad12-d32568797c83", "comment": "Malware payload (SalatStealer)", "value": "08161e05c4971e5a566f534a6690cbf8a42470744855524834bd510b6229c172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973843, "uuid": "302a2a64-22b6-4a4f-9108-bd7c9b099170", "comment": "Malware payload (SalatStealer)", "value": "54b0598d70827bcb1204454561f139a07a5aebfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973843, "uuid": "19bac565-71f9-4d5c-a7a0-9a84800c1cce", "comment": "Malware payload (SalatStealer)", "value": "dfac390ca6bf6e6a8fda4b6630e72d260a802d3a53c5300430ce087f2f331bf9092e31028121ec154f45abd77b339a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973843, "uuid": "00e16625-a82c-43e2-8b03-5afe8a2789d9", "value": "T1C2C65B01FA8B65F6E9035831415BB27F23315D048B28DBDBEB583F2AFC776A1183A645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973843, "uuid": "7c348f19-7d43-4639-a8eb-192197f809d4", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973843, "uuid": "f79808a0-d7e6-498f-99ba-7fb096300f2a", "value": "49152:GXxLFxcRUsGTfTS5L4j2mWSqm/W1sDBKBkQfImdU3c7RAb1vLvktHN63a2jjun9J:SFSRUs6j2h8/uYKAb1o6wE4qrNnEo/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973843, "uuid": "38796753-3735-424e-abfc-c3e38a4ac5a3", "value": 12543488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973843, "uuid": "7fc9fdca-df18-460f-9a18-58bc73f67964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973843, "uuid": "bdc998a2-1d0b-414b-9213-a0b72dc42039", "value": "877901a58750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9810dba9-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974027, "uuid": "453c612f-4624-41f6-b633-13800ceff934", "comment": "Malware payload", "value": "a222de9d3c4190b3123108fde95c90e5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974027, "uuid": "0fb1cf6a-c4ae-4554-8aee-9b4e1127fe1c", "comment": "Malware payload", "value": "08ea5fb9dcba73ecdae3f2be5f65699b54b884d7a8ce6761df987776cbebf221", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974027, "uuid": "88e23516-5950-466d-9da3-935a9cbc1411", "comment": "Malware payload", "value": "5a28b07451e0815abcfee47b2f83aa34ee428998", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974027, "uuid": "d3585a3d-934f-4a0a-9c4f-60f19e11d1a3", "comment": "Malware payload", "value": "f0f1113b1817cb84382b9bc5f69fef53af31e77272db77609d6df181535a0a4badb9f3e9c3ef7b9518e4d2924255ceb0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974027, "uuid": "04b3130e-2c3a-44a0-9c9d-ce4dae03ae4e", "value": "T1ED06BE4AF7489B6AC0F3923A0C355A62521B4CA68F43D7837D64773C48BB9D01F5AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974027, "uuid": "60400e54-39c0-45b8-9e3e-5629136faf29", "value": "98304:f1ij3XV8bh7E5LxToAVjHOI+whGk3GDcwHB:fzGRt/hWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974027, "uuid": "6c49ba46-4f8e-4799-bd53-fd728c79a5c7", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974027, "uuid": "5ed569d8-4132-4b56-aacc-35749d5b75c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974027, "uuid": "a6f986b4-4189-4c1a-826c-deda15f3ac5c", "value": "variant_18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b926520a-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975371, "uuid": "1f0931ff-d4f0-416c-981f-f1d3855eae8c", "comment": "Malware payload", "value": "186db9baf39801d45997602ca2cde38d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975371, "uuid": "bafb1cfd-5b7b-4a3e-a13e-251b94635c44", "comment": "Malware payload", "value": "098c5c3943e6465e3698b4c34b6e606069003db1a413ca322f2615dfd7c2ff46", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975371, "uuid": "8520619e-67be-47e1-9e8a-18c12025795d", "comment": "Malware payload", "value": "2f0ed2aff3d9fee509e019c95dd3f7b2593c91eb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975371, "uuid": "a9d8d58b-fb20-46bc-970b-40eaa054cc4c", "comment": "Malware payload", "value": "1f828784eb51f9cff8586ceb2b18218101e3b82ee51d75217cf61d251ed947ec2eaaf3d2f82bc5430fd038d82a8d3d69", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975371, "uuid": "60e912d3-329c-49bd-9624-c847a746c50c", "value": "T19A42BF91837D0796D8C695F614AE3A2C7A50D752B061732C643BB0427EAE2CB44EFE4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975371, "uuid": "d6ba333b-ca2d-4638-b42e-8d33cc4ee57b", "value": "192:0N7lluJ6cvxc92gbjjj/0GG7uUp6hqEGkL8JpnOxuHf3nJxr4DOvWyBxx5ltZ/D:0NJbc5O2gHH/Go+E6OxuXrFW0xx5nZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975371, "uuid": "931f08af-8caf-430f-b715-6c89d1c78981", "value": 12098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975371, "uuid": "e6f1d656-7533-4458-96ff-7186b2745010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975371, "uuid": "4a3145cf-e4e6-4a79-b1f7-e02a43f1c1f3", "value": "images_20260724_193355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d11f3db-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974009, "uuid": "0f8d170d-0c8a-4da9-8ee5-9ea258676372", "comment": "Malware payload", "value": "b8ef3d07f169f2c2661ea58d4dba6ef3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974009, "uuid": "a0febd1a-462a-4662-8496-51b0b9624b3f", "comment": "Malware payload", "value": "0a13c4120719d0a487f5d87f907d777afc0c65280c4f057c880bb92e3dab2219", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974009, "uuid": "6c2c548c-4f63-435b-9f26-52026b4377c5", "comment": "Malware payload", "value": "def0294868f9fb857bc9dcb7be5a8a4a464f8d54", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974009, "uuid": "1a0afb3a-f1dd-4e7d-bf55-065f60703e94", "comment": "Malware payload", "value": "ac9c780580787e65d0dd7597b20eb603583ddfabf20288e7d961aa3094e7434350f7f2034e5a12678a05129de8cb4899", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974009, "uuid": "3cc96d60-1f95-405c-b9e3-bc3377f65f23", "value": "T13F06BE4AFB489B6AC0F3523A0D355A65414B8CA68F83D7837D64773C48BB9D01F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974009, "uuid": "0d921e7e-e57d-474f-ab42-8800c849514c", "value": "98304:Q1ij3XVfyeCEhIhT6ID9xgxLkG437zz2Fkjv:Q4RO1LgVkNzz2Fkjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974009, "uuid": "ff646761-a0b3-439d-ac50-8ee287db7b57", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974009, "uuid": "93c93cdc-bac7-4c4b-ad31-56615127b138", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974009, "uuid": "2e534599-df51-4015-9355-16d427a3cc71", "value": "variant_16.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df30d08-8861-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785008773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008773, "uuid": "2c234450-d185-44b1-9293-bec84a8b0b1d", "comment": "Malware payload", "value": "fc96309caf93421f63c646c5b94194d5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008773, "uuid": "4e2782b0-b5c1-4e32-b1fa-c13c25a4d963", "comment": "Malware payload", "value": "0aa8796ec42231ee70586d3d48c7271bad38377c208fbbbfad578f6eef04313d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008773, "uuid": "cb77feba-9850-452c-8da2-315af2d1226e", "comment": "Malware payload", "value": "b6de0cd902523e50da8c248935d83b1f31135835", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008773, "uuid": "a2766b47-5f19-4fdc-9273-7616115cd080", "comment": "Malware payload", "value": "8080369d5a3c23e2cf3c6458f20de273a81b148972f6b9d38c376ee8d039d2acabb9ff45d4b6739328197d93b8ccd8ee", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008773, "uuid": "783fa7ea-c129-4745-b74e-61d977ea4273", "value": "T1F2B6332345E5CF3F9F2E2C1C964E465D75BA8A9FB091D320CB6A9A4624DDA0CD4321FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008773, "uuid": "3c213b7e-7e62-49f5-beaa-2975b670b3c4", "value": "196608:JIs1tRMNHL5V5yn3E6Ywo8aQZeolG9+5xru8xwGxtNrHPHBIhpI93hGAwIjZ:D7GHFan06Yr8hUQGMru8t98C3hJw2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785008773, "uuid": "71d5d812-3bd7-48d0-a928-8052dac2b744", "value": 10683732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785008773, "uuid": "9714dc65-a7ea-435b-90c0-dc2146fcfd0f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008773, "uuid": "466c6839-d5c6-4946-bc94-404750eccec2", "value": "Loader.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fac0589-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784979462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979462, "uuid": "bd95fa4e-fdc1-4e10-a669-6eb395092b04", "comment": "Malware payload (Mirai)", "value": "d607a06919e5996eef974fa327bc0487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979462, "uuid": "01ad69b7-5296-4a9b-a027-c680f28bb5a4", "comment": "Malware payload (Mirai)", "value": "0b4fd6e044d08527e8e5ca38f5cc7b77b131647e7bff76c64bfe67bf333a09f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979462, "uuid": "20414dcb-8fbe-4433-a3d7-6ef1487d62d5", "comment": "Malware payload (Mirai)", "value": "e5fc1bdc002f623c7c5375da0a6d417e2235379c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979462, "uuid": "b2b64763-bb46-40a7-a124-df608fe9f00a", "comment": "Malware payload (Mirai)", "value": "e26ca40da53dc35fb76ddf74e6f5c7a828df0349419f3560716ec991577fc50688bcf09e1ce18bb913dc10abb927f523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979462, "uuid": "27bc657c-326e-48ec-a46a-78fadffc94ae", "value": "T12B73D70AEF510EFBD86FDE3705A90B0235CC954722B83B7A3574D92CB15A54B4AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979462, "uuid": "e21ae8a7-fb7e-4ee5-ae2d-2b016c59d7e7", "value": "1536:2dgpPukJwJ1xSlEqjqPhdhN6SPRR4Ibw0AzDOs80RBY:2dgpPblvjq9DHnsZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979462, "uuid": "23704d20-f4d2-4fd3-bdf3-8a428648c33a", "value": 76536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979462, "uuid": "7f2ccdc6-0d18-4d50-a8fb-c30d5f02a15e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979462, "uuid": "338a74b7-5c90-4a02-a82f-ad0cfc57e4d7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79602e8d-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974835, "uuid": "6bab5b51-0a84-48a9-8cdd-b15099919b60", "comment": "Malware payload", "value": "e9f9771b0cbeb0450ae73787777daaa2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974835, "uuid": "02a712cc-6863-464f-b798-ec6e7f440ec4", "comment": "Malware payload", "value": "0c2e20e4306bbf0fdb1c0803ea7e61d5066559adde11a217591c46498fc0bdb4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974835, "uuid": "d849718d-ef5a-4c60-9683-e70ab6d462f9", "comment": "Malware payload", "value": "6301a47225320ed0af5fce96405219a0e498ddb2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974835, "uuid": "4f0c5f35-cecd-41ec-977c-d9b4e7a4352b", "comment": "Malware payload", "value": "286fecdd6476a825b8ec3d7c06741e18ea03397ebd04ba7be4d96a11f1c343909e8f025ff6f4f30685c3492eab6b654d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974835, "uuid": "cf6117af-ee4c-48ff-a47f-20ee69260f12", "value": "T1AD02B06401AF40C7C46EEA371BACDC5263BD98A7D7B218133B5560D3F647414E613F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974835, "uuid": "2fe289e9-79b3-4602-ace7-abb0f8b9ae61", "value": "192:oyeDk+kpZqmo8qNoB85zlykHkbVuw4buvvulQs:oyeDk+kpZqJiB85JHkwwXMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974835, "uuid": "ab79a4f9-c008-403a-a26f-175381fc50d6", "value": 8312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974835, "uuid": "01d667aa-4ffd-42ce-a56b-5127b7f53aa2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974835, "uuid": "ebb361b1-8568-4b97-832f-71fa7a70092a", "value": "images_20260725_085225.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cf54ad-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975790, "uuid": "c83b70ee-7746-4a3f-97c0-65eb2643f801", "comment": "Malware payload", "value": "a9c9a64a0537e0c68da680022554028d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975790, "uuid": "8a57bc9e-045e-4667-89d7-292bbcf474e6", "comment": "Malware payload", "value": "0c5d61e5672e8a185e2d5f154436814af404fb4a631014dc2ba30af0a2e951cf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975790, "uuid": "405a6d43-1187-4f6d-a80e-8800b659ec1f", "comment": "Malware payload", "value": "8a1727b74391219d771c8affe7d0261606806cfa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975790, "uuid": "406c24ea-92f7-4b63-b572-e4c92e36da73", "comment": "Malware payload", "value": "d272da9a511251b8442c243eb423bebc7a039467470a4f69d2025c1226e93d00dcdec25b2ec167edee3861dad45db82c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975790, "uuid": "ae794ed4-b490-410e-b940-196d52fb02d3", "value": "T171B16CABCBA3C26967492BBDA4D305981F3AFA1C52976003077AC5FE8D274C29D167C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975790, "uuid": "5dcb8b18-9bfb-4f9d-9d2b-fc2465f08663", "value": "96:Ph9yaNgqxwTI9+kfWZOoCHxCQtDwsBcTR1W5rMHAfPcYq+QkTs6SqcSAL:Zp6TIQkGMRCQtDwsBcTysAHfC5acRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975790, "uuid": "f771a30a-d72b-4e19-9e18-f469d4cb1984", "value": 5410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975790, "uuid": "509e3efc-f81c-45b9-ac15-1f4ff58ddadf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975790, "uuid": "815cb64a-d305-44fc-8e0d-891361d8b315", "value": "images_20260725_022921.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d6bd3d-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973973, "uuid": "b33dd03b-87be-4947-9762-5e5dcf236912", "comment": "Malware payload", "value": "becbdf82f502f01f515ebb24a85d4237", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973973, "uuid": "5249fd3d-916b-49bc-bad9-f41eb53adba8", "comment": "Malware payload", "value": "0ca219d3094181a696ba6954721f4cc5a5cde5118dd952c90afa6b73ddeb48a3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973973, "uuid": "fdc75309-0add-4a2b-a93c-f502f0095b10", "comment": "Malware payload", "value": "a89124826c8d916c06874706430d751ca5dd8f6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973973, "uuid": "3df6055a-45a9-423b-8c5b-b5daa4138a00", "comment": "Malware payload", "value": "3ecc0a938722ac6eac61a20c83fe48f8b764d558cdd92fd1b89a24b805e321707aca323db6d12db3964fade920ce7b75", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973973, "uuid": "b612a660-b350-439c-8d79-94733560f15c", "value": "T17406BE4AFB449A6BC0F352360D355A62415B8CA68F83D787BD24773C48BB9C01F5AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973973, "uuid": "63284eae-9fac-4434-90ec-187fc7d94249", "value": "49152:Q7HX1ij3XV2lrVE7NFRk0QhFaTX/Of8XetBHrAoSpGbC+Ynmc5wo22B3iEgjZg6s:e1ij3XV2lrVERAYTyiCjSs1c53iK6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973973, "uuid": "459edf23-9db7-4425-b8ca-4b24e046668a", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973973, "uuid": "c3d7e8b9-3c7f-480f-adb2-ff0baea1ff33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973973, "uuid": "aaca902d-74a9-4518-9e5d-f3188d7186b9", "value": "variant_11.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3350b30c-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974717, "uuid": "a106b54d-3093-48b8-92be-3bfb021445ac", "comment": "Malware payload", "value": "42806720823d783fdab911e516af3940", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974717, "uuid": "4bbe4dc4-5186-44c0-8019-5d47c19cf645", "comment": "Malware payload", "value": "0cf97ad454bfc4178b32a86a1e9c81fc3f816fad224c14ce824991228680227d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974717, "uuid": "2b2e4c51-edaf-4876-bf7b-af7a1bc7e377", "comment": "Malware payload", "value": "8aa6c93326f2a875a89181814d28357d62f26113", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974717, "uuid": "9a9be79a-dc53-4c28-8f88-cb4e89b307df", "comment": "Malware payload", "value": "40c7b2bffb986fa21a5cfa04a4998fb7c9390d6f0874c57e95f94ff5f190e0e93fc26d3f9e7dad216d1b9b234eace5d7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974717, "uuid": "24d04989-a330-480c-8888-4bd85e5df091", "value": "T1FE12B041B530A40A887C655EDB0B9312891DBA676A5EEE1C843F1CCDE1C23533976493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974717, "uuid": "c4b8ab00-21d2-4417-bba5-5ecd2e19b581", "value": "192:6EHSy8WwQ8SZAE4W6VOUgRxo+wpfcOcrKEptDC1F38i1bfG:Jbw5CARWeO1xo+Gk5OM2sSbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974717, "uuid": "cb57b601-6397-464a-81d8-9257659ebe67", "value": 9785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974717, "uuid": "42174bf7-76b9-4292-bc18-11bb7b45802e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974717, "uuid": "e639cf7c-d77d-4c2f-8d49-ba17a05ada88", "value": "images_20260724_155139.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3dae10-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975319, "uuid": "a730dbf4-7105-4439-90f6-db530bb5bdbe", "comment": "Malware payload", "value": "5072b2614127fd2d29bc56cebd89f5d1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975319, "uuid": "4ac27e4b-e706-4688-b1f2-e29ece3b2736", "comment": "Malware payload", "value": "10204bfb9bb2c033bdcd770ae13df9fcecef64a01f578b58dcb7ce73adb5da7f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975319, "uuid": "6043ff34-e0ba-435b-8eac-e06fa5850012", "comment": "Malware payload", "value": "e07ffa8a6abf3e499104c82a151273141d1908e1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975319, "uuid": "7636bcaf-de72-4e31-9dc9-6064f4cc9f9c", "comment": "Malware payload", "value": "5a89300e614f386bf6d8623730bd77e6fe0ff16dcf1398e75bf340287d97042dd81b0b6963488528b13fbd1d4dff87d8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975319, "uuid": "582899f1-1e79-4ff5-ba96-5b5f84e9b19c", "value": "T10B62D19AC318E7818EF1A639B6F06F2C7FC82E1C1C5DC5D994BA8209521F345C6CA884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975319, "uuid": "685d6672-2a78-4225-a11a-aca14c7e28c7", "value": "384:mxhhKXYL5LvBZ5QvplT+PIntKd1T38zDw9MgRh32Ct+WJd+:OBL/5ehbnUDWw9MQ3Tfd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975319, "uuid": "22d8e90f-a447-43ea-9d72-dea344d9baac", "value": 14684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975319, "uuid": "f1f6a393-5dd0-45cb-a1b8-5f101f6725ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975319, "uuid": "50f839ef-3261-4f6f-9b32-1d747f7fa8a9", "value": "images_20260724_183826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bf9f2b-87fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784965964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965964, "uuid": "9ac00b48-c33e-4827-8f08-461a8d813613", "comment": "Malware payload (Mirai)", "value": "c431717a478699719132884aeaef658d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965964, "uuid": "fc039c6c-d30e-4524-811b-961bf6fa9a1b", "comment": "Malware payload (Mirai)", "value": "10e7e57e903d87c3362e692e8a78b0e3df820464863867b3340ebe8e24508832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965964, "uuid": "fa6444a6-76bb-471d-993f-be82859711dd", "comment": "Malware payload (Mirai)", "value": "c422a4a3cc7c655e0c42a472f6a958efd23e4379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965964, "uuid": "077f2037-3ac7-4bec-86c1-bf0387f1adca", "comment": "Malware payload (Mirai)", "value": "fa784a64bb06aa0ebb0c423970d3133ece27b89e6788da23fe2ba4603f3b506fa51fd986f1fc7feedcb3de2329a41db6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965964, "uuid": "f63f2096-c3f2-4b74-aa61-1a06ad874dfd", "value": "T1F30429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965964, "uuid": "65385a6f-1ea1-4e19-a8cd-1632d4b09df6", "value": "3072:T5zb+mVmSyJtrlNcilf0KUylCKHB4TakGDP2RVBv4mBVpjbiLLsepqBOKb:cSkTQylFHB4TzGDy14m+LvSOKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784965964, "uuid": "efcca57d-e264-44d7-8091-33ae98864b63", "value": 182244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784965964, "uuid": "0012de83-3c72-464a-9f99-a6f5d6f749c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965964, "uuid": "92876153-e749-47f7-8985-659c3f81c6ee", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba8eff4-8825-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784983187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983187, "uuid": "1b5a7e5f-0d72-44c4-b343-816c7d740b91", "comment": "Malware payload (Mirai)", "value": "2a2e290fbd4c196cce6d6c4fa2c776b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983187, "uuid": "dc1a4ad5-1fe7-4887-af7c-023a4e6a66e9", "comment": "Malware payload (Mirai)", "value": "11b25298b460ef047e28ea94f036bb70988ffb4bc3ffcd100e947fcb89de5a03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983187, "uuid": "4b3ea1f9-e86d-4fdd-addb-22377151fd09", "comment": "Malware payload (Mirai)", "value": "c717a718b5ea7528fda3e6d8534182e518049793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983187, "uuid": "4399f223-1915-4f26-bdb8-974b675697d2", "comment": "Malware payload (Mirai)", "value": "6cb18504108cd9f7b260bc1ba68462638574c52930ff19bb7a4699e880761e0b2d9d0cb40792f5ceb3cc27be12b64644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983187, "uuid": "bb3e0d91-8ab3-4aef-a734-55a8ba06eded", "value": "T155E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983187, "uuid": "b126ae06-22c6-4109-a553-9e2ae67253a4", "value": "3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWcih0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784983187, "uuid": "458a1a41-0526-440f-810d-547e311d066b", "value": 146264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784983187, "uuid": "490ff6e1-566a-43f8-a485-e26c15a58287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983187, "uuid": "0266e7a5-7dfb-4e0a-a40a-80782ec5ffb6", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff7a1d5-8840-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784994549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994549, "uuid": "59fae8c8-21db-4443-854c-4fbcbfd3bba8", "comment": "Malware payload (Mirai)", "value": "b4942ef2c382d05891081ffd9fb3c1f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994549, "uuid": "29758261-18b6-49e0-85ae-fb10ed00d9ca", "comment": "Malware payload (Mirai)", "value": "11cd2a7ca29db06bcd814bc400f150e8d23aaac68c1635e8b465d72ee8d315b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994549, "uuid": "feb01821-2e99-49f0-8c4f-dbf5ca998c73", "comment": "Malware payload (Mirai)", "value": "b34f04217d0f08b649b1287f51772433e69d0eae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994549, "uuid": "97b68fea-114a-4d91-ba4d-73b9f3fb1020", "comment": "Malware payload (Mirai)", "value": "212572d875c1d6924faefb7b0e4b9d448792779bb18535db330997babba436625da998eb3f10a46b3e309a6a26f630b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994549, "uuid": "977d6b9c-e340-4361-af01-4d6fe4c3c950", "value": "T1CBC31A41F8829622C6D717BAF66E21CD332163E9E3DB7107CE255F21378658B0D67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994549, "uuid": "cc0c1e10-1cc2-4cb9-98ca-940246b210a3", "value": "1536:G/4vAze7/gUOBeVhEN10hb3j6GuMR3Orvzu2yPc9u1y8GeJ1/jjLEczvSHV4F:G/4vAJUO70EgPgu1NDBSHV4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994549, "uuid": "92ea84c4-f232-4297-812f-ca552172fdd3", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994549, "uuid": "1430537f-8b2a-49be-86fc-ad66d6265eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994549, "uuid": "d7f68179-dc3c-461a-886d-94bd0f86ac35", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af95b486-883f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784994253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994253, "uuid": "1d7f8793-d40e-4bff-b1da-3ef945cdbf3a", "comment": "Malware payload", "value": "297c10a4b6d898e1a4faf06c82f7c5f3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994253, "uuid": "6b4161cb-6c33-4084-8563-b6b3dd95f82d", "comment": "Malware payload", "value": "11f03dd57cbc7c882dcb9ea5067726e3cd48a155eae3d185ce02dcd721066e0d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994253, "uuid": "465e6bd1-4f7d-4dbd-829d-fd3a6627b02d", "comment": "Malware payload", "value": "53a8f51be7140ac340db8bcfd097098e0b6086af", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994253, "uuid": "8f62caa8-3244-4f62-b536-d8ad9eedc24c", "comment": "Malware payload", "value": "d9e36bc2a95c57273b900b17bd7fb4d3bedfea4555630916c7ddf7da01f2e169e06793dda8efe430e3eeeca51b20e4ed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994253, "uuid": "27da2f5e-e4ce-4ae3-98f6-5c6e2251efc7", "value": "T15B963350ADEA2B75C44FD3718213727E76387FE5E9B88C167AE472181E3231668B7308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994253, "uuid": "68646ab6-4c15-40d0-bcfd-a55f50003e9c", "value": "196608:8H4ZEgmyTUDEm4YZCfbItn5vpzZOa99q0yVPsUEtwT20oRm:LrBiEaZCfEtnJpOVpEtI22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994253, "uuid": "764a142d-4aee-441f-852a-d730a3c68ba3", "value": 9216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994253, "uuid": "bb479c9e-baf7-4729-ac86-dc9ba069fc5e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994253, "uuid": "d01c043e-d087-40e6-bf9b-fb5219cf9154", "value": "intll.1.zz001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4161c441-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784979465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979465, "uuid": "6ef572a7-599d-4083-88d9-fa30ceb162f6", "comment": "Malware payload (Mirai)", "value": "405af4bfd1d56c180d0dd11acdf3c5dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979465, "uuid": "2e0dd901-ddb9-4353-b79a-d49c50a00a1f", "comment": "Malware payload (Mirai)", "value": "12e639caaa79458418b964487e40c1886bf60e860b7be5894b9be95f272e6af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979465, "uuid": "9134d87a-03fb-430b-8c7e-a024ed5303dd", "comment": "Malware payload (Mirai)", "value": "ba8cb7ce7ed484223d55e0c2859720d69e0c1f7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979465, "uuid": "c892b805-473c-47c6-95d9-126401995c74", "comment": "Malware payload (Mirai)", "value": "df77ebf413f0c13220608e271785d42a46386d74bce619b1b5a1c1d99932dcf67d2d6901a22327bcc325abf85c1bbd30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979465, "uuid": "3ccb80e1-d36e-49ba-88c8-42eb2adc93f7", "value": "T1F383295AFD81AF11D5D625BAFF4E114933534B6CE3EE72129E209B2523CA92B0F3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979465, "uuid": "33fd07f8-94b4-409c-b039-2053868e752f", "value": "1536:tZnfEDGlQJZEMaRZCidLYH84ll7hiS3ZfVGUAIrfZZ8YHIXERH:46lYEMaRZCidLYZH3ZfVGUAIrfY7yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979465, "uuid": "90049585-b196-40cb-a79c-8559545c0673", "value": 81064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979465, "uuid": "a612b715-978a-4ed7-9e25-87b45da5f3ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979465, "uuid": "e8d4d0d0-8d74-4179-8048-433bc43cada4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f53de88-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975247, "uuid": "a0594bf9-93a1-4097-b976-60c227e2ab1a", "comment": "Malware payload", "value": "1c94d3dbe78f978b01823f45b78a78f7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975247, "uuid": "ad15ffa0-8961-44cb-8db4-ee9618324927", "comment": "Malware payload", "value": "1372210c23d133df8383b26cb08acb7f3d29ac237cf4ed04af1f04b6204e0ec4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975247, "uuid": "2a0b959a-a347-4400-b861-39c3b724ff86", "comment": "Malware payload", "value": "203d648a1600c823e38a07750914ed50fd802b3d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975247, "uuid": "f932a785-71dc-4bf7-86a9-7ab5c1076b1a", "comment": "Malware payload", "value": "8f34cdbf5e08774bd4a7fbf3b78a00822ab8c4504275824569e74f24f00740e5eee5e3d1f99e56e920716c9c48ba0887", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975247, "uuid": "d3a2c95e-3fed-4460-9ca2-7126162c349f", "value": "T19A12AE2CB84B289C989BA57A3DAB9379067ED8D34409438F12C4C24F1E6F46817EDDC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975247, "uuid": "bfb9dcb6-69be-4c9d-a8ba-c298d1ddb279", "value": "192:QU6xn/VXLD2WxaOS5s8wq/aJhrroXjM8KfDBZMVAGF2UPS:Q51/VbD2fOpWgZoXj3KD/G7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975247, "uuid": "b10b1343-129b-4e83-89be-016f5f946869", "value": 9845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975247, "uuid": "23558eeb-9aac-4d44-a686-7f0cd78860dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975247, "uuid": "f81b5959-5be2-4634-9b2d-5120cd737e93", "value": "images_20260724_222131.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1374c577-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991414, "uuid": "446666e3-0522-4e93-bfba-27b5620f2a83", "comment": "Malware payload (Mirai)", "value": "4c974fa87f81924abf0cf628f0963f76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991414, "uuid": "b6941308-da70-4c8e-af03-5a7b18b4a228", "comment": "Malware payload (Mirai)", "value": "14280dc64d2ab66ad71e4cecac846366027ccb50a1a6c779c775735f19e0ff5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991414, "uuid": "76151561-ad0e-49d8-aa17-38b517b523d7", "comment": "Malware payload (Mirai)", "value": "22555f449f9a97a7639148ae93eee400395a115c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991414, "uuid": "1b9d8ff7-8ccd-42a9-bf6f-5616d1dcb9ae", "comment": "Malware payload (Mirai)", "value": "30ea824a888c91f2a31eb24132a0a05ed9b1eb69dc842bc44bfdd776efda99ca50bc1be681d66bdf43f6996bdcfe5cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991414, "uuid": "38df7262-8eaa-4aa7-80a9-35145ad92d13", "value": "T188630A6AB9418F19C4C5167AFF1D538E731367B8E3DEB213DE142B242B8B56B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991414, "uuid": "b775ef6a-7b46-41da-9ea7-e4b545ecd46a", "value": "1536:/cnWrhhBi8wgnHkzeS3YEhCTD85KFxOrJAi+iC7+uJzxEg3kV:lrhhlnEMfHFxOlC7+uJzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991414, "uuid": "027d7ef2-6d99-490f-9866-8f49c165d29e", "value": 71228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991414, "uuid": "11804e88-9bd8-47a8-aef5-b3f7fc8beb49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991414, "uuid": "6d93cff2-213f-4bde-8337-987f63fb58e3", "value": "WAu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7da29e7-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998642, "uuid": "2a48f778-f389-49a9-be8a-8fe260fa3b45", "comment": "Malware payload (Mirai)", "value": "58e30105cd358d52b08ba595c4d819ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998642, "uuid": "816db07d-e4b4-44ca-ac1b-d3974fdaa041", "comment": "Malware payload (Mirai)", "value": "1490878e37bcbe481c1495b85040e993093eda87702a84f1b45f9d7f13f3e011", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998642, "uuid": "ffe31869-14ed-4b11-acf0-8a8ce868b22a", "comment": "Malware payload (Mirai)", "value": "55b021a2d7a1b5f2ac6df346e6f23a4d40f42cc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998642, "uuid": "d48f06f9-a364-451b-9549-e24bdea6e586", "comment": "Malware payload (Mirai)", "value": "63feaace1d9158d7b263f83a15eb6e651aca06b134c3ff568b5e5289b099a667c001b6803fc6216dccf107e533a55ae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998642, "uuid": "f3a2a6c0-95f7-47d9-9c0a-5235f9e82f46", "value": "T14523F17251E1119AFB3B953701AFFFCA030FB50FDA4815D2A1A4A8F2856D767330DA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998642, "uuid": "91660086-4fff-4d96-b04b-2b3b4b7758ea", "value": "768:HmYVIhIViIw2cFqaSAQUOmXX6KwRgWp/K/+13wkLUGW72DV4eu7KhQ+6EyzmsUTH:HmYiIViH2cka1Q0wRr/KGmkdQneueG+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998642, "uuid": "121d9bba-325f-42bd-a784-3bb8b8b1a8e8", "value": 47592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998642, "uuid": "8b6a28ec-a6c8-4ca9-88ff-70f191adf1cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998642, "uuid": "61773ef0-df02-48fc-8f48-6535b852c703", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f699ca-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974663, "uuid": "70768844-aa18-4b88-ba42-d3e15f59db95", "comment": "Malware payload", "value": "1fa724f588a489efa5a371d69a8793d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974663, "uuid": "350c7a65-f42e-46e9-9645-a48913e1f581", "comment": "Malware payload", "value": "14ec45fbdd2187afb5b7f942e507862da76e018e5adee8318090225cd7a59508", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974663, "uuid": "2b94709b-99c6-4dfb-beda-5b07cc48ce13", "comment": "Malware payload", "value": "7f2287d2f58752cafd14a6c5d7471345ee360709", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974663, "uuid": "d645251c-08c8-4ed7-9b56-6b884eb2268c", "comment": "Malware payload", "value": "04c9ece559d78844ca6f51590c4f97c636c8d138a9115ec5e7c2a167336c028532d24a50642f334c3e89ae393c2e716a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974663, "uuid": "ce000dff-4e03-4919-be9d-3bf4a4dee6cf", "value": "T11042D027DC90F9A3C0467560668DC384DC6CE7DB357831827189C2689639AC3987F3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974663, "uuid": "26dc60b5-92f1-4113-84f7-754e0f4beb58", "value": "192:zCkhtxt4goF9ZGjuzaP+5cR3NQW7FInD4snouogxnIphrfGclB+fOmRMeQmwuBWq:Vhtxt4gQGjuJ5czQEMD4sobpMzMeQm5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974663, "uuid": "9c33591c-5ee2-49fd-9ada-e5cfdd7c33fd", "value": 12282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974663, "uuid": "cae8cf75-f3a3-44d0-87cc-f0f59e8ecc76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974663, "uuid": "4d96448e-ffdd-4aac-a614-6f4cfcdfc748", "value": "images_20260724_233909.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeb13fa-8841-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784994869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994869, "uuid": "1952461f-3f88-4047-aea9-1de2e822daa0", "comment": "Malware payload (Mirai)", "value": "794bda47779637a11e612cf09d21b241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994869, "uuid": "a6bfc816-59aa-43dd-b03a-04e866a33944", "comment": "Malware payload (Mirai)", "value": "1547fa68bf58e238c859e2f61ea0610da0c4f48df7a5adc508010e0dc2bcc74c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994869, "uuid": "6dfa1248-081d-4ac8-b798-be0019b3d426", "comment": "Malware payload (Mirai)", "value": "da8bfe2a70699a5cf0d3a9c93d5798b15e8785f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994869, "uuid": "d73c4cf2-8620-4a41-a7c9-77ddf69d574f", "comment": "Malware payload (Mirai)", "value": "7a34e8cb8eb34f3962909e23223fc8825143556ff01147d36dcab8dff1690290c3f225982fa72cc86bfb92c14732fa27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994869, "uuid": "e74113d6-4148-4774-9c82-7a0bcc7c0509", "value": "T133C35C0677180B07C59309B02E3E3BE9C7BAE5E021E0BA89650FDB5A4675EB75449FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994869, "uuid": "aadb8f54-4505-4b0d-a0e4-f9e2cb8fb0e1", "value": "1536:KCwEcldSvZowO86Sg9yu1Oe2NWxsf4wFF+1mJTu2a9FF4vRHqf+N:6EazQ84eCFImJTW6Hqf+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994869, "uuid": "c0661d2e-03cb-4a73-8f6a-ec6a9f694b57", "value": 121356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994869, "uuid": "bd5be0c8-69fb-4404-b91a-0ebcea03519e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994869, "uuid": "8403cc20-6d43-45e6-ade1-35508a705022", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9516a9f-87f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784964312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964312, "uuid": "313e9178-80b5-4efb-a72b-4517f77aff35", "comment": "Malware payload (njrat)", "value": "0268fde13e99c555ed4a4c6ef193b9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964312, "uuid": "ca4eac76-5914-496a-9948-51fb96901ef1", "comment": "Malware payload (njrat)", "value": "155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964312, "uuid": "d5c7b9bb-fe8d-4a9a-ab8a-bf4660aacfd1", "comment": "Malware payload (njrat)", "value": "ff5db489782f10217946f75450803f6c835108c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964312, "uuid": "a3fb10d9-a8a8-4d32-b4c7-fb8c9d39a655", "comment": "Malware payload (njrat)", "value": "4dc58e06785842be5d508e31e6a9b25ba8894c441a6e8b22c8a29218bdc4ccff5933957f5c2727e8918d178746f7f6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964312, "uuid": "2efb0fe2-447d-43ff-82d5-fb102c5a3418", "value": "T162F54B41ABE8CE1BE1BF2775A4F200125BB1E449E732DB4B1694E6792C637406D0A37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964312, "uuid": "9ac84b42-3d5e-46a7-b42c-9f820da2e30a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964312, "uuid": "a58f2469-0271-4f71-a839-d8a1a29c2a9a", "value": "49152:4HSarve2wIDiFilNkzVMWzU0hdBdo+6WuDayPAr/NJJ8:4i29Dxb8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784964312, "uuid": "c1ddc502-f9ce-47a9-9c94-48f2c4561eca", "value": 3425280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784964312, "uuid": "241e32e9-c784-4bf4-8b19-d9bd02a79342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964312, "uuid": "21eb2f6b-3694-40d1-aa51-7f655a3a3fdc", "value": "155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0069456e-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784990953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990953, "uuid": "39fa1084-4859-454a-97b0-5a1a9ba4d69e", "comment": "Malware payload", "value": "d1fd177119b97799972acb817a3f8883", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990953, "uuid": "53f1ce21-8305-4bfd-adc9-6f862f9d6b95", "comment": "Malware payload", "value": "15e5d8a18c573faf7284db9ee7070dc48544ab9ae07cb3818b8c9747cee84138", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990953, "uuid": "ba3961ad-cbf6-4a25-8063-e940e0512096", "comment": "Malware payload", "value": "6b851571a1a1b2f7699b092b75c885b82b32c0e3", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990953, "uuid": "ec3ea031-fac9-4f33-b919-34ed7aaee2eb", "comment": "Malware payload", "value": "6788421af6c1feb5df49466cdf40c2751562b8c9a07b32d353e0431dbe43352d55f7e8457db3e9a401a5e74e3ea5b811", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990953, "uuid": "b601e8c4-8fe1-4f34-a0aa-61d11953937b", "value": "T1D606227915D79891CA67097C08F1111EE0AD7C991F23CBDB23A536CCCF76E8C9A6132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990953, "uuid": "d09d28d3-9403-46b9-8c9d-ef1ccf661075", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990953, "uuid": "07dabd20-5ad0-4d40-93e8-0f797c4b3662", "value": "98304:tUkXyXQ+Yzyk7MBKsoxc9NlDcq1HCYZ+7OQ/:u/Yzg5oxmNlD11HrE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784990953, "uuid": "84bbf5fa-5686-4338-83f4-3f50936e1f7d", "value": 3906048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784990953, "uuid": "d783e963-a91e-4267-8f98-cd2353c9e905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990953, "uuid": "a30bd145-33c0-44ac-9a00-593290c72209", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9466be56-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974021, "uuid": "9feae223-56f5-443f-99b8-767277ecc93f", "comment": "Malware payload", "value": "a4f53b9fe3f2e67a18435fb7200fb6eb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974021, "uuid": "368da3fb-cadd-431a-aa40-0ec12d928638", "comment": "Malware payload", "value": "1663597cf04f37d8d431461cb76abd702189aaad0d7456aeb65e410b8a1c2141", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974021, "uuid": "1531e094-169c-45eb-8aad-a4bceeeb1e95", "comment": "Malware payload", "value": "c306b4efb37fd079c89d85925b6426385a18537f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974021, "uuid": "aae597b0-0d20-437b-bebc-ea1c34f26e04", "comment": "Malware payload", "value": "c2c5e65f4a1369c0dec65a42b582c50e1af4912c126e92eef688fb9cb5e6dc2ed103b06b46466dc828f113b511d581bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974021, "uuid": "367420ef-d45f-490d-87df-deab30ef83e5", "value": "T12706CE4AFB489B6AC0F392360D355A61414B8CA68F83D7837D64733C58BB9D41F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974021, "uuid": "a89a78dd-b282-4484-a5dc-fb0cb314878a", "value": "98304:V1ij3XVlyNswEZcjTdT0V4x6OqfIp+YVg:VGzq9T0KJoIHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974021, "uuid": "35292e1b-5e31-4514-963b-bd8b1f3451ef", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974021, "uuid": "6a1d0152-f945-4684-8139-85ee997a6923", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974021, "uuid": "bbeb50f5-cf6c-4111-916b-efdf2fdb0bbb", "value": "variant_17.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dd2df6-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "89b58175-ec96-42d7-8212-b9f752b77eb5", "comment": "Malware payload (Mirai)", "value": "50e97e03937457e907234f6f78614a00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "a75b8060-27a3-47ff-b3a8-67d557284e2d", "comment": "Malware payload (Mirai)", "value": "1691335759096e562729e38e60abbf270a7c285c241ea095a2e69e737a8bdbcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "2f08a956-d515-40e1-8f70-507a41fee3a2", "comment": "Malware payload (Mirai)", "value": "0155955bcc8ccafd7408b366c7c6c9036a57ffd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "4b2eb73a-5044-4343-af8e-df7fe54881dd", "comment": "Malware payload (Mirai)", "value": "b78f56c41ac22c7929bcb94871d14fdb832dd1acda62aa6ccad461dad8d5624f51676a309f175d72550919196b2f627a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998713, "uuid": "d260a4b3-f9eb-4541-b6c6-f30d59aeeb0d", "value": "T12233026789FD9288D47DB1B76CEA7E720230D8875108A4263F8C297D9DCBE5C57153C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998713, "uuid": "fe652b11-394d-40e4-8742-c6db13435ca5", "value": "1536:ETDIHJFmoOaW59p9LyiwcV79mLOFiiaYnouy8Hyg:QDWJbR69Pwc19DLoutn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998713, "uuid": "2649dd20-6cd7-41db-86be-d096b894a3ed", "value": 50320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998713, "uuid": "35e5684c-b570-4be6-b3c5-158ae16bd92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998713, "uuid": "5cc54760-d03c-4d2f-bf59-d1ce366d49a7", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110a372d-87c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784940729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940729, "uuid": "e2533083-053d-4c64-a4c1-71d2b26b27e7", "comment": "Malware payload (Efimer)", "value": "f5e3a80de3fe5deabb98ace7acd43d03", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940729, "uuid": "5e15c938-1fd7-4440-8240-c654127e32ed", "comment": "Malware payload (Efimer)", "value": "16bb2b729c044eb246f01fcdeb1ced10047865d4b1136ca04a9bb1e59f2952e2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940729, "uuid": "003f9d35-96e6-45bd-8340-72dab58f957a", "comment": "Malware payload (Efimer)", "value": "1a8d55fc354dcc176aac037b85d1baa14c6c800c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940729, "uuid": "0e429e01-0cbe-42a0-8617-dee905e42b4c", "comment": "Malware payload (Efimer)", "value": "0d9930b7a0b5e77ffd43138f99ede96ea3951edc81ea5fa4633c8d39f90b5595c21d45710e8a24ce277abcaa3ae503c0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940729, "uuid": "fd2a62bc-a636-46c4-a083-99e4eb88d414", "value": "T1B1E6339879C047FBE772413DD9E596B6E1A8B0DB4771C4AB0B14CB25CE0B1F04A39A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940729, "uuid": "2eb60bf9-b518-4aaa-ad83-a8ebe5b73825", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940729, "uuid": "ffef5148-fe2c-484f-bb64-42f7b40be890", "value": "393216:Yt+jeiC6iQvf+nQs920QXMCHWUjXEcuI3/PGTAI:Y8Sqi9tM0QXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784940729, "uuid": "9282af2b-dab9-434b-81b2-ecf0d0f53f64", "value": 14311471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784940729, "uuid": "97ee873d-cee7-417c-8ffb-903911ba7b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940729, "uuid": "d57e8939-14f5-4124-8cf2-3d7cdfd2950d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dde36b3-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991539, "uuid": "4fe9e6c9-be8a-4453-a9de-bc8580986f6b", "comment": "Malware payload (Mirai)", "value": "e01d44ee6ea6e50b0d095d278650dbaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991539, "uuid": "7168a76c-b09f-46a0-b514-c6939e620615", "comment": "Malware payload (Mirai)", "value": "16cf8cf07af40fd24cc8b5149911bce5344a8f3026f93a4eea834be49c2fcb76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991539, "uuid": "3b78072c-3467-4659-8aa9-a62d40fb6bc6", "comment": "Malware payload (Mirai)", "value": "0a462a3861adb4cc839e167eb11ee146c614ad82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991539, "uuid": "ee4aacb8-766a-4394-b675-34da8d228b84", "comment": "Malware payload (Mirai)", "value": "497b00d6b2f535d8168c41212be9dd87a8cfc184cffe0d683fd64b478001418c1baca8f745907621de97d9d5207ed2d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991539, "uuid": "9d88c90f-cc1d-47aa-8e18-977966fec988", "value": "T1D2E31846F8819B15D5D511BAFF1E124E33132B7CE2DE72029D24AF713B8A87B0E3A519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991539, "uuid": "bb998dc4-cfb8-422c-8c2a-95b63de34b6c", "value": "3072:xyWS9gBpUUpDXlfn9aUz+bhggbAwpv6Xodb:Yd9gBp/Flf9aUqbhJv6Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991539, "uuid": "2833ecb1-9277-447f-b493-63b877c4b5c1", "value": 151644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991539, "uuid": "e9651039-9069-4243-8488-6fc9aa4267d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991539, "uuid": "2081eb66-8e72-46bf-bf28-8afdd82446b9", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a607dd59-8880-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785022154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785022154, "uuid": "e0366951-b817-4588-9f0b-42ba7d60cf6f", "comment": "Malware payload", "value": "8d1f898379640ff3b9d61d256ede418f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785022154, "uuid": "d136ff08-3639-4332-b5d1-d0b8daa56ff9", "comment": "Malware payload", "value": "170175f699d31ba16e1def49684a8b37034863a045a6ab9910e91dd568049b9b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785022154, "uuid": "e5223d7a-4e9b-47d9-8ffc-55a83cd7c452", "comment": "Malware payload", "value": "81d2e79fad91ff217b57dd13f23600e365997bbf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785022154, "uuid": "ee62cf21-4ade-43a3-8d15-e6f3ef40c46e", "comment": "Malware payload", "value": "0930bd89e92e68bd1de81654bce008e43fb8475e6567ea4c11b7ea29eb28b738805283e520eb49555cb5453e3194dbbb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785022154, "uuid": "910a9a39-9778-4019-857b-6d4b5cb3b8b3", "value": "T119623B0BB8814036EAE14079477F422644BE6CB623C0F8DBF7F0698A5AB46E1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785022154, "uuid": "a6b2ac53-9fd9-45cc-9e9a-b335bb01c3e4", "value": "08e71dc3a4ed4919ed4f88f99fab3457", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785022154, "uuid": "aeda7c05-2d1d-427b-acbe-6697ff2c7577", "value": "192:D9BErjXgjo8P0UI+TemM2l1WFeI82IKUSfEzQyFJxTmv8U9cthBM9c+F:ou0IzWUoERav8U9cgzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785022154, "uuid": "690dd9b8-970e-4f05-bff2-b2ab0df706b8", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785022154, "uuid": "9c921548-6fca-443f-92c3-4518f988d8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785022154, "uuid": "5254bfa9-276f-42db-9a27-8a7dddc2bb0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6874fd8-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998640, "uuid": "e3d72285-48d2-42b7-b037-737087340d40", "comment": "Malware payload (Mirai)", "value": "fc7096bb25044179427f12b9a7d7d1f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998640, "uuid": "ae641395-d027-4460-9ffb-49eb6e9537f2", "comment": "Malware payload (Mirai)", "value": "173b7f4a11a97f58e34f48bb72c06e194edbb4c626998345fcaa41a03d9aff43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998640, "uuid": "f6e7f613-60a5-4268-8e87-1d70f90b2d59", "comment": "Malware payload (Mirai)", "value": "f2fd8718872da8232ea5a4d98d49ed924df85202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998640, "uuid": "2d39fcaf-2af6-44ff-b3bf-a033de7f8fa8", "comment": "Malware payload (Mirai)", "value": "9eb59caf9b77826f6a5ee7d276d9fe80209c1296aad3202ced339460912e798808feb560413e24151c3c5608c1e87ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998640, "uuid": "3165dff1-268e-4fcb-b5bf-c6bd3a6a214f", "value": "T14223012CAEA6D175FACB50B6C13A220E0834936D12574897A2DCB0E73C977653E74FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998640, "uuid": "69607b41-5d79-499a-9934-6974bb572397", "value": "1536:xwx4S4NT40qrIfoQuXlpg8ZOsPHZ1tQtIrnouy8Hyv:Cx4SwFovl5PHH3outs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998640, "uuid": "bb6ee9c0-e94c-4ef3-bef5-eb2c420dfc69", "value": 49644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998640, "uuid": "f9058847-bf33-46a4-9403-f50053be9a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998640, "uuid": "10709172-9dc8-40ca-b6b2-92aebb34529c", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb42eb66-8811-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974623, "uuid": "b8656d9a-54bc-4c90-84b0-4ae0d853e6bb", "comment": "Malware payload", "value": "f74ed934cae2a6d9b3066fc30cd554b9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974623, "uuid": "dd2b0201-6dad-4d23-b6d7-30a44b1f181f", "comment": "Malware payload", "value": "17d80dfbbaf525a14c952f95950de22b4f44428564d6999920c1dd1099efe31a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974623, "uuid": "5bd1cad7-6ea0-4941-97b4-1269bacf9785", "comment": "Malware payload", "value": "978674e14a7518302dc006d3b0d686d524529ee2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974623, "uuid": "fd0ddd5f-33dc-4025-ab4d-f94137f97248", "comment": "Malware payload", "value": "dc0145508055235098d3a2a07547be301d195b2a1838afaec79507a6e5e06f0368475332b671483372982b9ec49c8657", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974623, "uuid": "056d5a1d-1e30-4a2a-ab41-2e12ad53963b", "value": "T1DD02BFE5A6539A23EE6D5ABD79D4027084D141B486C4012B9F60FE822BCD1C7399E3E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974623, "uuid": "c88e5cd5-78bd-4f6d-a13b-207dffc4c690", "value": "192:7xNfkHC5FDgkyQMNmwWmwPUbRXGIucowd9O1jeEUnAivYM:7HkiEvNmpmGcLXCiF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974623, "uuid": "797ffcdb-652f-4827-bbb8-6bdee8b305f9", "value": 8720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974623, "uuid": "7484e0fd-b23c-4af4-8269-5f0dbd1e8f30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974623, "uuid": "32be5387-9189-457f-b142-00bf5a6d27ce", "value": "images_20260724_182927.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d32b79-883f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784994213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994213, "uuid": "857a9b82-86bb-46fe-abb9-31fa837e07b1", "comment": "Malware payload", "value": "b38e84aea797d0b2c64a79f61b555a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994213, "uuid": "43ff7253-33c9-4b95-a71d-63d0950d943d", "comment": "Malware payload", "value": "17d83435eafdcb90dd6471cb37eac1b1e37442038104d859be891ab45e5b0cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994213, "uuid": "02e1db5a-832e-43ea-a4d5-32a3b5213008", "comment": "Malware payload", "value": "03b2a3b071da712293d6c4b13348f024c46543fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994213, "uuid": "dca3d8f2-7c06-4c43-b3ef-d347dcf746cd", "comment": "Malware payload", "value": "ad2015ae3068e8d5db76eafc651866e70413f7936f7adab895df0e982b8d20edadacac959c38e97894abf787f407adf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994213, "uuid": "2990086d-c2ac-4c75-9ed4-06f1f4c00fde", "value": "T11747331563F4136BF277963D1FFA6B69A575BD3AAC10CB9C01801308192BB319A2C77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994213, "uuid": "65f8c5fc-0873-40ac-b8f0-2f6f791c3d3e", "value": "5f07e11ac4497697824b78aa9db1a415", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994213, "uuid": "8b18a1f8-2c9f-4292-b5ca-c97f27600a46", "value": "786432:bXJ/f/0x5yENTJgxFKkhCP5cN28zq76W3fOi:t/0xntgxFKKmuk8Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994213, "uuid": "5a9fc1fd-ed74-405f-9025-55731646ec03", "value": 25745864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994213, "uuid": "780b16a8-05d5-49ca-8f7e-b3772e8e9e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994213, "uuid": "ddc8019b-4c0f-4102-a095-649880e67215", "value": "Huorongt_12.8.1_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf340f5-87be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784938790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938790, "uuid": "43dddca1-7187-4a8e-b28c-484dfd5b7501", "comment": "Malware payload", "value": "cf370d4b0e6a4b0ceb9854f137fd8962", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938790, "uuid": "26834444-0379-46ad-98fd-ab9a2e6aa023", "comment": "Malware payload", "value": "17ee65b15259a09080c45eeeafa761f58552c0a23ccd50b8400aca044f295cf5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938790, "uuid": "9a702cff-4ae6-4436-8430-fd50e92075ea", "comment": "Malware payload", "value": "46fb0c814663940fd627e7345b1c82258ee5989b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938790, "uuid": "790a8cfe-667c-420f-a022-401d60d60fcc", "comment": "Malware payload", "value": "561b323493d416d281d9a4f194e31f270406bdf3c6d8cf8d1d0f2ff450759f8b2289b2524d82945a8173471db178965b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938790, "uuid": "c0dbcf9c-3ffc-4355-850d-aa9f33d8fd98", "value": "T15A136C6916953C28AE99893B5C7E2F0CBDA983E1304491DDBF8B3CF18C15A9CE31875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938790, "uuid": "1e9f6dce-12fa-493b-a89e-66845aea8722", "value": "768:/n9NyXsZztCG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:/nHusZKco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784938790, "uuid": "7f07d4c1-025f-4388-882d-8588ff44cf21", "value": 45489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784938790, "uuid": "f399399d-6bae-4c3c-a956-6fc182220a70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938790, "uuid": "f0bff5a7-0b59-465e-a5a7-cabfe9ee84e7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbb9a6a-8840-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784994730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994730, "uuid": "d88b1b39-0fa4-4159-9ae8-a7ec83555794", "comment": "Malware payload", "value": "6fe941c58ed1de43e92fb6b0c8b23608", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994730, "uuid": "268814c4-ec80-454d-bb1c-3b7453c40c61", "comment": "Malware payload", "value": "18567073a177ba59e86f30bd94dc48cbe9adf4efadfdd3c97a0344cc6bdc454e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994730, "uuid": "379bf65a-4466-43b7-ac16-a0faf13cd0df", "comment": "Malware payload", "value": "9bc77884d59cd12734533bcbf644073a5bc14243", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994730, "uuid": "d3c9e1ce-b578-45ab-9542-af2c0c27671e", "comment": "Malware payload", "value": "4e35a32e1c78fac12ca49602485781e1c0aa589713877b92364140b90411936b959b8cb4905970017ec84103c972c497", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994730, "uuid": "692a8907-c725-4b48-9499-64a941bc09de", "value": "T112E6335C96D010EEEA93A03CDED153C1D5B878736335CACF9DA443A26E2B1B14D3A627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994730, "uuid": "74cdfaf2-ece4-465f-9e18-810191fb5031", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994730, "uuid": "fbd65177-6e08-47f6-8368-d8887c229d4a", "value": "393216:wBzAcmUfu1iOROq+/MXMCHWUjXhcuI3/PGTAI:w9hMkwXMb8X2H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994730, "uuid": "3eda178b-4d75-43e7-a97b-9a010324a2ac", "value": 14323685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994730, "uuid": "1bca5cfb-4e71-4dfb-abf3-879fbbca6c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994730, "uuid": "e0da6b19-6ecb-44d2-a68b-2eb93148eaf0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c24532-8840-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784994481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994481, "uuid": "99df8f4b-748f-4641-a649-9b168deef04b", "comment": "Malware payload (Mirai)", "value": "091574a75599271eb4bda2c4748eee4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994481, "uuid": "1e1e4251-cb28-4b36-b9fe-8b31697d58a1", "comment": "Malware payload (Mirai)", "value": "187a8fe253e9a3c86b1238a991bc239f93aff291b8ef26cffd1fc5eda02973d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994481, "uuid": "998531fe-f324-4ab0-ad7c-20db84cbd078", "comment": "Malware payload (Mirai)", "value": "03c788a73bedaa3d1bfb5ed2faafcaaa2df17310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994481, "uuid": "46ab349a-31d1-4c9b-ae66-e01364a8bafa", "comment": "Malware payload (Mirai)", "value": "e880050dbfefee4832fc44d987b975ac435d12f3011113d5d33195b9468c469c288b3235c2d516c72bc304da85c4709b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994481, "uuid": "1c6392ec-bb0e-4242-b5ff-59fa03270be8", "value": "T10823F2417C457C21423494B8534FC7D16BA673AC816A777321245A5DAABC2D2BBBD2C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994481, "uuid": "8f431452-757f-490f-bd99-2c742f5f8721", "value": "1536:fIpMRGxSNNZuK4YBnhSobqCEaJtFIiZpNdVhD4RpPqe/z6:9RG4NffpSoOCEaJtOszdfD4Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994481, "uuid": "45476b68-67af-4303-b6c9-a8fb910dbe99", "value": 50032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994481, "uuid": "0ebb5590-76e7-422d-b568-e01972bd3bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994481, "uuid": "c8c874f7-3155-4365-96e6-c68973e44473", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09201583-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974646, "uuid": "dda20f98-8716-430f-b836-202ab33adcc7", "comment": "Malware payload", "value": "02246176ad08971e6246af379b8602b0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974646, "uuid": "f9aca259-ba64-4552-b5a6-6758d9987bac", "comment": "Malware payload", "value": "191f90d68850b555674e64465b3eb75626757d00b769b047b0fab427561c1bc0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974646, "uuid": "36db9f1a-7c53-48e0-ac52-cb5c14051970", "comment": "Malware payload", "value": "574086ecd76deee633db9d2ac7f3d977f88f4bd2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974646, "uuid": "c49e5c15-304e-4494-b4f4-2bb40b4202cf", "comment": "Malware payload", "value": "ae7617708da1f4a7511abec0be45cea2c6bc98f3353665df4a6261e4ca6a819610906fc7d737cfa9db8c29a2eaf16378", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974646, "uuid": "be5f7f0c-bbb7-426f-a3c1-aba512ead198", "value": "T1BB814B68829F3935E19733BAF8A5A7435A5CC86784940765338451ADBB656313A03C2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974646, "uuid": "50592365-1ee4-4bd6-bbea-88ed21e5fb58", "value": "96:i/vw73k82Q3WAmER8kpt8Y80hBpdewXMMwA374OP0zh+:iHGb2Q35mE7tThBXevMwM74dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974646, "uuid": "d01bf4fc-7d5f-4418-98aa-5608e60ac678", "value": 3879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974646, "uuid": "72bdbdf3-bf0c-4c11-8df0-b8682e65a1bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974646, "uuid": "6bde5848-401d-4016-afc9-531efbb0b699", "value": "images_20260724_101929.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0b37c9-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975163, "uuid": "f6871743-b9d9-4118-a741-7f5a259ec9c7", "comment": "Malware payload", "value": "48fecede3b9a424ee3bcb785cff02e5d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975163, "uuid": "eae864e7-7631-4197-8aa8-64799eeec932", "comment": "Malware payload", "value": "192dc3cf1154c6e1d5e43565e31f110732aadba278bad1fe58b1cc2f27c2f452", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975163, "uuid": "c6501a71-2f99-4f15-93a5-936a1676feac", "comment": "Malware payload", "value": "8148f9eefc8d67f0f072438ff80d54af4a4cc331", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975163, "uuid": "64f45859-2517-495f-85d8-29848175a346", "comment": "Malware payload", "value": "8add84ac89ad74e9a130d1e515bf87841ae9f2b4985da6413fb42e101e35f98c52582decb3e88a6e71c3b411261e3ef1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975163, "uuid": "7bfc7161-7fef-4a01-be3a-f4842de6c9fb", "value": "T1C042BFBCED85A44E7A0F4770B0BDE33E34800556B47662718A66FCA1F3409D6A771F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975163, "uuid": "9e3ab172-4c7f-486f-b766-73633a028acd", "value": "384:zWzGkaECq75BOUDOPGnOAu3rcaxKZLm1lB+:azjTd0UEGRl2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975163, "uuid": "a520641c-d975-48d1-99d1-e3ac8738a7a7", "value": 12929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975163, "uuid": "e8421ddf-fe2f-4a78-9e12-bb8d7c705275", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975163, "uuid": "ef02d0fb-001f-4d90-abb9-2ff944c34b74", "value": "images_20260724_183847.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ad74f8-8834-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989428, "uuid": "16e971fe-fe1a-4a85-9ee0-9651af44302c", "comment": "Malware payload (SalatStealer)", "value": "cf50721c59df8b48d1e5b7d52273de2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989428, "uuid": "6082a374-4c61-433c-8181-73f95ac96b11", "comment": "Malware payload (SalatStealer)", "value": "19b21214dd78b3a065128d30499eb976921a41807219cee3e93a90923f1db155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989428, "uuid": "ab9cabe3-2d71-4433-b3a3-4ef7d205459e", "comment": "Malware payload (SalatStealer)", "value": "f4d29f92fda5307d5a368d6099030e8575ee0b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989428, "uuid": "0cefbef4-5291-47ce-8591-b487b9d75830", "comment": "Malware payload (SalatStealer)", "value": "ea343c92cd565efd27ff620d9496812e1ea647419477335b129309ed5e0d532e68068538cf59c2653294c9f2e9f78f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989428, "uuid": "39341a8c-0c81-4faf-b0ae-fa6b80eb4a85", "value": "T1BC5623C95BB8CCDCD1DFD6F199194145C93D832CDBACB0D9449A8C5DF8FA690A3A8A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989428, "uuid": "5f924136-ab75-4383-a04d-622e3b923695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989428, "uuid": "c274b3d4-ee2f-4b2e-a388-0a761097018d", "value": "98304:/D/Xb5APHV9Zv5OdXQITSysmH5pD/sq4zaN+4rbuj4237cruKcJhYxeCXm:L/LGrZv5gFSyFZtsON+wwV37MHcJhIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989428, "uuid": "dd309678-f72a-4b3b-b979-2be058ef557a", "value": 6019173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989428, "uuid": "36a11598-ddb3-49d0-8512-431f3a1094af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989428, "uuid": "1e31dd0f-1df3-4460-8b35-b8ac97f7540c", "value": "RKNBYPASS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733ae8ba-8876-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785017774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017774, "uuid": "9058172f-aa37-46dc-8e8c-4ab85872a17c", "comment": "Malware payload (CoinMiner)", "value": "3e164b983245b5c4a83f912ae694f94a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017774, "uuid": "5a5b031d-5fa9-44ec-9952-1d45769b6498", "comment": "Malware payload (CoinMiner)", "value": "1a5fc161c39e639f6c053ad79040e2f18827c0d8df3e39b5202a3920fcc9b4b9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017774, "uuid": "c4af9d7a-0a3c-4b77-9a17-57630571c650", "comment": "Malware payload (CoinMiner)", "value": "d5a0a87dc48e302eb622c66664e6c00cdf9cb1e9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017774, "uuid": "8241b59b-293f-4b3e-971a-28f8f1d9b561", "comment": "Malware payload (CoinMiner)", "value": "af94fc5f8675a2aada54da3ab45e3a76641747cf092adf4133d9769c9eb1be230989a50dcc649f0660fa4d00b4e4b7da", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017774, "uuid": "d4974c85-d71e-44eb-9549-884f175a253c", "value": "T10122381F7E890231E39448B4157A864F553D1233A383B3EBF773E19D0B953498840AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017774, "uuid": "01a3bdc7-f1b0-482e-979b-936ed047cb0d", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017774, "uuid": "b7d9e0bb-999e-4f6b-b89e-bb11a3c6fff3", "value": "96:U2gwdfnoeYz/J4hrt6KBWdCZaDbFx+ZQKl6ETZjH/CPFJxGE9mZ2FFhxC7tCEe/o:mwoNScKB6x+eKlKPFJxTEZmFhSer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785017774, "uuid": "3f8568ad-50b5-459c-b1c5-b8b95c2793c0", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785017774, "uuid": "b873bc16-d40f-41c8-9682-23082f00c183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017774, "uuid": "8aec1d37-be5c-43ac-9d3b-86f7c2c100d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf09af0-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975270, "uuid": "7fbedf1b-582e-4c3f-b943-4e0a1abfd4a3", "comment": "Malware payload", "value": "757f06a04afb4a1766d471c349a95dc9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975270, "uuid": "37a566dd-fe37-41b3-bfac-076bcfeb31e9", "comment": "Malware payload", "value": "1a68f66cb5369223e1830290bd27bc968bd9d0f3067683185b370eddaa5e3467", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975270, "uuid": "11693d78-50a6-4b42-bf96-1af8502eb7cc", "comment": "Malware payload", "value": "59595d45973298731d9b51c39498c3afcee256aa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975270, "uuid": "e47ecfba-ae4a-4423-be31-e1c04fc29ffd", "comment": "Malware payload", "value": "9f9856d70a2a427295d729a97efcfa44479f1559dac713761b49d9e60c933f2be38d0c555e1e4c330fcbeb798e0c3d27", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975270, "uuid": "53ab7287-5de3-486e-9be2-56d4899e3167", "value": "T185F19E35EE13EC1582AE35B569561BFC50E3DAC1A7232ABF2739C094D21F71807D7221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975270, "uuid": "a388a878-b4a5-44f0-90b6-ba8e5db9005e", "value": "192:UHlZ/y5mm+DT5DeXFqKSnE95XLluH7R3HP6cC+x6Q2g6wLe:sZbcXYKznLw7Rf65oje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975270, "uuid": "512d80ff-e2f2-4884-ac5d-5fef432a10ef", "value": 8056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975270, "uuid": "087e5c8c-66fa-4deb-9c31-e0242f9ba5b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975270, "uuid": "4698911d-f33e-4ce1-88bf-2d6365a26d60", "value": "images_20260724_230657.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a97b7b-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998718, "uuid": "798ff3af-18c9-48ad-8291-4a1e1324b016", "comment": "Malware payload (Mirai)", "value": "0ccaab535c7fdb826116f815f1553c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998718, "uuid": "d86e95df-13a5-45dc-a103-ece234e2a487", "comment": "Malware payload (Mirai)", "value": "1ad0053c9f4d5810a0433f6778c35cc7afbb765df0985621cf4c0346a2cff72f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998718, "uuid": "90c1d6d0-d956-4b35-83a5-0d2f4f7839a6", "comment": "Malware payload (Mirai)", "value": "573995b4861a29d76ea4ad697842d06f05dab3e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998718, "uuid": "38a24064-4b8f-4eda-ac5a-750e6bd3291d", "comment": "Malware payload (Mirai)", "value": "28ec898c405ee6a534cc1ed971a58c8881afc3a274b2582dd0470d501601b9ab6636764dde10bbfbc1a743f315763ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998718, "uuid": "1a9fb62b-05d9-409f-b066-f3d0c415de55", "value": "T164E3BEA7F74B20A1C86306F407CB7BCD2E6762825F5B95E36C6B713B597A0DA0402BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998718, "uuid": "cbc5079d-b3c9-4de4-b2ff-02245f917fc8", "value": "1536:PpkHkSTXXdfs7Zk4J26ACwVTg1Ia+keSVrBcGln6cMrRVOHxZJk3LgJ7s/LWnz:PpkHR27HDWVM1Idk9UWngRVOWbgJ7sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998718, "uuid": "c429fb54-243c-4452-b4c0-408eddd6e707", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998718, "uuid": "3f1e8d7d-aff1-4422-8ba1-81490de0f5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998718, "uuid": "6815868e-82eb-4afa-9df6-c095bea2b395", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29fc5de-87f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960784, "uuid": "b973d0ae-d352-4569-8c6c-f0d6ce32829c", "comment": "Malware payload (WannaCry)", "value": "41faa6070b56ee395b5f811008213b03", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960784, "uuid": "c0dd225e-180b-457e-bfd3-f5cd226a32fa", "comment": "Malware payload (WannaCry)", "value": "1ba28ed44b1be838f303f53c5388cf1b007212798d50bb3e82932cfc06d7f6dc", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960784, "uuid": "af9d8817-ca74-4025-95b3-f57bbc6985b3", "comment": "Malware payload (WannaCry)", "value": "2b0e4a9a122db7e489d927f526f21dbd775c42e3", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960784, "uuid": "7df7f423-0fad-4342-893b-b28e8f2f8d45", "comment": "Malware payload (WannaCry)", "value": "7574640a239df21021e37871ea51d67f10527d8bdbacc2f8cfed4bced0d9eb3a94f43555923782033a16cfa1e8f508fc", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960784, "uuid": "a4645b57-ec4a-434d-bf3d-38f4d78d51ac", "value": "T1FE36238A31BC81FCD1072AB584B78E16F2B37C5E22F95B0F9B40497A1E13755BB60B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960784, "uuid": "5d3c515a-75ac-40a3-abd0-91ab5a1af0f7", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960784, "uuid": "22614076-4cca-4369-8ddc-3691b672c59e", "value": "49152:jnsntqMSPbcBVQej/1INRx+TSqTFQo6SAAR:DMtqPoBhz1aRxcSUF36SAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960784, "uuid": "d0ee46a5-3de2-4e46-aa3c-1453138e09e2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960784, "uuid": "0cb5349f-8a5f-4f6d-ba58-b244e99b4af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960784, "uuid": "e0779bfe-ce07-4688-bd47-805d17e93789", "value": "1ba28ed44b1be838f303f53c5388cf1b007212798d50bb3e82932cfc06d7f6dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ca7f34-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974830, "uuid": "4cfb9f50-09fd-481b-8937-1f4047f81a39", "comment": "Malware payload", "value": "5aa3d69f2e3ab5407b1fcfd4068e85bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974830, "uuid": "9d5365f8-4354-47b0-b7f5-b4aaa49d0332", "comment": "Malware payload", "value": "1baefd3c77bcaecf5ec30840552844f9eb3988e685c0d8a6c6290cd5d8ff7c37", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974830, "uuid": "0538b123-8354-461f-80ec-d8587e75a0f3", "comment": "Malware payload", "value": "9f915e038293fad5972550e143bd1dcbd988cb4e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974830, "uuid": "6984cff7-8c8d-4a3b-91bf-6909538df460", "comment": "Malware payload", "value": "892365a1077b2972f3c3f2e2c6aed37c961584e827b65e3001e8eebfe88d22c7eb3e0d62f4ae7a878ce0301e45c863db", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974830, "uuid": "97e05ac7-b4de-43de-9fbe-b55e2bd7ab57", "value": "T14912A0D14B160F9E6C099A7304CB2D885108AAF0371B6F703632A17C99A3547A74FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974830, "uuid": "3d96807c-4f26-42a5-9f47-d96fea8c7692", "value": "192:SB7dPVm7QIOZ/cklCLLND6ZetI9O9g4e4JxvDs02XnzLpB2Qkt6ui5292:kJt0rAKAetI4Q4JS0OnvPrdc92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974830, "uuid": "dea68b6a-b45f-4641-96ed-6331518ca6c2", "value": 9396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974830, "uuid": "11726068-c09d-4fa8-9d2d-ed3e1a161e62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974830, "uuid": "ce565ea9-1f5b-4c36-bdbb-7f2865fa44f0", "value": "images_20260725_021019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbef117-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975382, "uuid": "5aea30fe-0ae6-4c28-804b-3074b313a42f", "comment": "Malware payload", "value": "5cef545891a25cd4aae5313bc7ce89b2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975382, "uuid": "69a8a211-0804-405c-a2f7-91f211a3ecf9", "comment": "Malware payload", "value": "1c83c5762ada6f25a62f355e84a2a148b15ae7486f7f1f0bdefed570c4527aea", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975382, "uuid": "5ef8e7e9-65f8-4ef9-9701-edafe49ffa3e", "comment": "Malware payload", "value": "4dfdf53098162253c862beed0d19772710c4f5d6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975382, "uuid": "2eee6613-a0a6-42b5-9bfa-5b6fbca355fc", "comment": "Malware payload", "value": "c29a1c39bb0c87ef96f0a361a47c2a4ee5ca33a1cc0bda3dda159d3da1822f3b39e7b78193058fb88ae714ea85937de5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975382, "uuid": "4d18d5dc-6ba2-46f9-b5e2-e7c0b49f6f01", "value": "T1F6A17E78A5F68C23ED62757EAB485C75F73F8291048068CB87754A0538550EB389AD72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975382, "uuid": "f4aa89c2-318d-41ce-97ce-ff2d769f8307", "value": "96:4l+Pkl+/MsU2LERUyn9ZAGyyLaR+tETaPD8aewq1HxDMqoH:4l/kMsmRdYMagETaPY/wq1HBMpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975382, "uuid": "ca380f7f-da4e-40e8-95bf-ee1f299b7a93", "value": 4695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975382, "uuid": "48f3fe47-7465-4c42-bf8f-cb5e5b2c91e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975382, "uuid": "156a6b0f-e98f-4c49-bfa7-a2400724b553", "value": "images_20260724_114809.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963a6eda-880f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973595, "uuid": "05918457-7382-4869-97e5-53375f11295d", "comment": "Malware payload", "value": "429212c1a6cff81f1ee7c377ec6987d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973595, "uuid": "55e37cc1-efe7-44f4-8740-dd8ed67fb562", "comment": "Malware payload", "value": "1cde889d31c20ce18c5bd0abf21eada6afadaa39e80465034aa97f02f04ed80e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973595, "uuid": "de700c99-43c4-4dae-b1bd-99803a179a9c", "comment": "Malware payload", "value": "95bf915cc76fae9d2990b369f0b002a14f8287dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973595, "uuid": "8efff087-b543-4016-bc80-2ec0a049996f", "comment": "Malware payload", "value": "2a524d0a2d84274a2ad14a7b069f2f5df308f66be4274ce62f5b8fb88b7b123b3e8ef9f0de20ac4603016e36521f9168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973595, "uuid": "d9ffe540-2b3a-4ef5-907c-b54547a7e411", "value": "T14396182BAEB49528C25DC63AE4938F009F3378B50733CEE716A501654A4E5DBDF3E660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973595, "uuid": "b1ea8604-1d03-41a1-afa6-6027a3aaea1e", "value": "5268bd989d793b9e5b2276f95dbabb9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973595, "uuid": "d9cb7cf2-76cb-4b2b-b5f3-8a6fb659ecda", "value": "49152:oOvzgRt2l21dMy6ej/Ee6L8pFSkihTXWR54XXeWpjXdxbTKV71Jnvemq1NKcY3:m+jXfTKV71W1NKcY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973595, "uuid": "2dded007-20ac-439b-b023-c610b45f9c9d", "value": 8674704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973595, "uuid": "dca054f4-a7e8-4336-a879-081b901d0c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973595, "uuid": "500ec8cf-a0f2-4bae-a931-4978a366c943", "value": "NexusMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db297718-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784974140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974140, "uuid": "16a15ede-ab09-4b71-863a-ae6e57905199", "comment": "Malware payload (Vidar)", "value": "91092ecc0a5a3866dea9fb5088e6ad74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974140, "uuid": "84abfff9-771c-49ff-9ba5-cebe8cdaeed5", "comment": "Malware payload (Vidar)", "value": "1cfa40843d9e169e9df5d61ab7b6cc6db59a3237b8a3ca9a3fa047ef836d7453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974140, "uuid": "dbde12fe-bee7-4168-9388-6cf029e74a99", "comment": "Malware payload (Vidar)", "value": "aaa95d93a0a792db0411868121413e0cdc453373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974140, "uuid": "995b0088-35e8-4060-bca2-4c751406f705", "comment": "Malware payload (Vidar)", "value": "a59c3f14d20ec92ef072eac4c3953345c0c61bedbbca3858e3efbb4a737429dcc8edff842f21ad71039e95f2e4edd575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974140, "uuid": "23459166-2c93-4a56-a7c3-04ab1b36483a", "value": "T1EB0833897F62E13FF427D4B3D11866E8619BF188E733CB57112E85DEE8B36106B441A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974140, "uuid": "713dd5d2-85a6-4f16-b4cc-c2a9489660ea", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974140, "uuid": "623421a4-e5f4-46b2-b5de-af3938957766", "value": "1572864:bX2um44Hif/8w8jzzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyH:bXTm4vHOw9NYJo+sUifljLcs22/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974140, "uuid": "d930a40c-6f70-4460-be14-4f4044d414bb", "value": 83917595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974140, "uuid": "a7077d60-682d-46ac-bb8f-2e13274edec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974140, "uuid": "ee4124a8-53a1-4928-a05f-4b79393cc4be", "value": "figural.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b973e2-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939154, "uuid": "53b4fb1d-380a-4635-8941-4e25fc26380a", "comment": "Malware payload (Mirai)", "value": "4d370ae111b9f670cae7dbf6e57944c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939154, "uuid": "d9390404-9981-4817-8f85-59db26d857e3", "comment": "Malware payload (Mirai)", "value": "1d62e5957808cbd514010156ca0d3e63ee594a7db0dbf0b81da3001004b77812", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939154, "uuid": "44fc45b5-7f06-4d59-a42f-f0abf094aa10", "comment": "Malware payload (Mirai)", "value": "19a9311cb9a7c405c71781b53a3a759b5847f2ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939154, "uuid": "33acb3a4-b952-45f7-ac79-6e6dbdc763d6", "comment": "Malware payload (Mirai)", "value": "811ed8ef1031c7a59f205122dfc217fbcfd4d48c3d090eb2d43da22d0eaed5f82156dc18722cc1c9fa25713b12e1bf05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939154, "uuid": "3033d4da-2b70-4b5f-9882-16e71f4c6546", "value": "T157A43956EC409B91DAD12ABEFF1E824973531B78F3EE72129D055B3067CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939154, "uuid": "1b4f3bfd-b6ee-4094-b504-cee8c59807ec", "value": "12288:8Q8FKcD/pL8I7IpZLSzOaZe/1nAs8CXA2M4gRx0aklakdQRrKEN:ZOvLc4iQ4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939154, "uuid": "a832dca6-f679-48b1-8e7f-bf4243f645b2", "value": 485020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939154, "uuid": "8d2a2ed4-9643-4b7f-9320-d28ae8ca91c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939154, "uuid": "602cb8c4-6902-4899-85b1-d2ea0d04db8a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653670b4-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975660, "uuid": "b803fcf7-8cbc-4d9f-b35d-73f36a0d23d1", "comment": "Malware payload", "value": "9b4343d5fe6722a6c4aa41715d15a49f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975660, "uuid": "6d14cb9f-2307-42d3-b635-06d2cef8cfa1", "comment": "Malware payload", "value": "1d63588ab19e645c8e7af33bd5fd0e751ef8efeb409ae0aff8b1124e0e65d552", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975660, "uuid": "80553053-9658-4374-b211-f8291d3cd472", "comment": "Malware payload", "value": "38cda03c5d06c9d5fdaed21fa96c342a4afca6e9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975660, "uuid": "cf4d4a19-93a6-4620-a512-57ae446868ff", "comment": "Malware payload", "value": "01bfff998cba3ef3354e9720c0e96e5aceacb8f712edaf8405ee45270c427588b81a148d00df1667b94ae7011991dd61", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975660, "uuid": "d01b7bd8-5c4e-49d7-9cc9-6fee8556c653", "value": "T1FA02A044CB9ADD09C092367B34655496CF285EBCB7931A58B3CA88B4529FF445BC760C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975660, "uuid": "08535410-f738-4b33-b6f3-2054e418ad4c", "value": "192:M0JfXKoziUPDBOJwvM1mtqxIXxQhmWlwt/ku0rVgEdbV5usfbHa4:M0JfXJziSDBOekSxQhmWjX1164", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975660, "uuid": "fe6a37aa-cdd6-4b15-9e75-1eb2eadcdbe2", "value": 8322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975660, "uuid": "24f17c10-86d2-4af5-89be-e06e3f3fcd81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975660, "uuid": "8baccac3-5aa5-47ca-828c-e289d4649c85", "value": "images_20260724_154559.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3743b093-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784976871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976871, "uuid": "66aade6d-793a-4e83-9a3d-852369134489", "comment": "Malware payload", "value": "8879378814e137c3d4c0dd3b3cd4c0b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976871, "uuid": "c9e948d1-354b-4c48-aa8a-7e149ab503da", "comment": "Malware payload", "value": "1e08cca71caa1c1b13cc28ddbc20ca080f3807e6dd5cca5ced697b1d45f97307", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976871, "uuid": "c0fc1c7b-29d7-4c8f-8a3b-fd8798a30213", "comment": "Malware payload", "value": "adaa39bdd2d0602c618869d662b4babd950de539", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976871, "uuid": "7a08516d-4c77-4ada-90cb-c844114f239f", "comment": "Malware payload", "value": "ee378bf0f4d30feeb3e0a7e3a821ae1cc603e880973c2a7bff7262d4c8701ba89fb9c808906bd4b4f657a9fbb9f23cc1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976871, "uuid": "4d03e830-6f0b-4f21-8840-22848f559a6c", "value": "T19C843A8C36AE7055857E7CB7BA3F6094E555CC8152085098F6C8B8AFFF24B3A946EF10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976871, "uuid": "071cc1ac-4846-473c-aa02-88130034fd1b", "value": "6144:FZqRV1TAmTRDJ/KrXuT1PZxhaklqTOLLMASQT82irXOnYdPCinImyHTdpKMEANhj:uRVzZSr7OWQdpBrhv0DuE20hYU9+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976871, "uuid": "d9c7c90f-8acf-490e-a8f0-9456a1f75f09", "value": 407922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976871, "uuid": "d363e5a3-55ce-4b8d-9521-7bdacbb6d49c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976871, "uuid": "c095841a-081d-4b95-9a71-8fefce487cc1", "value": "1e08cca71caa1c1b13cc28ddbc20ca080f3807e6dd5cca5ced697b1d45f97307.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c462aa-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975761, "uuid": "b6fcf99f-18c4-405a-9487-15422237f023", "comment": "Malware payload", "value": "e2664f4ff5719cc31325c8cb03575e91", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975761, "uuid": "08f509ef-935e-43a2-858c-eab5dd183ec7", "comment": "Malware payload", "value": "1e8426200fb771992a460af1d715fdfeaaf3dab76e76292cead379f5261cae0f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975761, "uuid": "73daa5b3-e29f-4d42-a511-945c86216078", "comment": "Malware payload", "value": "67b7444959bd7fb007832db6ce432ff40001d734", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975761, "uuid": "42645bd2-754e-4db0-88d9-4e4c28ecb6c1", "comment": "Malware payload", "value": "af0558f167e97d6c4dfb30739c8b97e112eb9621dc736478616f5312580088642880d665e8b8df7605495c96df1e39c1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975761, "uuid": "b9e4388b-70dc-4425-9ec5-33d2cf3d975b", "value": "T11531E90244474884C23E99FEA7FA895C2865B0F0112EA49DF406B2197D02BF5017E9C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975761, "uuid": "9a321807-c712-44ac-b31f-6b8c18c92a85", "value": "24:9ODZcB2pyllkFxX5H3ulqTitvcZBxVoHAw7c1qZI3ATP5wKBpcj1dQBjYp4FevrM:9OFLgXMH+lqetvcZBxVoHFA1sKATeKBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975761, "uuid": "38eeb448-4c5a-45e1-93ed-32d313f9a078", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975761, "uuid": "2df7d844-c556-4f1f-b481-0f20449178a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975761, "uuid": "ae6990fa-7568-42e3-8e77-66db4fd2f17e", "value": "images_20260724_222323.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b432db-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973919, "uuid": "b0bfbc2e-141b-47dc-b9dc-436a423341ec", "comment": "Malware payload", "value": "761bbf8a7fcd2d7a4e5afe3945c0a345", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973919, "uuid": "2de4be73-fd9d-40fd-a2c2-de6c35a49cbc", "comment": "Malware payload", "value": "1eb5bb9aa31283022a2becd5d9eebadf4079225dffc08365a34d3a77983735fd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973919, "uuid": "caab200f-f1c8-462e-98d7-cac299146b6f", "comment": "Malware payload", "value": "a8fce48fe4d4e1b601bfa18bf975b03fa15af8c7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973919, "uuid": "c848f79e-15a4-488e-b63e-7273fe1ac3ca", "comment": "Malware payload", "value": "17df7183e1fd9738e0162e8e5ae732735469de0beb287885c98edf48c9355030c3de3f30a5ed90f3a87289e4e1a3a88a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973919, "uuid": "fc712b35-6a7e-448e-94bd-c4ea91191dfe", "value": "T19106BE4AF7489B6AC0F7523A0C355A61411B8CA68F83E7837D64773C58BB9C01F5AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973919, "uuid": "6544f145-437c-4864-992a-4607b582dc9c", "value": "98304:z1ij3XV7ey+EhwdT+dEYZk5d/K1fpYkx5rh:zEtOyHZk5FK1fZxNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973919, "uuid": "4acd78f8-057c-464a-a4ed-cac11de81e62", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973919, "uuid": "be70a8c9-eca1-45b8-8da0-7d61bc16ed8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973919, "uuid": "5fe543b0-2a26-497b-b007-c902ee2c769c", "value": "variant_02.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21421e5e-885e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785007329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007329, "uuid": "992565a4-25b0-447e-ab5f-88aa8e835ef2", "comment": "Malware payload", "value": "db923bdcc2637822ad560a7fdaf291c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007329, "uuid": "4b12dd5d-4497-4bed-82d8-d04586048700", "comment": "Malware payload", "value": "1eecf2377d20768c28d741e21affaa53cf26db0d083efdbf43a92fa938b7e4be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007329, "uuid": "a08e6708-a59a-493c-8b94-2c96286e2eb3", "comment": "Malware payload", "value": "6d1127c9fdadb9e8881b534ccc7cfff4068e464e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007329, "uuid": "89dc39cb-757c-43af-b79e-36684582d757", "comment": "Malware payload", "value": "9762c60ef81ebae767bc39f366cfe8d5650f838fa5eb369a0880e1a4b8b8fff3cf0520512233a8af4b0ad0bd06d56e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007329, "uuid": "f9f02cbc-69d7-41e6-be01-d13d578cbfbe", "value": "T1086533B4441EE3AB73889DD0745702691E4297B5CC92F01AE6FAFEF84385EA277D2443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007329, "uuid": "e7bb58f9-d813-4fad-a140-9ca41928df16", "value": "24576:SC6e8+QxSkuRCyUQhqWLE/oKaqVNAGZTUUrQhJX7Psc5pbqs6i2hAyBU3G:SXOOyU+dL0aIAsTyhNdus6iAAkeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785007329, "uuid": "80328b7c-8571-4de2-b936-e7661c36ec2a", "value": 1448240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785007329, "uuid": "85bacd4c-a1a5-4c83-9bb4-0b16dd7d17a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007329, "uuid": "a0a62976-4984-47f9-a438-5c899e1cf697", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9e7b66-87cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784944673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944673, "uuid": "201943e5-f4e0-4649-93b0-7025809bfa07", "comment": "Malware payload", "value": "a70a6fd3a35a4dadd0498518e2de1988", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944673, "uuid": "5d96322f-c396-4fb4-9095-2290f0e8c1ac", "comment": "Malware payload", "value": "1f4cefdd80b7cffdc0e8a47d9ca6d4fa663e9512cbf7cc31fb0e6d7175490c21", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944673, "uuid": "84c6ac7d-4719-42f4-88ea-1e00b2476209", "comment": "Malware payload", "value": "850faae79fffcfde04a21139f26240f009e93448", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944673, "uuid": "f46e92c2-6f84-41ef-8020-590477978eba", "comment": "Malware payload", "value": "474c0ecf94b6ef09f2b226ed6cb7c3ddee8382edd79c3d15dbae04b6b7129c9e7564f316cb40404054c92797e250078e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944673, "uuid": "f5c86216-6c0f-43cc-adf7-6e71d26aaefd", "value": "T18DD0955297E305B044614843D1C3A400F1000B3F8DF9C21E7D0BA4705F5874DF0C17D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944673, "uuid": "476a683f-30d3-41b9-a09f-9347352bf098", "value": "6:hTjjFgk59EtDyusSxOpAulNXYq4HvXDG+NjVsNXYrkJ:VCkjEzhSPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784944673, "uuid": "65b00631-f242-4c43-9f02-58d423d78d76", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784944673, "uuid": "752237e4-fb73-4386-9d9e-bdb94fa4da03", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944673, "uuid": "3b5cdb0a-dcf6-4059-8ce3-0917d6188f95", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5da711b-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998639, "uuid": "75cbdcac-0bf5-4df0-84f6-b59fbca54cbc", "comment": "Malware payload (Mirai)", "value": "416e1e0f2f920f3c37e6985cd21d5b8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998639, "uuid": "e74ca9b0-523b-4359-878c-4d2d208962f2", "comment": "Malware payload (Mirai)", "value": "1f80c3a9298fee062f1fc6ce020451cc70fb998b04262f153485b76ba7b5b43f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998639, "uuid": "e5e29236-b056-463a-bc49-a7aaff980a9c", "comment": "Malware payload (Mirai)", "value": "0e24342c0b8220a062d2acaef3c49585ba7f4f86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998639, "uuid": "3577c807-6648-4f93-af2f-86beb65eb2db", "comment": "Malware payload (Mirai)", "value": "9f1b973797819ffd104014f6f77a439b4d6f8d894b0af750f0ca7b2305affb47b90516c3b73b8431538f31279852dde6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998639, "uuid": "9ec59556-107f-4d3e-ab3b-690126d5e5f7", "value": "T15AC36C22B5391E27C4E0947A12F75366F2F657CD15A8C60E7E720E8EFF152902907BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998639, "uuid": "506d8bcd-1041-473b-b3ac-81a9f99a1d45", "value": "1536:X15L0RR1R76rx2STy3z4x1w45gkDxBYCZnD7jC4O1q2BQ5lpAvhdBiJYkytODPY/:FQwB+zKsUMhdBUYzMrYOQwPXOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998639, "uuid": "df7a52e1-d43b-4775-ac2b-7b4519de9e35", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998639, "uuid": "4da726f8-e893-4a36-a2f7-6fe1603187b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998639, "uuid": "1ea4d8e3-429f-45a7-b811-dce0d2a5014e", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cddcf0-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972821, "uuid": "a7aeb8a5-2d3b-4481-b2af-70a884dcdd71", "comment": "Malware payload (SalatStealer)", "value": "30d0e8c5d3deac9607282a0c49bd1cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972821, "uuid": "ba5bf574-e65a-4715-a453-55cc69bc44dc", "comment": "Malware payload (SalatStealer)", "value": "1fbeebd50284ce6fa42e48fcd3a36a8b27ee0a2f1b9ff8b4674f5bcdf4549ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972821, "uuid": "b5494dd5-5a6e-45ed-a143-26f405b8726f", "comment": "Malware payload (SalatStealer)", "value": "a3bcd9a3d387c7be8ae15aa5a2e71e0853a13ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972821, "uuid": "927aa1dc-8e90-4538-af6f-364913634c53", "comment": "Malware payload (SalatStealer)", "value": "ee1c7df36620eff2319b265a1165eab7075c6faa885992cc079f4d38858ebe463af5a2a8bccf9cc2d1e54bf77bdb13be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972821, "uuid": "bb70572c-a83d-4b38-9273-aa45584dd4fc", "value": "T19AC66C11FACB54F5E9035831406BB27F23315D048B28DBDBEB183B6AF87B6A1197A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972821, "uuid": "28e257e3-23a3-469e-8616-94818f11084c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972821, "uuid": "60b9c130-be99-4589-bccc-b5cfe7fbdc92", "value": "98304:1UhSHKu1UL+2iy0NeDqgtgu4sc3HX+6ElO/:6u1y0op6uyOlO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972821, "uuid": "64633513-ff0e-43dc-8cc7-505b4ae83a95", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972821, "uuid": "414fd9fe-c3ec-4fa5-bb96-e8ceb5adc250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972821, "uuid": "0c878248-938c-4299-8c81-3e15427d149a", "value": "00cb8d48f2571613e9bd7e9ef93986009cb5c075a9079f10d274910128f5bd40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd455fad-87fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784965929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965929, "uuid": "ed4c6c61-0490-40e1-ad95-a36f775035ed", "comment": "Malware payload (Efimer)", "value": "de4b52b0f65e583ab1be4564a3e863c6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965929, "uuid": "9f50978e-8f15-482d-af00-42d6546076cc", "comment": "Malware payload (Efimer)", "value": "1fd16cdde518d79227aedb9cec2e3b69ee47727e119cd8cec611cf1320e61265", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965929, "uuid": "2e7f4e5f-4fe5-4245-8ed7-1a1a30256d5c", "comment": "Malware payload (Efimer)", "value": "cae5fce1e51361e0c1b89119d9f0ca4a3a57ce1c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784965929, "uuid": "dbebc380-907e-4b94-bfdf-e949ab5c471a", "comment": "Malware payload (Efimer)", "value": "238fcac9b0ed46ffddfe069cab30e1c8bf2854aad8f27ae85be2d9ba34e38c4cffa0d8669778dd047a5f3dac72cb0b82", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965929, "uuid": "83ef4a8e-179e-40df-93cc-7db5f4688b07", "value": "T1B6E633186AD001FEE773403CDFE31691E9A874A24B76CADF47748A65AE232E1C43D716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965929, "uuid": "e5e13b69-03ea-44dc-b78a-a05dbf0a2000", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965929, "uuid": "511899ea-4581-402b-b733-edb90e483c28", "value": "393216:1xuqqUpwO5R2xFMS7n+vift67b9HwoJYXMCHWUjXZcuI3/PGTAI:1xrqUCOsD+v6t63BwbXMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784965929, "uuid": "228c4e8d-a709-4160-a26b-b7d14d082f3f", "value": 14271440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784965929, "uuid": "d6cbbe3c-d89d-4d2d-b564-dd3e2c38b258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784965929, "uuid": "0189cc9b-c97c-4a8d-8b9a-4f93ef8325c3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f377b259-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784975899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975899, "uuid": "63c10308-1989-43f0-81f7-fdf12423ccad", "comment": "Malware payload (OverlordRAT)", "value": "f2bc1f451548fadcaa799ab9d46782ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975899, "uuid": "47097a1c-00ac-4782-8200-47904fe5fcb8", "comment": "Malware payload (OverlordRAT)", "value": "20541efb895ad4079d4dbd7234c661c15b77d67085d67a0582a1b80fa093c16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975899, "uuid": "2c4a1cad-f7fc-4ebb-b2ed-30769e5cb867", "comment": "Malware payload (OverlordRAT)", "value": "a4e92203d12dba0319d421f67b6a07934e5495a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975899, "uuid": "33f84cb0-420f-4131-9be2-ec1bbb9394b1", "comment": "Malware payload (OverlordRAT)", "value": "4e3c7e01a01e95e3ff4df8defad0f1a0ac7de276e2bbc0db5867fa578d6c568c503f313ea1e3c014b43781941cf94958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975899, "uuid": "07f35d63-2bd1-4d7d-a38f-8ea4f7cb3212", "value": "T1A4C63807F9A946E8C1ADC131C976A2237B717C494B3127D72B50B6786F76BD0AEB9300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975899, "uuid": "eab04e2a-fd03-4425-a32a-6407ecfa4cd2", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975899, "uuid": "4b3c20b8-1242-4a63-aef4-1529fd4e5ef0", "value": "98304:bLoii83ASW0HL26LKa4z8uSD5uLK9hpERLE:HP7FLMzTSD54y4RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975899, "uuid": "412688ec-622b-49f5-b334-f7a6247ecee9", "value": 12402688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975899, "uuid": "04f912b7-5fc0-4765-bf66-57c449ec25d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975899, "uuid": "7b36dbbf-ce2f-45a1-aef4-bedfc47af083", "value": "agent-windows-amd64-d250904a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2bd6f3-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974818, "uuid": "74cac687-0641-43d6-a60b-97ce287b3f90", "comment": "Malware payload", "value": "4b75d5ed76abd2b69f2e990413b3adac", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974818, "uuid": "492114b4-5ccd-4237-b5d2-a9fd33959b31", "comment": "Malware payload", "value": "20b64bdfc698795a81219bdec9d9a26578f624aab1432bef73a3db4f8b2b8561", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974818, "uuid": "84c5cfd8-66de-4849-89bf-bdd64eed893d", "comment": "Malware payload", "value": "eb8013f58cc0a07e002abc3891ffe7c6d0c26d66", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974818, "uuid": "2fcd30ac-267d-4833-bcad-05dc8ab06b07", "comment": "Malware payload", "value": "736a599c445aa5ccfa0f5118a7494e187b061992be655125060673dff7967e4c9d1691f4648987956a638df923f3a31a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974818, "uuid": "d396b1f3-ef6a-413a-a272-3dc1e4c67c05", "value": "T1BCF1BF17AE623A77C9D30527BDAAC27365FB215EE444C5000CC882FD1AFAFD63341992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974818, "uuid": "0273a148-05ba-4a5b-905a-ee3e0850f721", "value": "192:b7NaM4JWulD70S7S0N+YoOSbyPXjyhh+OwJWEO2Tz:bph48OQ0JoOlPj8SwEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974818, "uuid": "c0eccc65-e865-4d3f-b95a-5b9ba39a516d", "value": 7713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974818, "uuid": "5bad5ff2-e851-4250-ac5d-466e693b1742", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974818, "uuid": "12265d41-ca0a-47d1-84f5-5bae5e589bbf", "value": "images_20260724_202037.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3688734-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984811, "uuid": "b49e76ee-81ed-4335-814b-86ffed9fbcd7", "comment": "Malware payload (Mirai)", "value": "7261cf827b4f784977e0eaaab0003fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984811, "uuid": "1f2fb05d-4cf0-428d-8caf-440cad39f081", "comment": "Malware payload (Mirai)", "value": "20ea19549d75930fee816ccace42c1a95e91bbff33e5ab2b003ae0983d2e5875", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984811, "uuid": "2980019e-7c13-4799-bc47-bdf894366842", "comment": "Malware payload (Mirai)", "value": "e67e1b67eae5a2263c3792d78e53deb09e1b7dd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984811, "uuid": "a827a636-328e-4a5e-a052-889d51a5b36b", "comment": "Malware payload (Mirai)", "value": "a7945cd15ec06489c0114d8377c4262f6bb4c6d1a3917c8294037811511b7f1d376322863a443e0e05c4f77875911405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984811, "uuid": "81b0a01f-d076-45d8-b20b-1bde4a8268bc", "value": "T18AE30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984811, "uuid": "34a187d9-8980-4959-9464-a19effa29a22", "value": "3072:3OtstuCDxzd9TOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEhZz:3+stuCDxzd9qFfDCcZwiAUtgKqJIZHhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984811, "uuid": "fc7333af-30fe-48b0-b06e-d8ba8e0042f1", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984811, "uuid": "94adf1ef-4bd0-4a6d-992f-157882d11765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984811, "uuid": "b0d70d0c-d65a-4026-9198-28bc57480013", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aaad2f-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784988886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988886, "uuid": "79b9de83-7cb8-47b6-8167-e4e28c29cf18", "comment": "Malware payload (Mirai)", "value": "0c3699d56a9848128faa96e6392783cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988886, "uuid": "a4208694-313d-4d9c-ace9-e0b4e1074963", "comment": "Malware payload (Mirai)", "value": "215263f470be44d8227fa86a2890faa64f3621bd22248d05fe92567bbbef5348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988886, "uuid": "1066e862-3ac0-4adf-a52a-8d9b7c322e97", "comment": "Malware payload (Mirai)", "value": "9aca66af89f33c3ef9cd98d97b20db02a8f6bbf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988886, "uuid": "01a8157c-e106-47dc-a2c0-4260c0fec244", "comment": "Malware payload (Mirai)", "value": "7525c3b8928474b42e0584be14d0097c0504f4d0936c2064e0374e8cd9d93652de0904d30228c21a87f8bf8083cc3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988886, "uuid": "9cd89751-21ae-4eb4-b369-a0b6e586f8eb", "value": "T136930741BC828A2AC6E023BAE66E728D3761B3F5D2CF3117DD214B12778518B1D67F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988886, "uuid": "d11c05be-0825-4bc7-95f7-b46ed97f1228", "value": "1536:0n9K+qfikRNHQl7MhHiIP/Y2oYPwTFNDBUe3AgANH3afzyLH0nzn:q9K+qfika+PAnXmBuyLH0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784988886, "uuid": "2c880dbe-d88d-474d-b9ba-9d558a6b3a82", "value": 92040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784988886, "uuid": "3a6ec151-ed90-42e4-ab9b-34931e07d415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988886, "uuid": "db7dcd1c-9af0-4fef-b206-28dd4a8a5410", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c151e6b-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975215, "uuid": "e4d52161-6e3c-4826-ad1e-920250e000f9", "comment": "Malware payload", "value": "5feae3e91bc07b93df52ddd6aad04ef1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975215, "uuid": "df92f33a-5cb9-469e-bf55-e8f89a5d3a45", "comment": "Malware payload", "value": "215f0883841d7cc1ec1ab56ed633502ccbfc3e580f49f6b645bd4d503d82c111", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975215, "uuid": "b91930e0-0a4b-4514-851b-61e8e38073dd", "comment": "Malware payload", "value": "2f1cd84b367670de26c917e6fe45ed32b704e432", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975215, "uuid": "4109f7b0-270b-4998-b341-8a997557e781", "comment": "Malware payload", "value": "a51859d70e9d5fe161016ef54cf1a0e3878bc8bc81a6d08ff8b8dec2423e57ac9dc8f3e954673d74e597997253c876aa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975215, "uuid": "f366c092-9d17-4105-b2b3-94e40efdead8", "value": "T10432BF6BA315EDC0E72B2659FF668CE7A42F40614DFD20E2FB149641F60DBA0402944D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975215, "uuid": "8b47f5d7-c8d6-43be-84d6-97a6890dc94f", "value": "192:42pcIFdcwtCq18mXTV/NJaVtbR18nmQDSTgDhrEOa5UEJ6viE+zT1FEUvazna:40c4dcwtCqzV/0FuSS7fEJIirzT7EUya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975215, "uuid": "20b20c11-0b3f-4405-9158-b947631d0083", "value": 11062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975215, "uuid": "d5716dbf-d84a-4c5d-bb62-9f4e175767c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975215, "uuid": "4063a56e-f5ed-4fa5-8250-80bd95ba01d2", "value": "images_20260725_015232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94a09ef-881e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784980123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980123, "uuid": "c1d17620-8792-44d0-8e33-e3f9a79e12e8", "comment": "Malware payload", "value": "aeee8f67fec136379cd5ccffc4939ff8", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980123, "uuid": "cd7c9fd2-8d73-4c93-9b16-77990e9d379d", "comment": "Malware payload", "value": "226b78eb2ba756120adf78e49a299fde116f524fa9bf43b81059e2b32672fdac", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980123, "uuid": "6ff6b1a8-af54-49d8-ac71-de0d3fbb72fb", "comment": "Malware payload", "value": "de5cd30cb21f5eb45207cec9976b652a14cb514f", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980123, "uuid": "89d0e3ac-560f-4d6f-b553-d4595cdb453c", "comment": "Malware payload", "value": "b48c0d0b9ff24bf20c44e84c40028adfdf7b00e8be8ad9a0a120b464d3da40df2c7ef925fce46b4b9433e090d9fb5059", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980123, "uuid": "57240460-a578-4a6a-a49c-2dcd58cfe137", "value": "T16A3102287203DB5A947255354ECAE0ACF922117749FE2D00FA5895938FFB245C169E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980123, "uuid": "d7b1168f-4c9d-4f8f-ad15-1a15ded886c8", "value": "48:k8z7G8ToDYcjCQm/Rfkgm4FmhJgQ8v98unXVo:lu8ToD8kgkzn8v+unXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784980123, "uuid": "c212a342-affe-451c-9bd3-acfc4d86c400", "value": 1649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784980123, "uuid": "ae0d6d5f-4647-44c5-bcf0-2bc855391016", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980123, "uuid": "e0484350-0636-4528-92f0-4ae36256f98e", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040c0ee3-8843-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784995683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784995683, "uuid": "4b212739-0ea9-4ad0-a457-f8980c0d0b04", "comment": "Malware payload", "value": "abb18892f4f4b5ae1069d64e494316a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784995683, "uuid": "878c0316-63dd-4ad4-9b29-294e38b79334", "comment": "Malware payload", "value": "267487b7a83f6ac4f1bcec7ed638d3145eed2159676aeba746fc67a0b708ead9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784995683, "uuid": "d64d8396-1af9-4f24-a419-fae05c35968e", "comment": "Malware payload", "value": "162dba05ef59a8a057dbac000a01a9c9cc7fd830", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784995683, "uuid": "e307b8d4-a82b-4eb6-8334-291ade283dbd", "comment": "Malware payload", "value": "f71196aaedf65632b63304ee40f71bad8da15ae7ae4f81c5b0fec0e104fed61e01d6d57b8325d1d1e1ebc9217ed915f6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784995683, "uuid": "bb3af630-7d74-40c1-b6ce-ae68069b3e0f", "value": "T184137CA566853C24AA9D89371C7F2F0CB9A983E1310491DDBFCB3CF58C49ADCA219719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784995683, "uuid": "e6cc6432-c206-4d10-a550-7da2f6064d3a", "value": "768:dQFWzZx5k9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:OkzDco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784995683, "uuid": "bd4cd792-ff43-4178-a558-c7ef7cd2eaac", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784995683, "uuid": "477f581f-677a-46dc-9578-c1fe02b62708", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784995683, "uuid": "eabf5b8f-2ba0-49d3-a3be-7cd845b3af4c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1540bddc-886e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785014180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014180, "uuid": "124e844d-fb05-4e53-ad8e-95df2e7bd2fd", "comment": "Malware payload", "value": "638375618fc15b94d2e3527509e7261c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014180, "uuid": "7d9eac1f-8770-4084-8e55-7739b4ab34c4", "comment": "Malware payload", "value": "26be0774f54837706f579d6e75cc8ae2262ec54aeee2d5944cb2cd3308ffe1f3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014180, "uuid": "0758930d-516d-4f83-9c03-259f8620905e", "comment": "Malware payload", "value": "9e394d3ca661807b3194e1f2502fa0bf4fc5c111", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014180, "uuid": "0b809992-4da1-4051-965d-07b473db18eb", "comment": "Malware payload", "value": "eeb9a78249ac74162ca03e70d41ac053092b39f980d24fcfe5d3007e6ecf580b689093b6adbac61d72f92c94d3087b0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014180, "uuid": "4d7e40a4-4854-469d-81f7-c861c73eed61", "value": "T159C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014180, "uuid": "7ee8bd08-8f09-4e3f-8720-799f3ecef89c", "value": "768:LY8vCB+25j6es8R49FYpMSUpi+20qUpi+20YQX:LY8l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785014180, "uuid": "3f3b55bd-7fed-4ce0-a9fb-17f2e6f76259", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785014180, "uuid": "983a1ab0-7a76-4e14-a098-900353d0f10b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014180, "uuid": "fd3d1fb8-e9fb-493a-a089-affea67fc05b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac4309d-8832-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784988527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988527, "uuid": "a26b18eb-afc6-4a2b-ab98-493fa8ec8603", "comment": "Malware payload (Mirai)", "value": "dd864bfd00c6e153619ef55dfcef9545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988527, "uuid": "939653d9-f17e-4995-9587-4f2d1acda5e2", "comment": "Malware payload (Mirai)", "value": "26dc5198545c66039719a1d42830c0957050c3d22d1bc0c0c8fed7da35279384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988527, "uuid": "1b0cf286-8114-4959-819e-ea91f4a04751", "comment": "Malware payload (Mirai)", "value": "940fc7ba1cacb6012a208d5cd30a1320544eb00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988527, "uuid": "3d5c0e63-4f1f-4e05-a409-cd418213b0b2", "comment": "Malware payload (Mirai)", "value": "a2e5fe85c4faf3ad942e2c70ee9aee4b02d97bc9011b8005a2ca4fec7cbd518d157e4b41868c943b740af3473814b6dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988527, "uuid": "bf93c2a4-ddad-41c8-9880-4626e868d6a2", "value": "T18DF33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988527, "uuid": "8c7d7b22-2c42-4dc1-8d42-ea683dffad7c", "value": "3072:0v9PHxAwpHQxWFrctE3u6LVFq3tpvx6ZPW:01PHJQxArcmu6LV03XwZPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784988527, "uuid": "6144a5bf-cba7-4acf-bb0d-f6906860c614", "value": 158956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784988527, "uuid": "7250e0ff-709f-4689-9e87-84dc6d7659e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988527, "uuid": "cda51b40-2fd5-4263-b1ae-9b893923f827", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ab8539-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784979464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979464, "uuid": "979a3406-1061-4147-9596-d0b408287f66", "comment": "Malware payload (Mirai)", "value": "29cd6a2621cc90cb1dda263f75e7d98f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979464, "uuid": "8b29675f-6adf-4621-bcbe-45173653ef71", "comment": "Malware payload (Mirai)", "value": "27fc94603f297473d6c42276bdbc3fe2d813ec66a63981ee1a887fbecec4271d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979464, "uuid": "d193b6dc-e6e0-48cf-b96f-5dd96b89f4de", "comment": "Malware payload (Mirai)", "value": "956f758776d2af97b18846f1d0ccc9d353f24f3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979464, "uuid": "8ff9a22a-4f65-4eaf-a635-38bb9bb954c4", "comment": "Malware payload (Mirai)", "value": "6e13db8d1afa4a6e9adcab87073b3d057dc51542ee8f0f3a5a7a94a2ef9e6ade6fa9a11760cabbb1f0069c11aa3aec84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979464, "uuid": "5d7eb995-ac98-479c-b171-4232f53a1ef1", "value": "T17D432955BD419A12C6C555BBFF0E428C77270798E2EA33039E25AF31378B86B0E3B495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979464, "uuid": "5a69c928-cd14-48fd-a196-d3809495b6f7", "value": "1536:Z34QAmavhdFWJ+zkwOiXACHMoYvxER4C:qvLFWJ++FwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979464, "uuid": "edf8ed44-4dbf-475c-8b7c-031d6b3c477a", "value": 59688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979464, "uuid": "d362c714-8121-496a-a22a-880747ac5fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979464, "uuid": "5a555e6d-a56a-4daf-83b6-cd863dfc7b29", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175aebd0-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991421, "uuid": "cbbfcc10-acfd-4208-99f8-02d733099f7e", "comment": "Malware payload (Mirai)", "value": "f5f1abb6b1316f5c626ec5feba2a6590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991421, "uuid": "44898d68-f43e-4619-8ebf-595f4be11d34", "comment": "Malware payload (Mirai)", "value": "28560ee3bebc7c33129624df3324c5b2303f81035703165eeb18f880b587cd73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991421, "uuid": "b98d3c3f-ae11-4976-9c4c-8710bf1f3924", "comment": "Malware payload (Mirai)", "value": "4e1828ba61deb8d340e85479e962c108622910ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991421, "uuid": "5c3d64b5-21be-4799-ae46-5512d2d47faa", "comment": "Malware payload (Mirai)", "value": "84c3414f02088011ebad9e889efc6a6421d833f185ae326389d7d7d4076f20ce5090f013fd847de3723017dfa6f31d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991421, "uuid": "8c3d63e8-9d25-46fe-9975-780fde90ae54", "value": "T1AF4302348226EC9A4D2016B7E4CC5FC37F5697B4C88A766123CC12D2F8E4A5189DFDA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991421, "uuid": "d0bdf9df-14e7-4c1a-87d2-23e9b24f8c07", "value": "1536:iGj2ig2gybbq0QbIx3UGurK4wkMEl4xCXeLM:jqisCJQbtrKbkdqueLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991421, "uuid": "386b2b23-ad0e-4ac9-9c81-2328b0a1563b", "value": 58780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991421, "uuid": "50276c2e-87a8-425a-a108-a29da3c7e29d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991421, "uuid": "593212a9-ab1e-4099-a65f-4f45ef7b449a", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4007f637-884b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784999220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999220, "uuid": "9ba374d6-b32c-41a2-988b-a125d6a5e3dd", "comment": "Malware payload (RemusStealer)", "value": "a5cd6f31554350d552c42dc0320c85cb", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999220, "uuid": "858cfe6a-f6a5-47f4-81c2-d365ac6b6ce7", "comment": "Malware payload (RemusStealer)", "value": "2880c19f853059bae15a838d1320f728d3f681ff8bdfe22d455bc0335d317c7f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999220, "uuid": "f7d149de-a813-4b9e-9ac6-9b8128e2d217", "comment": "Malware payload (RemusStealer)", "value": "2a67068602cd24a96338010fb040eccd08b60aa3", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999220, "uuid": "afe10e79-70d0-4687-a9a8-325d7ac8de88", "comment": "Malware payload (RemusStealer)", "value": "d44a605dcdd738bfa12dbfa4280f48b5fb68fc31821ecdb23b9a0b946d3663cf610469ebfa3dedb7de1696854691deaa", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999220, "uuid": "055f6965-fd77-4637-b0a6-72e8c2282429", "value": "T1F8253A5BB3E930F9E137C27985924A05EB72B4354721ABEF0360576A1F632D48D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999220, "uuid": "3b2ff2b6-40eb-4a10-8217-f0b804c71c7d", "value": "7d0290492937921b604a72fe395319d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999220, "uuid": "c232136b-6c26-43d5-abcc-cb7d9b4c5fc3", "value": "3072:P53+Z2c90aq86nJ4YvsaLuiv0SQyd9sODvm3klPnR8YQpl29p8:P53+Zz6JD0Gugdd9bvf/OC9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784999220, "uuid": "bc13b104-90a2-4c89-9f6d-78ef7cb2a78b", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784999220, "uuid": "477a2be7-84f2-4690-800b-e07720fc5f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999220, "uuid": "61a9a5f9-e282-4474-925a-5e943dda1e0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ec0b2c-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974755, "uuid": "36836888-f706-41cb-9f43-ede25bef5b61", "comment": "Malware payload", "value": "5abc7d60d52c4421a8d712cbc2c4f63d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974755, "uuid": "c36c609d-d591-4647-ae4c-659fefb81f5d", "comment": "Malware payload", "value": "28de15b5a599796ffd8dfdc1735c0ba80c2c5ed07803e55bfccd3994877f6540", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974755, "uuid": "7417e77d-65d4-40b5-8a7c-edbd31ce8482", "comment": "Malware payload", "value": "b72ad605ed2988ce605b702c0538e89f5cfa15f5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974755, "uuid": "521e069a-922a-4ddf-ab95-4114b0c137d0", "comment": "Malware payload", "value": "9b52da57f0538d125c0368fa7ab5ef705dbc9ddf2921120868b5dcc2ed0742fb208e42dcdcf12de20b0291c430a37765", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974755, "uuid": "c4b01550-fd4c-4406-b8b1-d9be0bcfbe4e", "value": "T1894119FA5E24495DE4218AF021BF41B5446485A30A05F18F039E15383BD3947FBF39D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974755, "uuid": "54c57fcd-6a4f-4835-8a94-fd9cbd5e95d7", "value": "24:9Vzeys9i1SMVlP7Yk9lpH6F8E3EhEc+KUukcSL59CXk8gTSL1xAF+Ilj2O5i/yBy:9VzC9yJjYgHi8kccdDmQF9Bi/WagmLmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974755, "uuid": "6cbbac43-0e0f-4e92-aeff-73b2f615e2dc", "value": 1944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974755, "uuid": "e0e99d97-9e93-4a99-b631-ceb7d82f862d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974755, "uuid": "9fefada6-239d-446f-8250-696ce4568c80", "value": "images_20260725_062558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f1d95d-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975815, "uuid": "29e1b80a-392c-493d-b51b-74d0769945ae", "comment": "Malware payload", "value": "7e4c09e86c66b3066b117d44a3f270fd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975815, "uuid": "b71b3830-a525-479a-91fa-41a85bcc3f5f", "comment": "Malware payload", "value": "295cfc34a2f3f3642d9fbf5bb1629399419949c67492a64285f203c333e90b8a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975815, "uuid": "84c14a48-c390-433d-a982-9b2639a1eadb", "comment": "Malware payload", "value": "8ce99bc5242befb8662a6ca1d226bd1b41ea72b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975815, "uuid": "6c555883-d1ea-4747-afab-b4a97883ac78", "comment": "Malware payload", "value": "8999babeadce118fe9f6db4906c8059f7a1598ae8766491051a1b132ca1190700971c61255329e12995565596b9fe297", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975815, "uuid": "a1f235be-61c9-4519-b0d5-66f423c3c7eb", "value": "T14942C0BD033E4807D2119BBF638C2D13F6EB088766A8ADD6ED350E1E0CA6F550897721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975815, "uuid": "2626257c-45f5-4d4d-b9c7-340a8229249f", "value": "192:D4NTJ9OrsBmWzR+WEgIknlqsdsbvwZv5wCHaGtVCBOvzF0jvsuxn19gP73kh84QM:kNTJNzR1zlqsdaaEG/CBOvzWj7o0hWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975815, "uuid": "a323d641-bfac-4420-baee-b336922740ba", "value": 12499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975815, "uuid": "47b972b6-f617-4c03-b28d-cb45e800a71b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975815, "uuid": "caf4fecb-2a31-42f9-93c3-a0fd5ddf999e", "value": "images_20260725_005724.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa99d62-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975597, "uuid": "8812bf68-85ae-4f1f-8641-4afb144f2a34", "comment": "Malware payload", "value": "f3a980b74eef5a2dc3893ebfa8c1ea49", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975597, "uuid": "1237109f-4985-4bb0-a255-e56199d7e890", "comment": "Malware payload", "value": "2a0d9b6fb2be860c56b3e09db57ad50d2a05eb9499a60a052935fb3631090504", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975597, "uuid": "4229a1e5-9a36-4ca4-abdb-8e84a801e8d9", "comment": "Malware payload", "value": "a52b82d855be52e05bcc442bbe7a59cfd83d7fb8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975597, "uuid": "1ca5ba71-baf8-497f-8b44-73f4c273fb1c", "comment": "Malware payload", "value": "01c055aab61e1fddcf8895366be5ad7835c9dc45ff2e3c1e26d60a174577b24f44f1026fc7f96936efa6fff6d932f915", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975597, "uuid": "a691be66-635d-4707-854f-6f75a859aab6", "value": "T1D6411B144D0E45A3D4E7D23D11FD19C14D2EEF4B11A1945B65DC270A094B7E24D95B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975597, "uuid": "5f117e86-94e4-4c10-ad18-f190a32bb3fa", "value": "48:94ORBmFIfXyAuXnw4hv6W1NdwK1GrykiMj8ejINp3R8aH56htd9:HWIvjun+Brev1N9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975597, "uuid": "75dc23cc-f0ab-4897-b34d-32f9107bb2aa", "value": 1904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975597, "uuid": "10b3fea5-310e-407c-a255-030afaf45c30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975597, "uuid": "196e7579-3782-4887-866c-4ef15ffb9a83", "value": "images_20260724_155519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fde7c2-884e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785000631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000631, "uuid": "5e76e89b-a210-404c-a429-4527ec06a1a5", "comment": "Malware payload (Vidar)", "value": "c7fe8f4f25bad097efcadcd798da0a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000631, "uuid": "7071ecec-2d9e-4970-bade-3b413990b1bb", "comment": "Malware payload (Vidar)", "value": "2a5050ebca4c8fa135b80503d1d2bdf77ec30e8089cbd318a939888048957b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000631, "uuid": "0ade88b9-b6a4-408f-b744-4febf841db62", "comment": "Malware payload (Vidar)", "value": "9b45d7455d950bf89bacd045a5b5545c2ede865e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000631, "uuid": "73f6c855-c3dc-4371-af8d-b351bb4ed4f4", "comment": "Malware payload (Vidar)", "value": "75a1059cdebe649208fac00844cc25434cb45c7c980d096b25cf32bbbbc4b82f07c1d7a6a6a4b74a863fcfff5022fb55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000631, "uuid": "f2be690f-4ffd-4c76-bb85-e25a9dfbf935", "value": "T126068E03ECA588F5C4AAA33289A752567B75BC091B3223E72E606B383F737D09C35755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000631, "uuid": "0ff075f5-8617-4e3b-8279-dcf2523e99aa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000631, "uuid": "cb35a222-28c7-4fc7-9055-90bd8ec72252", "value": "49152:POQXcLIFCIz4JECtAhFS5Eg70z6iITtC3jI7pQpK7:PIeC/7Y6iItIjQo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000631, "uuid": "aa0dd2a0-30a5-452c-8bc5-73de9bc42d03", "value": 3871088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000631, "uuid": "9a1bc56f-5fd9-423f-bf53-730b48a7c5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000631, "uuid": "9e76b1d7-f638-4155-b379-3e0d3eb7e683", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a24ed4a-87f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784960716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960716, "uuid": "a17ec405-12b8-494c-a4bc-42e30c6e8f6c", "comment": "Malware payload (Prometei)", "value": "677c707828eedaff5c42a438ac44027f", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960716, "uuid": "452e270c-da69-4f2e-b152-efcad4caca61", "comment": "Malware payload (Prometei)", "value": "2b4a338c4c933710a1757733576d3bd2e02819c6275de7117f4ea5e1ec441639", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960716, "uuid": "6c8104a7-b42f-46c7-9210-248f8258ae7b", "comment": "Malware payload (Prometei)", "value": "19ec3f60572473fc0072d707bffcda3689f0ffd2", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960716, "uuid": "a09ff170-0a04-4aec-a815-15141a69c17e", "comment": "Malware payload (Prometei)", "value": "cfcaf3137129e38f57ddfe7d5feb247f8b31f54eeaad74f553dc3f19df5590f052950b63b7a755e24cfdbcd75b1a4aa6", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960716, "uuid": "a2e2302f-500e-4562-b0f5-375c7ff8077c", "value": "T1E5511DB9B404F231B30E803A3A6FAD50304F816F280D2C2A744FE55C9FDD0B857E85AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960716, "uuid": "b1db3944-110f-4eef-a98c-e9c4c3a3c948", "value": "48:oWq/VkaDlbHyB9/HbX7HFyCPVpBCnLWMH3pNMMOeHFPZC7VpBCnLWrH3pgMMqhcX:oG4bHyXHPHFyIVulHZ6oHFxUVuCHZJ9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960716, "uuid": "15cea640-c651-432f-be23-6e94c7d498af", "value": 2989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960716, "uuid": "1cbd2a3a-1d35-4266-8ea3-ef8485df41ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960716, "uuid": "13971f34-63f7-434c-b187-64eb3c1c9b86", "value": "2b4a338c4c933710a1757733576d3bd2e02819c6275de7117f4ea5e1ec441639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbf2798-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975188, "uuid": "e37c7980-bbdd-4643-a176-762f39d5a84d", "comment": "Malware payload", "value": "414d4c3517c60907aa58e509f8079499", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975188, "uuid": "ae164cdc-eaac-4007-aa16-6c70a6394187", "comment": "Malware payload", "value": "2ba0c36840f969c65afdebe9f780b40bdf4de1d060ab1b46c18ca4d26d1627c1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975188, "uuid": "c2a341bf-45d3-49fb-8e79-02e677552bed", "comment": "Malware payload", "value": "e55783f6803cc63d3d6cad0d60a58f68f37ccac3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975188, "uuid": "47148f76-1891-4b69-9427-dad78054b424", "comment": "Malware payload", "value": "2cc68bb0a19e751e0aaae8fcc9dbfa1ff14e44ee239d7de93db7e43c1811cfa3bcb154d2434a6eb75cb2061f145f129b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975188, "uuid": "519569ab-ec8e-479f-8897-6867a7964278", "value": "T1FBC18E999BF2595CF903A8F937C02E442F18DA3226CEC95531CA491B6F4930EEC15286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975188, "uuid": "90507b14-52ef-4b64-9692-21f82f84ba4a", "value": "96:vD0WUayG3btZfPNAChlIqld9WdjdAuGUunLy+aKLUJTrsOOZNVKmo+ku:rL/FXiWvWpCuGv2+5BNVKmo+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975188, "uuid": "30a9d169-a6e7-4a6f-bb69-42eb0b738999", "value": 6074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975188, "uuid": "21d2fc68-d763-4cff-b859-298d1452f931", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975188, "uuid": "fcaa85f6-1451-444b-8291-d32b78f0017d", "value": "images_20260725_052107.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18185614-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991422, "uuid": "7fefa0b8-2097-449b-a947-7b53b55ba7a6", "comment": "Malware payload (Mirai)", "value": "83caa08ce9ad70697451ed8104c96006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991422, "uuid": "603d17f6-0de1-44cc-8cfa-90615562786e", "comment": "Malware payload (Mirai)", "value": "2bfc941fc4465567601c3a91f46e605dea8a526916126160c62b66c14fa78d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991422, "uuid": "49644dd9-8e30-42a8-86ca-b44c5421841f", "comment": "Malware payload (Mirai)", "value": "85d461128e38502973cea677237e2d7b7791b62a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991422, "uuid": "c7508052-771d-401f-9119-a8f88d4f6688", "comment": "Malware payload (Mirai)", "value": "5ac7f3ffd4a4629ef9ac2d3385a247e86e01cc19303e9260c5eda695140f7b342f63e95485f7e34700daf9132275193c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991422, "uuid": "d552a7e8-74eb-411b-a762-e598c347683e", "value": "T149A2C0B86547EA70C47018BBDA30D987220F56B9C4EF3A7352A41308B797D1A87F835B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991422, "uuid": "108ac727-c06c-4c61-9f7e-baa861b93555", "value": "384:Md/jrrIGND/spqf2xmfCexyc9uD3AzN3Hs48ogV1+++hymdGUop5h/f:WzZ28KexyqunD3Vas3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991422, "uuid": "3b496aef-ed24-43a0-af4c-624bf0770107", "value": 22264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991422, "uuid": "dbb4e47c-ea01-44e6-85f7-40335172fa7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991422, "uuid": "dbd11753-41a4-4349-acd9-dbb0e25fba56", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5566e591-8870-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785015147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015147, "uuid": "beae3c26-384c-4de8-ba6d-486a2ed83cca", "comment": "Malware payload", "value": "536fab297f29ea750594e251814f1085", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015147, "uuid": "441e9457-59cb-44d8-9e23-388ce45d26f8", "comment": "Malware payload", "value": "2c8301d65528cc47b1d99ceb850d39bfb4d5c90ca771b9ec483280e3be67dcd5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015147, "uuid": "e7b50e8c-219e-4f4c-91bc-7343f70e8e89", "comment": "Malware payload", "value": "187adba06daf53bcf7e924a7cb07940de66b156b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015147, "uuid": "5e3dbc46-f75f-41fb-b5a1-fe5d864b995a", "comment": "Malware payload", "value": "278bc1f6f3889b903dd45258bed2912026c230bf2a34359289d20be5092b1dea381db6097190a8f3819e9d78f2fac078", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785015147, "uuid": "c61a5677-af7a-4a3e-9d19-7e710c033075", "value": "T189137D595A953C259E89893B1D7E2F0CBDAA83E5300851DDBFCB3CF28C45A9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785015147, "uuid": "bc546d00-106e-42c0-9962-e635ed333aa7", "value": "768:uVEJVIhtMH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:MEJ2Mwco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785015147, "uuid": "b267e536-4060-4472-948a-38592f362aa6", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785015147, "uuid": "967fc754-8804-46af-8ecb-3d917c258565", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785015147, "uuid": "bc41bf43-ae4d-47b0-8012-5f1e8317e12a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a74e3c6-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974675, "uuid": "8a3d9e7e-169f-4e8c-8659-0b4efe9b8ae6", "comment": "Malware payload", "value": "81dbb538494a3ce5c0fda409f8de7128", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974675, "uuid": "a983fff5-e8e6-4d1a-802a-efcc7741a6fb", "comment": "Malware payload", "value": "2c85748807b0cff81fb0f6c75a9ce28107cb3975d28ddeed1b400e3986be6953", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974675, "uuid": "ddae2ba5-18c3-4e15-a914-e6e10fdfe8e4", "comment": "Malware payload", "value": "fd937061f4ec1667501d85d7d388ad798da6e7f9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974675, "uuid": "9e3ba69b-d0ff-41ea-87b2-628df76d9526", "comment": "Malware payload", "value": "bc778c197bedfe25a2b19a9781ddc964a388f6eea7b5fe2a383633f12317ce871e63608843e96e5f763629feb80374c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974675, "uuid": "ceab2460-f27f-4f4b-91a5-9ce6c896de7a", "value": "T1FA514C3E81198362F64DE8F114F7278B2A78D40883210387B1384D162E527CB5B728BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974675, "uuid": "2a876837-c3a4-4a42-a387-06e802148b8b", "value": "48:9AIEN1ahzX2YUra7GWhfnV9Nnb7xBCNAz+sXetl1puH38lSQbQCi:mIEPczmY8+GWhf5Nqt48lSAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974675, "uuid": "374f6f82-e621-4443-9e26-fe6455f6f97b", "value": 2664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974675, "uuid": "7d30b843-3d4e-4a36-b4ac-0388a14d3e09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974675, "uuid": "229c0d37-6b74-4ea2-bf57-d6bca9caac0a", "value": "images_20260725_045554.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c73871-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1784975344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975344, "uuid": "f278299b-7416-4f0f-81e1-c687d8c3fb56", "comment": "Malware payload (OverlordRAT)", "value": "f3a81cd70d0c86700e45b9de40644c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975344, "uuid": "d1268112-8984-4277-a441-80fc2efa37f2", "comment": "Malware payload (OverlordRAT)", "value": "2d9adcb653a222351652077abc838e027fa814f120741c7fb4f14d71d03f9fa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975344, "uuid": "ad965353-81c3-4307-93e8-5a00253d39cb", "comment": "Malware payload (OverlordRAT)", "value": "09301281e99e74c52487211f8555571e2b1e9ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975344, "uuid": "1840069f-5dcd-452c-989e-b7d9cb6b4504", "comment": "Malware payload (OverlordRAT)", "value": "e9f2544a9ad69c469bcf3ff5188272294e5b0caf05906c90ea21d1cf2aa65a4dacaa79ea8b51752221d8e98dc04fcd2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975344, "uuid": "cb5643a9-8e8b-455a-a2a2-4497ba1c6787", "value": "T144273A17E85518E9C0AEC134C9679263BB717C491B2023D72BA0F7252F76BE0AEBD750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975344, "uuid": "d3445992-9c86-4034-a78b-7f4a53f1bdb2", "value": "e35353effe7047db8af5e79efb1cfdeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975344, "uuid": "b7b3e000-9117-4aa1-bbc6-eb4fe5ac6fff", "value": "196608:917IcYDVPxOmw65y7Tl7BDNDTgDjtoYV:96cYDVJDw687Tl7zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975344, "uuid": "a41f9eba-87eb-43fe-9f51-9148ec890691", "value": 20822016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975344, "uuid": "9009933a-fb12-47d5-9e59-37df3adc3d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975344, "uuid": "61736565-7bc9-4956-9cd2-a2c4d0e97552", "value": "Cleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb1d8bc-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974038, "uuid": "a8a7249e-1539-4f6f-b8ba-edf7352134dd", "comment": "Malware payload", "value": "f2ef0bf6ac7fd231e87193c8a994364a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974038, "uuid": "116b8558-9ef7-4d6a-8cd2-ee9e74e1eafb", "comment": "Malware payload", "value": "2e09605fa2efa85a78d09dcd10c93066a8b59bc4c298afc641a9458d9eef33b1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974038, "uuid": "a4cbb2b7-893b-45d3-94dc-afac5493a5c0", "comment": "Malware payload", "value": "2851f4c46e1ce3f314ae3d35bba899696731c690", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974038, "uuid": "d93d5e77-aa85-486d-897b-ae7148b90ccc", "comment": "Malware payload", "value": "26dacd030a74de6d1967fa19625b6b6159a3d4b0fbea1da2089a2c5f69c936a9a8c2b75fd53057c7f71d57d45227151e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974038, "uuid": "a00fc703-2d72-4b25-86cd-48284c7b5cff", "value": "T19706BE4AFB489B6AC0F352364D359A61410B8CE68F83D7837D64773C48BB9D05E5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974038, "uuid": "51655c0a-9f7e-4470-9839-7699af0fee3d", "value": "98304:g1ij3XVVAcAEmeJcTTwTY5AWacuTNgVL7tmjmk:gWDKATY+vD6l7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974038, "uuid": "dcf01d3d-f509-4a9d-8d8e-b10e619cc5a1", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974038, "uuid": "8b5a00da-badf-417e-af1b-a6aa6e307302", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974038, "uuid": "f4be3238-6de7-4915-af45-e71f9ac71fdd", "value": "variant_20.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ab0e7d-87e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784955129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784955129, "uuid": "7f604e0c-2775-416f-9345-c8ef0ddf471d", "comment": "Malware payload (Efimer)", "value": "905448056013f06904b511ee9bb7d3c6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784955129, "uuid": "d95aba23-46d9-4c5c-88ac-f82000b5e163", "comment": "Malware payload (Efimer)", "value": "2e9aae52a4d86d9006695046d6ec8ce67f6999c567a524c18d8922072284e72e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784955129, "uuid": "021871e4-1076-4825-a645-8c7836034d00", "comment": "Malware payload (Efimer)", "value": "35ba555b6b662b860ac590b8af983c54868defc3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784955129, "uuid": "5b124401-4075-4d7d-af5f-a02614754041", "comment": "Malware payload (Efimer)", "value": "ffa809da5c5a4b5aa60f1826f621989aba2e6423b17b79914896ba8728797785ba86c50c3eb7b475f2d62c710c5b28ac", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784955129, "uuid": "80fd51f2-cc80-4762-858a-3cff7ae1c531", "value": "T149E6334C7AC441E9EDB3423DE9B22618E4E5B8B00775C99F476807E5BE172E08D3EB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784955129, "uuid": "8dc3e113-dabc-45fa-962f-3254bbdf0bd5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784955129, "uuid": "8f7091f4-bd3e-4de8-b9bc-7282a4fb0be0", "value": "393216:sW4mIVcxRIuA3Absb7WXMCHWUjXHcuI3/PGTAI:sbmI+zA3Ae7WXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784955129, "uuid": "88c54edc-11a1-4e64-be41-0fe0ee803fcf", "value": 14273688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784955129, "uuid": "09a6e5d3-ca21-473b-86ec-fe8e204c91e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784955129, "uuid": "8b4eb43c-8b04-41b4-8082-068637e69c93", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38ee8d8-8855-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785003682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003682, "uuid": "0d6a5fd8-f786-46e7-a801-ccf03f37906b", "comment": "Malware payload", "value": "026312ed570610d33bbebb999b095668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003682, "uuid": "cda0bcce-36b6-464b-98bd-841325c43058", "comment": "Malware payload", "value": "2f206563640dd66a743ffd493ce0e3c31a8fc5a24b9f5d2b540fc22d45c13d66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003682, "uuid": "81870dec-5bd1-478c-a18a-6232ab5de782", "comment": "Malware payload", "value": "5c54973e56a98a414d865f4e32f508f7579066d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003682, "uuid": "0ab34887-dfd2-4411-a679-cb15ed96aca0", "comment": "Malware payload", "value": "c8b7e34cf8da07f69504c098bc527f69b5b4d80fa88763762337aba2372984028d60e94d87c6ab3087b45a470bc77897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003682, "uuid": "0430d3e5-73ed-4145-beab-a8151234399f", "value": "T15E85337339E27BF5CCBFA6F0A649EF19919E2260690FDF88E452CA55C4D90A37311384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003682, "uuid": "4d4c79b8-5f19-4780-8f2b-7e166e11d869", "value": "49152:SeI/oZTjidHVh3oUgnTUQzlT3chu8MRejJ/V1a4:NaoZXW3oUOlx3cqRo/Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003682, "uuid": "6fdff9a7-d831-4a8e-b6d7-d9f9c28cffd4", "value": 1736816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003682, "uuid": "943aa489-c7b3-4be9-8830-fa31d12dbd07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003682, "uuid": "ce96b73e-7d72-4326-988c-21e042d60402", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5fbadc-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784981869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981869, "uuid": "82d0703d-7188-4bb5-a7ae-b191b95e6bd7", "comment": "Malware payload (Mirai)", "value": "ced0f958fd3c6b9ca905bb7f12773f3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981869, "uuid": "3e672c68-61cd-447e-8660-d469787bc828", "comment": "Malware payload (Mirai)", "value": "2f29e4df0f650e9d0567c195bc1d847e79d431f97d3eb080f84d179d0c5a64dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981869, "uuid": "32a3e08a-2c9a-4b5f-95e0-11b704645290", "comment": "Malware payload (Mirai)", "value": "6348e3e728d55ed61224bbddef396529195eca8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981869, "uuid": "bbf9bb8d-8a0b-4a97-8213-31554cf0c31e", "comment": "Malware payload (Mirai)", "value": "8d02ef3438ba30863ea749963391a73486bbef5d175fc942f51a5892341c4cd5ca2b405d228affb26027d2d2eaa68244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981869, "uuid": "50468bfc-6583-4f6f-a66d-a06f2ef1b8be", "value": "T11BB34AC5E243D0F9DD6605306172FB3BAD76E0FA132DDA82E3B58A72B8226C1D41675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981869, "uuid": "48303063-772b-4d6f-89cd-679a4867d3b9", "value": "3072:vKDYTd+7F2pEXMtOABsGjnluLr0x5EDI9/rFPHYC/BL:vKDYTw70EXMUA5jlc0fpPHYC/BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981869, "uuid": "438bd46a-d482-4538-bb44-c68b01127449", "value": 116500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981869, "uuid": "cf786137-45eb-4a28-9ed2-4e4115bcc1f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981869, "uuid": "51242eb5-0168-4e68-906d-87055d59f69e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc62644-885f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785008125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008125, "uuid": "eeba80e7-a145-4790-8ed6-d3135c637bdd", "comment": "Malware payload", "value": "7be394c41b9b147fc81bdc08100447e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008125, "uuid": "0ec633bc-9de0-4711-b821-5f9680191cbc", "comment": "Malware payload", "value": "2f92eccabc10aa2ddd4ec44fe4ab67deb30535ff885acb8b1aee4686be47523d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008125, "uuid": "444af559-8095-4a11-bbad-f839d40bd9f4", "comment": "Malware payload", "value": "c07a1579d0935642d14f2b2ce07ffc816275c74c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008125, "uuid": "94e22dd1-f5d0-4450-af03-507d49f6a54b", "comment": "Malware payload", "value": "f5eff9d5f04c4c2cf9292f7a11b1974bfe3dcaa19daca046a1bb71d2132fb0c6c00e29ecf8d899cdac6f36098b1c5d4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008125, "uuid": "140118e8-939d-4de2-9559-87897c1f9e2f", "value": "T1B5C26C966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008125, "uuid": "74ca8671-bfce-455f-af4c-41fe03954b31", "value": "768:c8vCB+25j6es8R/9FYpMSUpi+20qUpi+20YQX:c8l25JJd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785008125, "uuid": "f83652d8-e1ad-44b2-b175-2e43c60a8d92", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785008125, "uuid": "35740a00-ee7d-4c1a-86c0-c3ea2d02ddd5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008125, "uuid": "f582787d-375f-4e11-92e7-d611a9be7517", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af7e325-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974730, "uuid": "2e8ab057-c36e-4cb5-aade-3ad9f2bf6462", "comment": "Malware payload", "value": "252752c896cde26990f95f0e2434d1da", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974730, "uuid": "d8119b74-61f6-4bf2-b504-275860d10432", "comment": "Malware payload", "value": "2fda2d186f0f2d0204987eabc74207f77f2c3b9a9a9b2a5c7edfcf3c04529c65", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974730, "uuid": "2a3c6b30-84ac-4cc0-a682-6728064e5f98", "comment": "Malware payload", "value": "eaf7ee2fca4d40207080c3e95d866c6c2c0db90b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974730, "uuid": "47b02b83-4a79-413f-bd83-f0197526d5be", "comment": "Malware payload", "value": "580baa9d16be8b040a789bf938743c4f12a3dcdfaf12d9a10e8f14632d9ac62e82de880c70b3cd311993b533af0e55a3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974730, "uuid": "d59791f4-4bf2-40e5-831f-7a19995cffe2", "value": "T111815BFC712DCCD3DE53DCF0A74E1997A64798E4208A0824CB782CFA56C7968161BA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974730, "uuid": "dea3f4f4-1ff4-4c76-b333-45f21dfabeeb", "value": "96:gRCCnUWpiaEkLP0HIHBeP0I2A+rSZHHKt0CuzCWINadlfN2RGJN:gwCtsRgK/1HKt0Cuz5IifN4GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974730, "uuid": "e8864b8a-da21-4584-bf4e-3e472a754c30", "value": 3839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974730, "uuid": "63ef8f9e-89c1-469e-8952-9d9c85cb9831", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974730, "uuid": "e7f0f167-c588-4981-b018-42c0a7dad978", "value": "images_20260724_175111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73def929-883b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mettle)", "timestamp": 1784992435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992435, "uuid": "399334c0-e073-4242-b6a7-035d0382844f", "comment": "Malware payload (Mettle)", "value": "4fadf38854f6f170c0a8f3e9ace0dcd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992435, "uuid": "3221aee8-f9e0-4ee2-806b-27dcbcbdd2fa", "comment": "Malware payload (Mettle)", "value": "30955adfb864533f1d6a46b25f02aa79c5c5891d0b536eb9da9d33bcaa1061db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992435, "uuid": "683e21df-c503-4722-a6aa-483b0271164e", "comment": "Malware payload (Mettle)", "value": "2820cd2f56c7a4750a2066bc840e6c4a1b664568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992435, "uuid": "6d50e764-cf71-447f-85df-d69117d01073", "comment": "Malware payload (Mettle)", "value": "dfa56893dfe1081fb900dabf88b4e84aedcbeccf91d6c9f31af9bfec65334648d228ae13b7b83fa6e7e41e387046ea32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992435, "uuid": "fbd5d99a-c8f1-4334-afa8-52ab12d98cae", "value": "T172357E0BAA9504BEC5F5C4B0875FC233AF71B4895212367B2694EA303E67E346F1E791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992435, "uuid": "70b374e5-d40c-4580-a2a0-313065fd077d", "value": "24576:wA02G4dDtanDquV+gtV8R0OcvrTud1KEj0hi/djV:y4dDtaDqCV8RrkTYJMiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784992435, "uuid": "519493d7-dda9-4918-a369-472ba1962847", "value": 1121480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784992435, "uuid": "f63487a7-c063-4ada-bebd-8f288c6c5c90", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992435, "uuid": "674313c5-ebad-4a88-b835-ff6adb017784", "value": "49.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81b9c78-8861-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785008870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008870, "uuid": "7bdf6023-d191-400e-9dd8-120eef684355", "comment": "Malware payload", "value": "54ce2b38d32b12708dc5b4f00430f284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008870, "uuid": "11e12713-f663-47ab-b96b-70a0c6211ff9", "comment": "Malware payload", "value": "3100f5931301a7968b274bc718c8363fe8b73cab7b997cf4ae161e39d06197ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008870, "uuid": "210d4765-688d-48c7-9fbf-39ac20b7bf0a", "comment": "Malware payload", "value": "4022c1f0fa37d2ef0775a5cb6a411b27321d657c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008870, "uuid": "392aa90e-2de8-4e73-9dec-9ebb2c9aefb2", "comment": "Malware payload", "value": "e397157989c41faee818dbbfd37cda8a423fe158aae118568f87e755087a6b704162455b6353f6e5018e4be6e63002e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008870, "uuid": "fe264b18-c9d3-4752-9669-e409a6afc4e5", "value": "T1A2167C94ED0F3912F3C7E23CCF4A97E1761735A4E32390B279D2524DC59E9E4CAA2A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008870, "uuid": "632884fa-482b-449b-8f86-e6d47092d46b", "value": "98304:Azb9UwGPrUaw8E1nUTpRtJ3gqQuUAmt+sFvz:0b9Uwza2yT4Nd77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785008870, "uuid": "c020ba17-5ad6-4a4b-af53-0e4fea8dd958", "value": 4199936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785008870, "uuid": "2520d96b-5367-44d0-8ef1-99f6ebb8b19c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008870, "uuid": "7fe77c9a-dfd0-4faa-afb3-55491431c0f0", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc90e5b-8840-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784994737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994737, "uuid": "193a4c54-03da-4557-8884-7d29dc171879", "comment": "Malware payload (AgentTesla)", "value": "0b905aa2442d333f5c3bccc3724a5d7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994737, "uuid": "77aca26a-cb35-44a9-a14d-24d3e76476eb", "comment": "Malware payload (AgentTesla)", "value": "31a762fdce1008e635a5e6486d7bc50b4bce671c9232006216e70cd8f2a4a7fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994737, "uuid": "a4a6a583-0826-4198-bd11-c4cc6bce5dc0", "comment": "Malware payload (AgentTesla)", "value": "bcb6ff58f5bda59e4f119d76f7ef21f7d55e9a2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994737, "uuid": "b127e614-c29d-4712-965b-a63ce0aee1f4", "comment": "Malware payload (AgentTesla)", "value": "ea5b88deeee4b275dc12b71fea67c5461381a2edbab148f6f24c0560a65fb1e96081cdde02e1c1795ff472b5210ef197", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994737, "uuid": "a41ad54b-6eae-4f2d-adba-c7b61f4704c7", "value": "T1462501541266E902E1D68BF678B0D33432345DCFB9E2C3D29FE96FF778293816954282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994737, "uuid": "608f35e3-a18b-420c-8db3-b75f92f1954a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994737, "uuid": "844819a9-6b59-4de0-891b-f71d13833ab0", "value": "12288:lIQEdI+zxxltnn0g5zjIhSl6Cm25d3zJc0lzcV7dUxY3qUO+5jHxm+KBQ8MTFVpE:roFzp50Qzh6mDJDlrxcqUTtyQd+oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994737, "uuid": "dc554ae5-6ad8-45ff-bd41-f16b909181ff", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994737, "uuid": "2448a6a4-ddc1-4593-a44a-b4a433f0dbc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994737, "uuid": "460fa206-6d33-452b-a7dd-eaa161e32e55", "value": "Saldo de la factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c2cdf5-87c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784940060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940060, "uuid": "96b7c117-c7bb-488d-87fd-20eedf9a20ce", "comment": "Malware payload (Mirai)", "value": "7c7b54d65f5c333eba6bd216b03658c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940060, "uuid": "faa88190-4a10-480b-8c5d-2dedb87a6953", "comment": "Malware payload (Mirai)", "value": "31e0afc59cc487267b1f44d2a3c2dee3eabccb819c90d40535c7335b7b175d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940060, "uuid": "ba164127-96f1-4264-a9bf-d1bfecf181e4", "comment": "Malware payload (Mirai)", "value": "72b35eafe2f00200bfee61f60e837dba019992a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940060, "uuid": "648d02c7-23d2-4205-bfbb-d67322735497", "comment": "Malware payload (Mirai)", "value": "755489c05ff66165a6e453b3d3ffc1378d6430c57c02ee962b81582e7ab69a757d5c865e05b0b251898880a608efa315", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940060, "uuid": "578f697b-1352-4ac8-9ddf-44c5b61ff222", "value": "T115C34CCAB802DE7DF80FD5BA446B1D0AB931A35165830726639BFD93AD321E57D02F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940060, "uuid": "4f4bd3e6-df60-4934-88b1-420a4fb68849", "value": "3072:XZav7dQKGUfAtk1/qjxMVLLDq8c5C1zF58KS:Ev72KGU8NiLnqy1zF58KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784940060, "uuid": "38c7a0f5-7108-46fa-8924-f0ee054054c0", "value": 127332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784940060, "uuid": "bed2b0f8-57c9-4e4a-b670-90eb932581cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940060, "uuid": "8c1a0860-82b1-478d-bade-f53c65328882", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0afacc-8828-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984209, "uuid": "b3b7d8f3-28fe-4b27-adf3-b61730c848c3", "comment": "Malware payload (Mirai)", "value": "a387a68dfb7ad909bbb4db7dc5c9222d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984209, "uuid": "a8a517cc-6dcb-4345-9b24-cb17080e2a21", "comment": "Malware payload (Mirai)", "value": "324deb4b74dd1414deff93cd374b2b388736546ad6286d9dcfaeb6acd2b7f8c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984209, "uuid": "95ea1227-6bc8-4249-bb40-78671dab3f03", "comment": "Malware payload (Mirai)", "value": "e57369245c22f9719a3e0621ed525ed93fa9b444", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984209, "uuid": "ddb38068-7bee-4d06-af7d-9b661961107a", "comment": "Malware payload (Mirai)", "value": "07cf775a0954d6928c9f420a602696edfed3ac7fc8b2aa31c4ffb860467127266e483face14a884ab51e34e82a2fd152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984209, "uuid": "01a5b812-e29e-4712-a758-fc2348fbd150", "value": "T15F134D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984209, "uuid": "17fa11ae-a994-4dd1-b1ad-0bd5c8f47c49", "value": "768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JvaVIoX4M+DoIwS3ZhP3XRcBPbX+svy:BEbMjOU1hiIoDI9JhPnmBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984209, "uuid": "9253d8d2-b65a-4c5f-bc5c-d05fd9e90009", "value": 43832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984209, "uuid": "e6f6fb9c-597c-4f0a-963e-25da5fa2db68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984209, "uuid": "4f459154-c30f-480a-a04e-f37e09514a50", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea03301-886d-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785014116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014116, "uuid": "7732e765-59c2-43a8-b928-eb0a4071bfc0", "comment": "Malware payload (WannaCry)", "value": "48eaace18c29524535a84ea5bc6e71cb", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014116, "uuid": "2dd8d3e1-5e54-49f8-95f8-2961990e151e", "comment": "Malware payload (WannaCry)", "value": "343e294624c935431cf4ec28cf998a7e0d459c9b41361d539f221406fee5a16d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014116, "uuid": "a9e951dc-cf72-4e90-870a-d8ab62830769", "comment": "Malware payload (WannaCry)", "value": "b0252b35aa23ba91066b7055af3e94947a1f25ba", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014116, "uuid": "2e35b118-1db3-45ea-89ee-099176368bb3", "comment": "Malware payload (WannaCry)", "value": "9e44e54fbd8cdd609717c417a3886414e68f1acdf9eb00600174fe8f6b29266c4f0104898e6b1152c70b8b2685d4701f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014116, "uuid": "05dbb8ed-3ac5-4efd-a81a-af54d73923ec", "value": "T1FA361259336C81BCC11B523494B34D26E7B3BC5A227D970F8B948B6A0E13790BB78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014116, "uuid": "9013390d-4a04-46fa-b4b8-f5034b24e8da", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014116, "uuid": "ef39194f-68c0-4d51-b58f-f1d678e7acd2", "value": "12288:jbLgmwbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLg1bLgdeQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785014116, "uuid": "07106911-7e11-40f8-969e-b70089ee9b0c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785014116, "uuid": "0efae590-2195-4daf-8c32-70e93067ed04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014116, "uuid": "ca916ab4-2d55-4c04-9744-61e4440bba8b", "value": "343e294624c935431cf4ec28cf998a7e0d459c9b41361d539f221406fee5a16d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d4d3e6-87c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939820, "uuid": "c8b3ccbd-898b-43a0-b074-f030a6411a0e", "comment": "Malware payload (Mirai)", "value": "8396dffe9e45e4536f47efc9d4cc62cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939820, "uuid": "2e14a73d-35a6-4fe1-866d-a2a580b04a8e", "comment": "Malware payload (Mirai)", "value": "35e65699806a4726c50d1d28c5cb3f0afaf4ac1df109a9259b99c18cdb76c6f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939820, "uuid": "aeffab16-4cc1-47c3-9cc6-2e4af2276fed", "comment": "Malware payload (Mirai)", "value": "90edb42061d7dcae825dd35a2b92e9855f831b98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939820, "uuid": "de42e678-26c6-4516-ab95-cd41651e46e5", "comment": "Malware payload (Mirai)", "value": "366be6aaa4074c4b17a7c6617f544040f9389052fbb55c54b46b07449a0890f2cf887f830eb03c2d1a6d50ce512e3078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939820, "uuid": "055fab7b-bb5d-4251-af5e-f88377bf2930", "value": "T15123F165C8F48749D8CC137E18FFF9420508EB18A0499EA253BD62171DF9BB98BAC3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939820, "uuid": "b5538271-595d-4b22-ac89-a47d35ae4b20", "value": "1536:Apg6TbridTtyABsOEoDLQSiH1ZMrzqciAJnouy8Hy3:1ZGvOEm8SiVCrRoutk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939820, "uuid": "cdd81349-8fd8-40df-a510-1ea1a85fcf0a", "value": 49684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939820, "uuid": "e81751d1-9b7b-4baa-a176-a43cba9c474f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939820, "uuid": "3008f4f7-9654-42d0-babf-e67501624c8b", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a12aa-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975611, "uuid": "08926055-8260-4b70-a8ac-6e5864bbb7ef", "comment": "Malware payload", "value": "882337d5f33be2282c94c1253035603b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975611, "uuid": "af5a6edb-468f-42ac-8962-ccf323aada77", "comment": "Malware payload", "value": "35e85fade57a82fe8d27ef4f4b8fcf0fce1690be3a55b9bad3166832cf26b4ca", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975611, "uuid": "d008f651-25ab-413a-a1c3-30ca0c1e5701", "comment": "Malware payload", "value": "d91b8bfb8d1ff6d356e8c4b7dc14f71acb9ea654", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975611, "uuid": "d1514c72-a24b-497d-8eb1-1fd97fed0d7e", "comment": "Malware payload", "value": "cbe57ae5cc38833f9d1cf36b4000c36cc1497acb908b416375afa4d92f971976e64ae757db7dcf88bb439e0a06c34a5e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975611, "uuid": "1f1d260a-b6c5-4015-9d3b-4068c215c1c2", "value": "T1DEB17D5AE2B38573D44186BD1C935E3483F10353DAD30B92536D29494E74A9F2B3C978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975611, "uuid": "6d87e315-2c02-4438-bddd-3bb8194b7fcc", "value": "96:7roP7Jv3ZlXGiZiMLYXgy7IljX5yYlq7S/mHC+VdbWeAqz0Ej7gwY01iiHn:gTBZlXd/Igy7IljJ90QmH35f5g4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975611, "uuid": "144e53e1-c2ee-4e51-9d30-de9a085300ee", "value": 5565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975611, "uuid": "2ca96bcd-ebfe-4876-8c34-6f659cf619d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975611, "uuid": "26cf545e-fe00-46f5-8bc7-aeec683e4c65", "value": "images_20260724_211638.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418c93ff-883a-11f1-bd95-42010a9c0009", "comment": "Malware payload (XoriumStealer)", "timestamp": 1784991921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991921, "uuid": "362272c3-a9d3-4a63-8220-b7d04c65375d", "comment": "Malware payload (XoriumStealer)", "value": "65c3aa0a48027921f2f94df9fd45c422", "object_relation": "md5", "Tag": [ { "name": "Dinberx", "colour": "#E9A3E3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991921, "uuid": "14ccd895-3883-4ae1-b463-ede7dfb5d699", "comment": "Malware payload (XoriumStealer)", "value": "364d3883e81da01bb449083552e5f1526ec734bdf40b27e71a4670fc3df12e76", "object_relation": "sha256", "Tag": [ { "name": "Dinberx", "colour": "#E9A3E3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991921, "uuid": "8d30bdd2-7db7-4015-8cb3-75691fb4ea5c", "comment": "Malware payload (XoriumStealer)", "value": "e2a6ffb0fe3813eeda24cef74fe77f9c24714a40", "object_relation": "sha1", "Tag": [ { "name": "Dinberx", "colour": "#E9A3E3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991921, "uuid": "0c7812cd-8a68-420c-ad0f-cccf2f39794b", "comment": "Malware payload (XoriumStealer)", "value": "27bf070c66b15fdfd458b1d5ccac432495ece1040a62a39727078ee5bbdad7a025b5f9cc1b93a3158d280130ca57ab2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dinberx", "colour": "#E9A3E3", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991921, "uuid": "249dc415-c667-400c-8528-bedc2b9538f4", "value": "T19035019F251F8C52C4BD58B807BBB3C68B5C9D7A1661DC222C507E0A767C502B62BF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991921, "uuid": "baad27ea-8774-4abe-9d04-b384d789b492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991921, "uuid": "3d7de407-1de1-4215-86e3-3512463b8ee9", "value": "12288:mceifO1cHqQA9UNEOIZBk1HIlnmMKr/kNiPDGd4GfjipfvzgiyBByiJv8TiMVlcL:ZCcKXZBZBk1HIlnm/a2G4y3v8GpQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991921, "uuid": "ece6fd4c-2c13-41e1-a34c-b16464e9564b", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991921, "uuid": "17e86766-f41c-4d4f-addb-926d6621dec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991921, "uuid": "17442634-47a5-462a-b6d0-067361877896", "value": "winws.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a63f6d0-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991426, "uuid": "8611060c-d826-4825-91e1-36d2c42c0c97", "comment": "Malware payload (Mirai)", "value": "d59203e9f4d8af45cd23382cda8dab3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991426, "uuid": "f131ce81-2120-42e3-a399-b42388b8b0be", "comment": "Malware payload (Mirai)", "value": "377054fdeaca076af9194c4ddb001785ed016a0404ac175b4cce8808fe1f8969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991426, "uuid": "33eaca1c-0324-46cb-a408-9bfa696ad0bc", "comment": "Malware payload (Mirai)", "value": "3a5a216521844a6bf0ed1d00dbda10704f619664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991426, "uuid": "3cf13801-2648-4f0c-915a-d91fc4abd2a8", "comment": "Malware payload (Mirai)", "value": "e6be837407516f7c81f789ad229f83469d948f2a2d2a2ed1afaa31258294ac76b39678bb33b95aa87701d0faefea943c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991426, "uuid": "a172d169-9839-4b81-a300-04a3700586a4", "value": "T163D34A05731C0943E1673EB43A3F27E193EFDA8221F8EA44251FAA8E9172E724585DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991426, "uuid": "32c0d3ce-81b4-4576-9742-a31f08c1c88a", "value": "1536:p+DzirgkqLzrEE2yK1CmHkv1qxEV5k76awRClq6wLS+rvAQTl879FTu+qA8RdjBG:p+WPqjEEnvsxRkRCj4S/QZGsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991426, "uuid": "bc4eb06f-e45e-43f7-98b2-4f72ccbb2fcb", "value": 142008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991426, "uuid": "24ab2451-9ed4-4cc7-8fb5-7e09de5676bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991426, "uuid": "8144c7d9-3e14-40f0-ab50-08d1a15b568c", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27abe4df-8809-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784970832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970832, "uuid": "d7279afd-e05d-4d55-aca9-0f63a371222d", "comment": "Malware payload (RemusStealer)", "value": "54e487a440d73b2e2ada3b012c221268", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970832, "uuid": "6f769f55-7f9f-4b88-a8a2-5f26607bf64c", "comment": "Malware payload (RemusStealer)", "value": "377f0aa03ac75e555ef3c7299faa1725452cd18966c4ce53622719dd6e5f5cf8", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970832, "uuid": "77a6480d-3e07-4a1c-a8a7-c72e2ead7d10", "comment": "Malware payload (RemusStealer)", "value": "81a339cf0c00148b6339afba449570e3a9304337", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970832, "uuid": "3d9d7ab7-757e-422c-9a4c-7968df75c9d8", "comment": "Malware payload (RemusStealer)", "value": "2bb0a8581019b3a645d75c7a1bb238c83210f992d973cdbd7553dedac9324a2a13eae7094fcb5e475d81e97a7a7ac1d3", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970832, "uuid": "824773df-5d0b-49ae-8ed2-764258f9355b", "value": "T193C56C07BCA148F6C5AA6731887352627B31BC085B3633EB2E90BAB82F727D05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970832, "uuid": "b2c876ce-2755-4240-8e77-cbd3eaae7527", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970832, "uuid": "9f677728-8639-44dc-8af4-6a5401ba8470", "value": "49152:oIoTUWLy6DrkTiT5RbIP550NWqD0UlxifDZb:oId30RbcfqDtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784970832, "uuid": "1339cc80-c92c-407b-bc83-9df54afced57", "value": 2698600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784970832, "uuid": "fa6cda4f-3a37-498b-b907-3b74b8faf40f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970832, "uuid": "3e0c5182-1de0-416d-8858-7409945f3161", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e686864-87ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784959247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959247, "uuid": "0a91d0e6-63b6-43e1-94ee-ebb021c7c8ed", "comment": "Malware payload", "value": "ba67c5ddf52cd8aab6740d6552f89fdc", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959247, "uuid": "07ffebf1-4dc7-45d6-a1b9-c03f99b84d86", "comment": "Malware payload", "value": "38072dc90fc49ac44e5b2c4c7a3a82bdbbbad186025a21a3482800ebeb4facb6", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959247, "uuid": "007a3dc7-6d6a-44f0-8ea7-9c0722b07c36", "comment": "Malware payload", "value": "a0403af40e3cd8174f5d636b85c03d40bba0161b", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959247, "uuid": "5de49a4a-87dd-494b-b177-a5155e7b8f34", "comment": "Malware payload", "value": "af7fb611a1bd086c72d7a8ba84019d93ea3224fbe2b34a69ffa6f7908b829eebc9ccb3911b846f2b36a18d0639f38864", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959247, "uuid": "2dc093f6-1bf6-43a9-b79e-9828fa8c72f1", "value": "T1E931609B04205B7A0A53CFCE37663448B00DD9EB1C5BEBE0984D4EED52485CCB162FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959247, "uuid": "9f762f34-654d-4697-97cc-091ebe23652f", "value": "24:RIUmxNlZtD6DZTjR6YmbuB6trhbppJunjCKOtQ5en:RIU7lm7trhbG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784959247, "uuid": "3c5de8d5-6c51-48f4-8a0e-0c33c7d986e5", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784959247, "uuid": "96a06bf2-3a1c-45eb-97bb-6f6b36f1efd8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959247, "uuid": "a0b19171-c9d1-47eb-91ad-87e8049780b7", "value": "38072dc90fc49ac44e5b2c4c7a3a82bdbbbad186025a21a3482800ebeb4facb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee3611d-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974763, "uuid": "f44aa705-5a1b-42ec-99f7-e221ae7f095f", "comment": "Malware payload", "value": "ab2d50eaa84d695c7b0896507ac726e3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974763, "uuid": "c026ff44-f720-46dc-b7ff-cbe5b48eda69", "comment": "Malware payload", "value": "389973dd832fb762d2770e5c615d688f95f260cb5f5bbc6ce93a0f447046a694", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974763, "uuid": "b4437f02-1631-497a-aed8-ffb9341db8d8", "comment": "Malware payload", "value": "4bac535e8c76d2154cf11ccadb26eed88c778ff2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974763, "uuid": "a7f20711-e2ea-41f7-9523-62fe8a174894", "comment": "Malware payload", "value": "fccc94221d443de763f72e619734f03178364c5fbdff33ef2731858f77eaec662bbc216e24f49fc446e86f2390d7e852", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974763, "uuid": "ebe9340d-1755-43c9-8db2-ac234e364f17", "value": "T1A9D1AE0C971391F88203A631B2F6FA62459593B51BD3B28E80903E7B93E03E1F93255F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974763, "uuid": "ade9747a-4525-415e-92b0-3676b4e0c97c", "value": "192:A+q8PAbwyl5+qg2mI5KTrXBNPYKP77SiXcq:Rybwy/Xg2fgtBNP77SiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974763, "uuid": "68c2993e-f9ca-4867-bea3-538932d72e27", "value": 6616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974763, "uuid": "526262f8-8619-43ba-82e9-2de9cc972682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974763, "uuid": "9660c5ff-5e74-4e6d-9206-e713cd8ae65c", "value": "images_20260725_025041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf882d4-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975243, "uuid": "fc1d0b3c-8cfd-4c83-a316-7b9cf7eb1fd2", "comment": "Malware payload", "value": "d29026fb8641835e9be500f5fedeb717", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975243, "uuid": "24faf2aa-fa5d-46be-9681-ee6abfc73704", "comment": "Malware payload", "value": "38a6b870320acaae475933d54d4250695ebdbdd440c91ceaa7e61e2859147806", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975243, "uuid": "ed091103-ea25-4d47-aa8f-1325fdc9a70c", "comment": "Malware payload", "value": "75ab897c103f387430b6dba244d88e258c565e8d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975243, "uuid": "117d536a-b7f7-411c-bdaf-c620a981d118", "comment": "Malware payload", "value": "fbeb75b91e881bbaa9a85427e19687cc3748c664d4ba47cdc9f44be6122486e01fc02b15f357b9d8b06ae4bd386620b2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975243, "uuid": "676809ee-427a-43f3-9c06-4152ec421ddf", "value": "T16742CF54D2D2DC1DCB469F35A4F77C57228F985BDACAB051BF861752422616283E344C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975243, "uuid": "6aef63e3-55a8-40c0-b126-2cc1ed5632f2", "value": "192:KOf3CAqvrG16GSHOLHK08bAGn2M6CjKy+98uAHk1EbgbslMlMrezkTfjt7DXwruA:KOE6SuLq0mAG2PQtFu+EFIcM+wZfAV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975243, "uuid": "56bf7962-a520-4b09-982e-ed0a41ea77ec", "value": 12659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975243, "uuid": "8658cce3-fb67-41dc-b646-436279b58ef0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975243, "uuid": "a6232e26-675f-40aa-986c-bfb0f9bdf36d", "value": "images_20260725_041214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ada4ff9-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973925, "uuid": "8d17f6ca-7087-4182-9dbb-710167205486", "comment": "Malware payload", "value": "27c2a99bc4369b96619eaaf238e7dcd5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973925, "uuid": "b51ed86b-4614-4bce-bc9e-7587cfbe0b7d", "comment": "Malware payload", "value": "38b878f4c6c75cf3688237e281e73e3c308a8c2e141136d4dbc5f2f2e84454d5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973925, "uuid": "470245f3-f93b-46f3-8ebe-8ae506e4be66", "comment": "Malware payload", "value": "e5df9b4c0383e03b26475a0e228de518ed297be9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973925, "uuid": "fc8adc39-f87f-4957-97f8-32adc1ca808b", "comment": "Malware payload", "value": "abd9c907c88d06866695ba7c4f469f5090971d4cda1213f4a03ad1c870310f42efa9b13016e57bd90847541dc6e38280", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973925, "uuid": "39c2fb33-adb4-4435-89c4-5600d6ec899b", "value": "T1B306BF4AF7489B5AC0F3523A0C355A62525B8CA68F43D783BD64773C58B7AC01F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973925, "uuid": "89e65b49-c6c4-48cf-92eb-e6934e8fc1a0", "value": "98304:81ij3XVSZXRExgETzq75fz5tFcuTZRnQjx93wkT9y2:8hYWH9zTFrlRQHwkRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973925, "uuid": "41a422dd-5f8a-4060-b507-fe5fb827dc55", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973925, "uuid": "870fc65d-0155-4bf2-ae92-596b54b3c150", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973925, "uuid": "00adfd29-a703-4112-bd80-22cdd92b4f14", "value": "variant_03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a45138-8835-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989673, "uuid": "b600abcd-f635-4db0-afd2-da055ac2e4d2", "comment": "Malware payload (SalatStealer)", "value": "07b9dd4ef7ab29f740a0d38bac2b61b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989673, "uuid": "16ebbe3b-54fb-46a7-b7f8-e54ca04076f1", "comment": "Malware payload (SalatStealer)", "value": "3a11c263682f30013c8296fc6aaf0346033b48bd9aea2c4c9c1edbc2877622df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989673, "uuid": "545db438-a622-4228-9617-31d894c406c8", "comment": "Malware payload (SalatStealer)", "value": "1c80a2c8b2111b07edc9b403f35ea53350639cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989673, "uuid": "0392ceb3-6dd6-4661-a61b-54c61e2e1d36", "comment": "Malware payload (SalatStealer)", "value": "6e5fa5d706442e251e5347fa86442d4873dcf9db80c0c0851593bc41547801385bc23204cfa7e86560b6da2b3dce2303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989673, "uuid": "76521f70-0fc1-43af-a8f3-705fcd077d2c", "value": "T175F5334881A2739BD5004737059E1AACD2D8F9EE01E4BBE0CCDFB762AC455FAD132697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989673, "uuid": "3edbf855-c6bd-4517-9214-7eece4691904", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989673, "uuid": "c3d3c1e3-40dd-4d70-939f-b0066205e677", "value": "98304:tVMxb9ZV2TwuWKAdjaYqeVbvuWebX907Sqv:tqxRD2TBWKOjaYzVw6Wqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989673, "uuid": "1bb390fa-8f58-461d-97b5-23f548ebf25f", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989673, "uuid": "4130efac-8af9-4bda-9559-9f51b1ef0143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989673, "uuid": "3f815202-d656-4023-9514-d67342b7d45c", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f09d82c-8855-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785003459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003459, "uuid": "f3f21963-b1fd-48ce-bcfa-b21815791a1f", "comment": "Malware payload (Mirai)", "value": "5374257d10b3f07c1ad046c900e57afe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003459, "uuid": "ce55875a-8534-4474-85f2-305dca22ab02", "comment": "Malware payload (Mirai)", "value": "3a79f8de2e26382af0127a263f6bb9c242a6c75c598e7e33792d2a96e956bda4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003459, "uuid": "5df564c5-e61c-4d84-b823-63314fededfd", "comment": "Malware payload (Mirai)", "value": "ad7491bb3dea856d5e2e6a5993c0a641c05e1825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003459, "uuid": "68b4313e-99f2-4308-9dc8-79909cd7658f", "comment": "Malware payload (Mirai)", "value": "7942a4c649b2c97a825bfe6d2dc29dc5de53da4da5f062c4d3f246cb35be86b363b9b8d0eb615fc431572201d6d74397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003459, "uuid": "27f3955b-4cc5-4571-946a-bbe9eb212812", "value": "T1E3E3D61E7E618F3CFBE9823047B79E26975833D636D1D595D1ACE6001E2028E241FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003459, "uuid": "9d4d4a78-525c-45d4-8833-0e75803f8a86", "value": "3072:K2JG2CYTcYpA5C7gMtspYX29A8uXENQDw/HKK9t/w+T+7oywvyMiRZtkpUptH/tI:PJG2CYTcYpA5C7gMtspYX29A8uXENQD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003459, "uuid": "32016483-13d4-44e9-a139-46b34d419094", "value": 156992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003459, "uuid": "3ea9ff8d-cfca-4c9d-b37a-674bbec0085f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003459, "uuid": "8f53e751-df1f-4d2b-9e96-ddf134b40338", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c8845b-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975767, "uuid": "a391ffba-7a86-4e49-b311-587e4550ff6b", "comment": "Malware payload", "value": "f0a106e86e698db1e7ab264f927fcdf1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975767, "uuid": "e3dda361-e74a-4dd3-b0a5-c35851c66238", "comment": "Malware payload", "value": "3af2d8850e44fa1ea587a775d72ef66018128cc5b6e2fbe1a2fbfbc619a4494f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975767, "uuid": "daea00fc-afbe-414f-9980-47d871198ed9", "comment": "Malware payload", "value": "532b8b44c6fb284f4b71dca87d27e1b44449a531", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975767, "uuid": "4134646f-bdf2-4a4c-b2cb-6aaaf468716d", "comment": "Malware payload", "value": "ab8dea01f4d556368a05241da30211776a77408c2f211d1d816a385031cbfb691dad8e7881d843463d3bd75eb0cedb2b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975767, "uuid": "0ba480ea-81e4-491f-9321-d0d25128e093", "value": "T17432A0AE4318561EFDE361F9559B0DE79170A0FDF7B3990711E2F20E2023609656B43E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975767, "uuid": "52629eae-8622-4759-b5e3-1efbbabd19ec", "value": "192:F1zyx0V1Ht0DaTY6aRf1lkEQViqqLPJD271a18JJs5i2CzzUWgwgFaFnw:Dzy2yDp/ktiq2D8oaJcizDg3Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975767, "uuid": "8f1c5073-b574-40a6-9b44-afd861e9687e", "value": 11240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975767, "uuid": "b7f695c3-6292-4f79-84b3-26c93c2aaad2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975767, "uuid": "f7c8c316-c117-47e6-8062-e7433638e0f9", "value": "images_20260724_220940.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1fc6c0-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975784, "uuid": "6c03d6c9-5c3b-4b97-ad8e-236c3b438f35", "comment": "Malware payload", "value": "7e22f8711cdde34974faba3962f083d7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975784, "uuid": "48993caf-6d82-4aeb-a3da-d4e2f8407483", "comment": "Malware payload", "value": "3b2e424b05b1b246905e1df35935f69e2fe723d3d8d02952fa1788e6dcff40b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975784, "uuid": "5254a918-e46e-4b3b-b4fb-22d50c5a93ef", "comment": "Malware payload", "value": "312ada3fe16fd964e30392f385f8ecb97d0e5914", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975784, "uuid": "f4099aa1-8074-42b8-9462-ee908e80042a", "comment": "Malware payload", "value": "c62aa4873e095478edf1c5dc8f44cdff3d374724f462cd96d62f05ee76d99b815e1a08c369cf7c79a1ecfce3595698cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975784, "uuid": "5c6351d6-efea-410b-9c3d-e85487d564aa", "value": "T11912A08E50E32915CE3686BC297FAE6F96152ABB502B3D02CF401D49875FF653897302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975784, "uuid": "85d0b357-d43d-49f7-8cbe-435ae43dcbf0", "value": "192:JfyQdR1f1gWc4Yxu/AqekhzZZnV/r9hQ2BznD6hWAeKyNT:sYR7c4YM/sktvVzU29Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975784, "uuid": "78ccd8d0-652c-452e-ae0e-2f7dea466237", "value": 9407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975784, "uuid": "23105351-88e4-4127-b1c1-42e2086db77c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975784, "uuid": "380e121a-0a6d-4ce8-af2c-804d7ab6e27c", "value": "images_20260724_223918.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8521b7f-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784984846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984846, "uuid": "e0bb983f-77f7-4495-93e7-b1f2e56fdcaf", "comment": "Malware payload", "value": "1cf13d27e0d99a0a43a8aa3c8e4963bb", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984846, "uuid": "f0477adf-cd00-4ec6-8982-62982fc11139", "comment": "Malware payload", "value": "3b3588dc4061a88872cd8617080423eaf79d0cb925c64a99129d3700cc9080eb", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984846, "uuid": "b20ba037-95b3-4c35-b25c-8409a49e7a6c", "comment": "Malware payload", "value": "ad84f68ba901c69728444813503b8957e381a008", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984846, "uuid": "d70f5b3f-96b7-41b9-b664-9513033d61c1", "comment": "Malware payload", "value": "e915b550c55854fc34a87457e0292feb1fed503601f2f0070b44dd96fac4b695a1759dcb4c5106ea30c597e0cc6aa26f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984846, "uuid": "29d9657b-621b-4a48-a9a1-f973b80574ae", "value": "T163F52AA5C110F4FBE917BBB4855CADF992BA1C0DB7D42107961C744BC3631BA438EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984846, "uuid": "776271de-7083-4bf9-9d46-f48575c4b946", "value": "5a4dce694935374774373ddc20cecc7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984846, "uuid": "1fe0e6c2-e6ca-4b8e-a986-eb57e2942dcf", "value": "12288:CNpbagVQBNf2CBZhb8053Q/+sIurwJ//F4k01+K4j6mEAc7oaQzC33333333333N:CNhayQiwZ58wUPrqik01+LlQ7op0Qx85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984846, "uuid": "41de559b-f76f-45a4-ba77-d735c4a2c2bd", "value": 3570504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984846, "uuid": "444cb557-9a01-424a-8f58-cd882d4ed5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984846, "uuid": "e006aacd-bcaf-4f2b-87b0-1ae629ef3c75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef740c8-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975354, "uuid": "368eaa08-116e-450b-b1ee-3b779cfa5230", "comment": "Malware payload", "value": "ef0cfc67c93de84bc7ee26ec4957a28c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975354, "uuid": "27d39b4f-8581-4c16-8ecd-14ad43d8fb61", "comment": "Malware payload", "value": "3cb1b3b497d11c525ee5ebfd1b6bb08be9b7666d8c455d4e9419ae1cc701ac40", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975354, "uuid": "a3bd3c90-b350-4da3-96ed-31fd5c8b583f", "comment": "Malware payload", "value": "c92827bf7306e3f0858af185efadeefe34163d67", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975354, "uuid": "24aa29ae-b3f7-4366-9dcd-48a1b4e5ce8c", "comment": "Malware payload", "value": "e02d00535209d2200d6c134b7a33aec0c4b17d1faf98ca9f44fcb6b99024740695b9ce6ff080017d543580e03bb77b9f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975354, "uuid": "408acf56-7b76-4550-9e81-586443dcc74c", "value": "T150512B24C195D444C8006D7018EADF2BB3CD6A17125E5769F6FEB48CCC3C5244E91E68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975354, "uuid": "186d1d82-629b-4516-92b8-9a90b674e93c", "value": "48:9jrftUhTomUtJrmyPwmJhGV6nMssDZhnLhbw94oQWe4x4cr7ROYZPc6+gUz/:FMTFeJrmyP5bM7hnNyQWe4Pr7Rrc7Jz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975354, "uuid": "398a45e8-c5d4-4c35-bb9b-461ce78afb31", "value": 2617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975354, "uuid": "d69960b1-26be-4ebd-8016-fd7d28e23e8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975354, "uuid": "5be51298-825d-4029-b44f-6295bd4aedbe", "value": "images_20260724_174737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0732c486-8830-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784987528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987528, "uuid": "4061ba8a-716d-431c-a044-cdbbbbf8f119", "comment": "Malware payload (Efimer)", "value": "fb1f416ee85327a14fcecae86e35eb67", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987528, "uuid": "a03bdf7d-b55f-4c56-90ce-c3b81bc9b3b2", "comment": "Malware payload (Efimer)", "value": "3ce59f9ba6c5ba98cace75c4d68e1e157b43d30747f4078a91d517a9f3b27e66", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987528, "uuid": "2e6958dd-03fa-45cf-931b-d1dc6b109f13", "comment": "Malware payload (Efimer)", "value": "5ecab726268a4266b456de337bf18ffbd9d5c8a7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987528, "uuid": "c946b7f9-ea31-43b0-b304-dec2fb3592e1", "comment": "Malware payload (Efimer)", "value": "f95ee5f409cab9f1265adee19b799308f0e50f785d98378101a338d037af3af7df85d388674388c5a06503a96cb61869", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987528, "uuid": "d7b774cf-b75c-47d2-8527-3d9469b082d9", "value": "T192E6330867E000EDE7E31139EED256E6E5B974711BB5CD9F47E48682AE173E04A3E603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987528, "uuid": "b048a2eb-baac-4f5b-ab06-f94a31dadd61", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987528, "uuid": "cf353b20-1af6-4ce0-8af2-bbe6eaf1992e", "value": "393216:vObHIU+Jk1QauXMCHWUjXEcuI3/PGTAI:vGIU0kiauXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784987528, "uuid": "52cc52e7-6952-4cbb-9fc1-2c2d3ca0eb63", "value": 14320230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784987528, "uuid": "6024b71c-3973-4ade-9deb-c341942acf69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987528, "uuid": "10217fca-6410-440f-b858-becbc5020428", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54b551d-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975794, "uuid": "4833a099-7914-4e04-abf6-799e00829638", "comment": "Malware payload", "value": "5b95d4ace98d1e8d9842d227853fd1a3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975794, "uuid": "489f0840-edb1-4a83-9886-3f39f574f0c6", "comment": "Malware payload", "value": "3ce964f9eec94a735525e9308ae83b1b8e902c4610c8447fee62f0602aff8859", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975794, "uuid": "e6fa19bb-1b10-4dc5-b5c8-0180ea06ac8a", "comment": "Malware payload", "value": "7f8042c074652b7883db18be1f4457e9eb88068e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975794, "uuid": "c06a1977-0d4a-4dcc-b6ce-991cd25aaee5", "comment": "Malware payload", "value": "240f97b228ec965a66f886f3d3386e0af9a0b009d4c3f386902db7cd110723255f19e48b27728e86ccacb57110233b75", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975794, "uuid": "c6233d28-4d8f-4d2f-8636-81de5ae2248b", "value": "T15922C09C5F991A4FEE6580B5B44621065F9C113C8E0BAC59DAC266DC5E27B0A4CBC0F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975794, "uuid": "90651293-9fe6-4cc5-9c2e-f1b7cd577d59", "value": "192:A6qWWqYkJf/3sa0B1f4a26l6W6W/cwzbA9XkGl5fETYZknMVyXf7uXsV+GqfIysF:3qWZYkJf/sa0z4a2c6G/hcx3cTYZkM21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975794, "uuid": "13f801bb-d37d-441e-a688-22b9078b1d61", "value": 10487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975794, "uuid": "cd741118-59fd-4e4b-95b0-3c0ef5c5601b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975794, "uuid": "82d58587-2e6f-414c-ad51-8b79428df397", "value": "images_20260724_133129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78002edd-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975262, "uuid": "1ba8bbaa-cf37-41e0-b4c9-d36e5b4db54a", "comment": "Malware payload", "value": "d78afb02ecba2320a4ab86b32a52c255", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975262, "uuid": "fcadc960-ce26-4a3b-bf18-0cb19a9d49bd", "comment": "Malware payload", "value": "3d3bf68e1abd08665eaa0c0b9223038d6051d0b36a127eb4fc309a8bb9595dbe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975262, "uuid": "ab56ca3d-7a91-4ce3-99ad-028263c77b7f", "comment": "Malware payload", "value": "87d4b11de192d89bf9f32fc2270980510e9bb274", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975262, "uuid": "aa5e53a2-5dda-4e26-ab77-5623b356abc9", "comment": "Malware payload", "value": "e13db34d73c73092a40948c72bc2cdfe3ec0dff0d78ebca7636d73ba4a80302ec86212488a2422aa94ed78270c4015f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975262, "uuid": "34631e71-c82c-45f6-9fc1-e895c2f4842a", "value": "T1B6412AA604D0968CCA0BCA30815E6D888A1CA036931996ABDF66C26843C07F3A547564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975262, "uuid": "477dbd82-211b-40b4-a8c6-0772da48f00d", "value": "48:96UqPfFTLaiS4rb5JjoLN8TvpOEoZo21NC6T47Uobbps2l:UNPdTOiDrb5J48Tv+Zot6Tqb1sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975262, "uuid": "a1f3107d-0a2f-44b5-b634-2ea6f21f9d0b", "value": 2063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975262, "uuid": "228cd815-9645-4beb-b4cf-e64d0646a2e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975262, "uuid": "31d957ef-4f93-4509-90e6-bab2f4480345", "value": "images_20260724_125121.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa3f068-8857-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785004588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004588, "uuid": "14350991-47a2-4235-b88a-dcb4768681b8", "comment": "Malware payload", "value": "7c13750b309f114c028bc5fa65ff0390", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004588, "uuid": "f30afc39-c59b-49e1-bcc8-af33cf2386eb", "comment": "Malware payload", "value": "3d5af7ca987b143447b7ab87c304d6c2b58f924ac4e99fe76270d1214d2783fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004588, "uuid": "67f2a0bd-37f5-4973-b869-a135ac2f4f40", "comment": "Malware payload", "value": "3cbf2c66ed26a7f2628a962be125644adaebd4aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004588, "uuid": "20d8a644-4576-4199-a7e2-2fc9b952e488", "comment": "Malware payload", "value": "0651c5606b794b841ded0b43c9ae476d304b227e6ee205687d5387450a7f53b34e0db5c3844b0dc8508708b26577ac93", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004588, "uuid": "fd27d54b-298d-4496-87d8-a6ced1db1a4b", "value": "T1E4137D6566913C24AE9998371D7E1F0CBDAA83E23104A1DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004588, "uuid": "b2900385-8d43-468c-81f0-812ec1c7872a", "value": "768:LXRWNGxVr9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Flx2co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785004588, "uuid": "85ec241b-2768-4a84-b9cf-7613417d87c3", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785004588, "uuid": "e73291b1-f2ef-452b-9b82-ed42cad2b34a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004588, "uuid": "ed2926e2-49aa-44fe-acf8-ccaac7a072bf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149c3555-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998717, "uuid": "faff8b1f-7fab-48f0-8c69-ab689266eed3", "comment": "Malware payload (Mirai)", "value": "edeb0a83030d1efdcebcabaaa955108d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998717, "uuid": "bc39d8a0-c5d8-409c-a8ac-2654ae15f586", "comment": "Malware payload (Mirai)", "value": "3d5b9c3821fae13dea78b113f90985fed0b7f43b2d975411907130e48bbfcd2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998717, "uuid": "8de185cd-53ba-4252-88e5-644d2e5e5cab", "comment": "Malware payload (Mirai)", "value": "5e37bf7b91db4b6ccff8e6ccf56bbcdec31cee4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998717, "uuid": "a5fe4e5d-fd4f-45aa-b970-411efb76ce5f", "comment": "Malware payload (Mirai)", "value": "24795c9079224c3970f289178f05fad006051d1c399948cbfe750e51eda2561bd01fc3e7c3415f288b9a3f7c1e25829d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998717, "uuid": "c3dba893-f08f-4f70-85a9-4c0f2a525645", "value": "T1B9E3D61E7E618F3CFBE982304BB79E26975833D636D1D595D1ACE6001E2028E241FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998717, "uuid": "ebb13561-08ea-4de9-a6c3-bfce247a0456", "value": "3072:pJG2CYTcYpA5C7gMtspYX29A8uXENQDw/HKK9tedw+T+7oywvyMiRZtkpUptH/th:pJG2CYTcYpA5C7gMtspYX29A8uXENQDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998717, "uuid": "23889920-1ba1-427e-9cd9-64965131c41c", "value": 156992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998717, "uuid": "a7e6ce25-f5b6-4103-b92e-19e867b1c593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998717, "uuid": "e48399d7-7b4a-48d0-aba8-d8539dcedd9d", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bc68a9-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975345, "uuid": "d760d6af-c331-4705-a70c-32bc6ef42449", "comment": "Malware payload", "value": "4457ced68b55a4dd1db3ae41483d2b69", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975345, "uuid": "e6c47bf1-925c-4253-b0ce-fa1b60be77d4", "comment": "Malware payload", "value": "3dcab83e001aafbd13d22269e0de9701b6ee50a0ba9cc4482167081652d4cf12", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975345, "uuid": "3882ff61-8565-4f79-9f7e-c791d8b14272", "comment": "Malware payload", "value": "460399c61bc493b688bddb571a29efc4cdb00adc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975345, "uuid": "e21c6029-7d74-4768-9140-72f82540f3d5", "comment": "Malware payload", "value": "21bbd02ae4b7555f1898958c22ab27a87e09b2ee81e6d003750a181d8b62f0388f1a03711c456813dda29f47b4ba2701", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975345, "uuid": "8f1c875c-2775-4b38-a01e-b7b3864d5ea1", "value": "T18B62C01063A6D841CD9239E5F0A15A8CB7FDCDF403F7277219A29EE99FF92101605D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975345, "uuid": "6fa7f9e4-86e2-458f-b29e-d17a19de86df", "value": "384:rhlaAfT3fKajFTXzCtaloiA+D4wsEmQwsZZ:CHTV+DqEzwsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975345, "uuid": "6b3ea94c-8ec4-471d-9ce8-75c236d1a322", "value": 15705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975345, "uuid": "29070c59-6246-4705-a692-ae25b53cc800", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975345, "uuid": "4fa070d8-2ee3-4c5e-9a8b-31907cc957aa", "value": "images_20260725_051752.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a544822d-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989082, "uuid": "caa7fca6-c971-455f-bf30-cc0ed5f90989", "comment": "Malware payload (SalatStealer)", "value": "a77d976fbff17ce256e18d5ad1935c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989082, "uuid": "3fa4ffdd-2c9e-4ef7-8f76-eb72ac4247a9", "comment": "Malware payload (SalatStealer)", "value": "3de53a836a8bdfab5e23339d6fd8ac680beb6d6d7f8f7f81fcb53044a1fe2c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989082, "uuid": "daf24a9e-8846-4631-ab55-b7f6838082db", "comment": "Malware payload (SalatStealer)", "value": "66a8114ae85628bf639b01fc3ce7e02a42baf356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989082, "uuid": "63cfa9c4-dee1-47a7-bc00-ac0661afd3b4", "comment": "Malware payload (SalatStealer)", "value": "fdb09285f3002f180e89947a918542837d4fcf6ca85c9284f8553d178bf1b0c79d289066b91572efc5db0bbb8e62f822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989082, "uuid": "e89e0271-5035-4609-82f4-c76365f4596d", "value": "T1BBC65B11FADB95F2E9035831016BB37F23315D048B28CB9BEB547B2AF87B6A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989082, "uuid": "24ab58c8-15eb-49f0-b470-cee7d8ac0d2f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989082, "uuid": "c833b3fa-f4ff-4662-9c17-f2480fe000bf", "value": "98304:uun+uBu7zmCvjkqwntcKNrAr4tG20CzEc0:KuK/jl4cKl0Ht1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989082, "uuid": "c55b7949-c3f7-4970-be0e-f5530e0f7d24", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989082, "uuid": "b9b1af7c-8769-4361-b548-86cef5b3af3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989082, "uuid": "cd6385cf-db46-4d1a-8263-2b8dbb32a5de", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017d29d8-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784981506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981506, "uuid": "3210ccdc-3580-4db8-8a91-7ebfc81ddd4b", "comment": "Malware payload (Mirai)", "value": "e9fb05350cdb5f9327db3841ce88831d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981506, "uuid": "244cbf0a-6ac0-4a54-a6d7-51be68d67ef5", "comment": "Malware payload (Mirai)", "value": "3dfe3b06e573fe0827f00674846b663f9fb07ed0349db1010712632e9f96d544", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981506, "uuid": "0e1197d8-9b09-4090-a781-e8935a3a407f", "comment": "Malware payload (Mirai)", "value": "926cb1b1fecb56eec3f8cc734c27128b0339e3d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981506, "uuid": "0143cbd9-41c3-4fcc-b33d-a320f94f99cd", "comment": "Malware payload (Mirai)", "value": "dfb4a32c542d5bb8475964bc6c11999109f473e9ffa347dd608a4bceb8f97b4adf526cb00886ee1f4a7a0bf23948605b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981506, "uuid": "8d333c55-27e4-4a64-b9a3-65aba84b22a8", "value": "T1B2F35A1275D094FEC8E5C2B84BEFA136DA32B4595134721F23C8AE262E5DF212B6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981506, "uuid": "43bba1d5-65e1-4312-8248-e715dcfd17fd", "value": "3072:wQU4P4VklB1Imd10qb8ODAhH4y1jFgOS1hVE:w54nwOB2xdsVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981506, "uuid": "db346533-beda-4b85-b833-be6da09ae0e0", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981506, "uuid": "6844cf55-7ecd-4c4d-bf06-34d805d3dd11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981506, "uuid": "499ff214-8929-419c-b7c7-d26d6c3b644b", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b41e3f-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991413, "uuid": "f4a00c52-e70b-4ca4-b530-b58dbc2c29e3", "comment": "Malware payload (Mirai)", "value": "d0f86e6d84f841d596a989fb37d15317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991413, "uuid": "1e074f6e-bae7-410f-bc13-0278b5f3181b", "comment": "Malware payload (Mirai)", "value": "3e0ee57dc8821eb088a8a4f2dfb5c90c068e7afce180b8316b1f9a59d27339ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991413, "uuid": "b5f12edf-ac8f-4552-9e2a-5c6d8e52beed", "comment": "Malware payload (Mirai)", "value": "6a37ef0168eec2e53a1b533d94103d6d1a70066c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991413, "uuid": "eb47c6e7-1090-463b-ba92-4794a4ce08f8", "comment": "Malware payload (Mirai)", "value": "dd765f0919a466a31698a7ff0ce9eb749267feef15af2c43e67ea0545b47aa2958e400731a4b40cd4532c89ffa17508e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991413, "uuid": "b8e61e33-e118-4cbd-bfa4-d697f3e65b9b", "value": "T1ACA3B74AAF611DBBD81BDD3705EC0B4234CCAA0771693B763534D528BA4A54F8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991413, "uuid": "35510765-ebfc-4921-97e5-5c511b7e5993", "value": "1536:8YPk3oscnH8rADQZHQJUFXIB7QiRfDXJu0abTpmYHd+4g2gCg/exMbax:lPk3Dk85QJEXm7QiRLc0wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991413, "uuid": "b8752c3d-9eed-4543-86ec-7d01f9df4096", "value": 101180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991413, "uuid": "4a53cc95-847a-49b0-afbe-200afde146d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991413, "uuid": "77af3555-b8db-43e0-8297-45d2c8bc683d", "value": "UlX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44372c6b-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939097, "uuid": "6957ac04-9a8a-44ec-87f3-12b4e6f5a832", "comment": "Malware payload (Mirai)", "value": "3703d24aeabc43f7a6c45d8d5dc2c3e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939097, "uuid": "23107b02-5ea5-492b-b31f-027dd24b69ab", "comment": "Malware payload (Mirai)", "value": "3edda772f2cd053ca6fe316444e6ba4e4a6f826eb84845ea27a8f3fc4b78b18f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939097, "uuid": "a13df1a8-caef-43ec-9a9d-22fa4a4e6066", "comment": "Malware payload (Mirai)", "value": "a0c5eed7943813ebe98b74c1da5527c44f4b5448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939097, "uuid": "81cacc7f-31e6-402c-89c0-e4905dee39bc", "comment": "Malware payload (Mirai)", "value": "ae09463c359170f653c517ec7a6c5b13515f1d43f9a28b69c4d57970c262c5e6484fbd7826c8dd3ae6897aa778c7937b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939097, "uuid": "12f5b1e6-20ad-49ce-a77c-b400f76d01ca", "value": "T15733F1D4A7125CE5ED6AC939D3A51B103FF887D914678497940DCAC3AE22CE43CA3ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939097, "uuid": "e6dd1ed4-f851-447e-8009-8228574b0e91", "value": "1536:6F9fg5lb0aK3KLZJL2h2NbU14JP7VJuCm:uol0ahJL2oBU2JP7VQCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939097, "uuid": "9e6a2164-f948-4eaf-b223-5d02821114ad", "value": 51068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939097, "uuid": "1cd253b9-059a-4037-bef3-e78b00dc0ad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939097, "uuid": "71d83ca8-8078-443a-8875-8b2433b1232b", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9cdcac-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975642, "uuid": "8910e9b9-63f8-4411-af99-1dfcf981e62c", "comment": "Malware payload", "value": "cd225cb8ab2ce2f551c76b9901a6100a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975642, "uuid": "f4ed8e3c-b138-4179-ab91-d4ee29b1bdd5", "comment": "Malware payload", "value": "3eddfb40ccfee44ffb45a39d2821743c5105ad1648e99a3587babc0818b8455a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975642, "uuid": "108bb2b8-37ff-4474-8a37-20fd45e21891", "comment": "Malware payload", "value": "a6546b46a44564896c4d135a89ed5ca99ce471c1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975642, "uuid": "db6c4a7e-ef8a-4f7d-9e53-b483d002d11e", "comment": "Malware payload", "value": "23165afb57ec69388abc361cecc3c7aee905dc4f7cc0f33777f0b3378aca2ffe806f27378c6200324f88f974e7366cba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975642, "uuid": "1570bd75-15e0-41a4-b091-6a9f64123f77", "value": "T157513A419419844ECF94AAF840F82D0E434809D69FB0A9F7B699485C3C82947EEBB02B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975642, "uuid": "0cdfcffb-e23f-45cc-84e8-2fabf1daae02", "value": "48:9qVY8zH6fjpc7pnqKUbOQ8GL+DNJ8IiTHZSorEjI8FYdPJvO0nYfL:c7aApnSn+pmISZRwjPYfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975642, "uuid": "d4ba5060-a426-462f-963a-092ba2714333", "value": 2564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975642, "uuid": "a31e5434-5d35-41b0-8e6f-ea27a7f56487", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975642, "uuid": "14f48c79-5d26-4dab-9842-27c1e9315852", "value": "images_20260725_085231.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec5b1aa-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973985, "uuid": "2a378b0b-145f-430e-8754-85371419d3b5", "comment": "Malware payload", "value": "07db32d11d50a97fe83641ee8548b5ee", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973985, "uuid": "9baf7adf-50d7-4529-972b-178344e1bc69", "comment": "Malware payload", "value": "3f43a355e101d91086a95d1fba39a22212b6581248e95688bab26c4410170016", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973985, "uuid": "4237d210-0108-4b97-89d2-e22c123cbbdc", "comment": "Malware payload", "value": "6345e22db3bc9f91e05c47893f5b038de0acbff5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973985, "uuid": "16f490c8-7619-4bd4-9539-0e4479f36393", "comment": "Malware payload", "value": "13b6bac68099cd5cd0c9c0273e4702ffffbc0b6321dcc950f37c0dd54f0278dd20ca613176c299c0db0b7b24871a9841", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973985, "uuid": "f75483bb-3bca-4950-91d2-250bba60f361", "value": "T16E06BE4AFB489A6AC0F3523A4C355A61414B8CE68F83D7837D25773C58BB9D01F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973985, "uuid": "4e12e617-a871-4fd2-9ed0-bc3a58b64b20", "value": "49152:D7HX1ij3XVgnlfE7NX3+6K3F0TF/OEnDxgaXI39/af05JQBfSib2BUVgoo:f1ij3XVgnlfEZ82T3xgaXw9/w05G5SRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973985, "uuid": "4520ff42-0c0a-4351-afc6-484075274477", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973985, "uuid": "db82b66e-8efc-4bd8-a71a-4d519919b94e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973985, "uuid": "11f55e07-009a-4354-b293-ed137483a6ce", "value": "variant_13.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242961ea-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974692, "uuid": "de2150c5-a509-4caf-a3ab-068c72310ffd", "comment": "Malware payload", "value": "383367683448af5af4b5e81f624c5c69", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974692, "uuid": "b9349587-c5a0-443c-936d-40444a904859", "comment": "Malware payload", "value": "3f63c7a6730c3669e18ab8db28a07613a6a785787dcd7b302ac3cbce8e0711a3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974692, "uuid": "83bdc3f1-9e0f-4187-bdba-b24a4b8baf1a", "comment": "Malware payload", "value": "0b1aed96a0e5f2c662d90913c18e817ee487f0a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974692, "uuid": "d9dc28b5-3ac3-46a2-88f5-116c69ac77c2", "comment": "Malware payload", "value": "75396004cf28361abab5df2b7523fce22c5dd9afa080dd2aa6ccad0ce5744b874d68fdc1ac60d7097b0ee968b3cbc4c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974692, "uuid": "97c81c52-2faf-4908-a568-ac6b23cfedcb", "value": "T12652C0FE1B297E0FA1CFCA34F54D2F250A125D7696050A90B3D32CEE363F5A31226964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974692, "uuid": "d3127360-8df6-419a-93cc-fa2a0d90b82a", "value": "192:15w6siZsvHzxfUOjs5r0aM7dvPzWuxZIEk72WJKyqP+eCrgnl2ik6r0/hIUInZv+:1N7uflTs5r0ndWuUvJBqPVCGrOOZ+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974692, "uuid": "f5902bee-b0ca-4731-8f32-c051dd334a4e", "value": 14019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974692, "uuid": "eec402bf-ee74-4b73-babd-d5c4199d7692", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974692, "uuid": "b557a827-01ac-4569-9b0d-a3bf022ead72", "value": "images_20260725_022149.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba50d02-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975671, "uuid": "244d3b13-7322-45e1-a9d9-8990a4c737bc", "comment": "Malware payload", "value": "bfb2e6bdb5e79986c45098b86c2f6dcf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975671, "uuid": "5ce61798-cc19-4e4c-843a-cc34d12d191a", "comment": "Malware payload", "value": "404c823152244bc7371b9400ada1c50629665b634e43efd2b0cc0954eb1d7a30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975671, "uuid": "e753c133-42b7-4bfc-a504-031fcce2da3f", "comment": "Malware payload", "value": "ba81dc90fef54e0d9e8b3730c822ccb921f6e184", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975671, "uuid": "4f3ab9e0-1999-490d-9628-21af90360bf2", "comment": "Malware payload", "value": "4b045c78e504ebb829ab8465df85d07cd3b99fc6faba7d548b722df16f06c8969b369a0a28cf3c8a3a68029c0bfb37a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975671, "uuid": "4d526bd7-1630-4abe-ada8-1632cee807ac", "value": "T15E62D0E3219A7E93D0568134B3EEC8BD4D7B25C7FEA4010DE0A859D4CEFD364AA68181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975671, "uuid": "3e827efd-1981-4f25-99a3-45464c19a432", "value": "384:DnR9l+e2d6n7JB6UdSf7tRbV3UwUy0aYN5Ob:D3lJ2d6n7JB6UQDtMTnFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975671, "uuid": "236a505f-e31a-41de-bc11-ae67a77a7b2a", "value": 15661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975671, "uuid": "c1c7e229-1c60-4585-82c0-fddff4abf922", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975671, "uuid": "45845bce-46f9-4b96-b903-640e5b0329c4", "value": "images_20260724_120600.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134380da-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "7a4cd47e-09ff-46f1-acc0-2f55842a3653", "comment": "Malware payload (Mirai)", "value": "aa9b53884143e6becc80c5ee0a5ed752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "900a9341-b48d-49f8-a94c-810bdf6fa7b0", "comment": "Malware payload (Mirai)", "value": "405b89d887891e0d43b349c8415edb18d75773205bc98a11676d6f7150bba858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "091b6c72-2bf5-4211-ac0d-9301019c3256", "comment": "Malware payload (Mirai)", "value": "e037841b9ac68e793d258c74d9f93867f43181ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "0195962f-01b7-45b3-ae17-60fae02ae951", "comment": "Malware payload (Mirai)", "value": "c1fd533c98edbd199780ec1148d557b6fa3de44031c50a7ea987712e1e5ac1f98304aaba071ed78813cf45a20e240b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998715, "uuid": "2072b7d6-1a0f-4414-b12b-b594b4910b1e", "value": "T14023F174B7880DE9DEBB6AA32D50A6873B7D4FDA6503CE81280C0FC655839287715CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998715, "uuid": "07656d1f-86a2-445e-bd06-6c8e239e89c3", "value": "768:Rd9F63jUNTmVcehlibeJAeqSvErYqN86hzsOXM4RHJqyNZYxuwUHjLAug1+fNfRV:lF6iSmgibKQGErYwrzsMv3ecIN1+pRdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998715, "uuid": "80f17687-264c-4426-a14d-a62b1d5db614", "value": 47460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998715, "uuid": "4b6de19e-b8d2-4580-bbaa-0e7cc4558e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998715, "uuid": "4993951c-db4c-4540-96e2-b0d4cfa2f7cb", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c75d8dc-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974759, "uuid": "f338a75f-ab3b-47b5-9b40-cbac06eeb544", "comment": "Malware payload", "value": "8dd7247dc1b2ac65c022c10746fff0e0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974759, "uuid": "6716764a-f8b5-4438-bc0b-9c80ab863e44", "comment": "Malware payload", "value": "422d29bd1e9a2419eb25519ddf019947ed813332905b3004647c132f03b187d5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974759, "uuid": "831a6edd-5bd7-421b-8bfe-cf3517edd827", "comment": "Malware payload", "value": "bcc60db5f77f4dd02adf4cf6110b8d3632ded83b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974759, "uuid": "fdc13a8e-da8e-46ff-9ab4-d263caa434ac", "comment": "Malware payload", "value": "63b856ecc2e336428bd9cf243cca593844ea614549c3b03f87d9aef1b974f9e675c2c6248958dcacb2dbde54a34ade4a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974759, "uuid": "4af75fea-b055-4a83-98fa-fd2fbb971abb", "value": "T159414B158E090962CB2BAC38D6EB0F3C3A203298E8F4621633FC44C85D9F2606E83C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974759, "uuid": "8907dcea-f10d-4a3f-9692-eca7471e5b5c", "value": "48:9O2jq+BSh6n3ICG8HVVyRwzXJTi4odlvsd0SkIuEDqOHqL+gdT:X4h6n3ICG8vVXNz6lIuTBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974759, "uuid": "87284f54-2d38-4f18-8fb7-fa2be77f1606", "value": 2372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974759, "uuid": "1631dc8c-c94d-4308-b7d7-3acb5ded0e40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974759, "uuid": "ff7b5a0a-494d-4bd4-ae85-2fac735f5bbd", "value": "images_20260724_132548.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4522e598-87f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784960144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960144, "uuid": "02f03ac1-aa01-4946-a336-629bea0c1e27", "comment": "Malware payload", "value": "7b2f738fdbb40e630469a0e14be027ee", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960144, "uuid": "0c4eca54-e4b3-4a4a-aef7-da80e9b4c05e", "comment": "Malware payload", "value": "43989993c32b49ae1d08a5eaf8841a903e13db0657ac6826198e95e2fadf26b8", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960144, "uuid": "aac11011-165f-4c05-87b2-1177a5d1af4a", "comment": "Malware payload", "value": "991c41e6f7416de9cca6bc433eb11f5b54464c33", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960144, "uuid": "4f632a01-a442-43f7-b9eb-262dd24eaa1a", "comment": "Malware payload", "value": "2635b652d38c31fcabefe872e26220b8a8a901eadf5314bb06b17cd6952cd88aa9b82df618e3da574348760d6cee17b3", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "ssh", "colour": "#FACEA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960144, "uuid": "f9ec4eca-4e7a-4611-9fd9-afdeedf5e791", "value": "T1B693010ABF24CD0ADF100CA327DE9E9E8C68BB5B469FB4B469D5948F67D00D97852309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960144, "uuid": "53f50d7a-85e0-4756-a9a4-9b4a657d65d5", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFW3RLlNCzgbo:phNlHuBafLeBtfCzpta8xlBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960144, "uuid": "f1595f59-39ee-4f0e-a88d-918731b27870", "value": 92928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960144, "uuid": "618e8db4-6a73-46f3-8e39-2a21aa528a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960144, "uuid": "f72e7340-5e78-40f3-b523-78c930097871", "value": "43989993c32b49ae1d08a5eaf8841a903e13db0657ac6826198e95e2fadf26b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ff7889-87ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784959173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959173, "uuid": "3d8bfd3a-ed25-4f4a-9747-512933a79de8", "comment": "Malware payload (Prometei)", "value": "8b15415a579559542cd798a8a71adede", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959173, "uuid": "bd463093-638a-4ca0-89e9-b3465c960dbc", "comment": "Malware payload (Prometei)", "value": "43fe665ac5639be66593a2cad6ceff61a255c91a605e3970f797b407b51a3b90", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959173, "uuid": "bf4b5b23-bba2-4824-bac5-3bf376e5f42a", "comment": "Malware payload (Prometei)", "value": "4e99121844a334b32addf33b6df33e8b39a05c03", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959173, "uuid": "034aa915-cbc9-4ae7-acf8-30527a2f1ae9", "comment": "Malware payload (Prometei)", "value": "57d32de57ca7c784a9c237170f193bd8d34b1a340c01eaaabbe9d36c0463b016ee3d574cb41cd31db29793e6e99abf11", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959173, "uuid": "8168ef34-894e-4ec9-8cbe-0fed886ed8b4", "value": "T17BE13191B8A0A970670DC03E999E494131CB572F451C2C2979AEF5203F3D6B2A3F87B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959173, "uuid": "13cdb05f-5f8a-42d6-a6fc-aba5e4a3e7f9", "value": "192:zCh9TLzVLJSXy4nutO5utxF0x+Fg7PHFd+bMmbB/NPB:QXtdtr1bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784959173, "uuid": "737475e1-6ea5-4948-8a5a-579336c03805", "value": 6878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784959173, "uuid": "a3fe4545-f9bb-4339-9b16-bf931d798756", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959173, "uuid": "a840c566-7780-41d6-94d1-cad3d2e6a3bd", "value": "43fe665ac5639be66593a2cad6ceff61a255c91a605e3970f797b407b51a3b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3c4219-884e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785000774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000774, "uuid": "505688f6-8fab-4ca7-b73a-5ecb22a61042", "comment": "Malware payload", "value": "5efca39b93a87eeddac34b384725d16d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000774, "uuid": "e3890f07-71fd-4a25-bfd4-d00577923887", "comment": "Malware payload", "value": "440789c3674469c66bbdcb706c8fc7af666b67cfb1fba4ae4886bc94b66aeaef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000774, "uuid": "864b3145-002d-47de-be48-ae9c724e71ec", "comment": "Malware payload", "value": "63687fb994e368b3b6c3a0afbdfc37d93559669d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000774, "uuid": "812e86ba-9556-4f6f-9bad-da46522feada", "comment": "Malware payload", "value": "e6f33c49ef8702651f5476556f5a83e5420c2a0aee1cac99923cac710f27afdf6775e7c06cec6e428cd94bc86e3ee74a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000774, "uuid": "6db1441e-d5bf-4342-928c-4869ba50cc85", "value": "T15AC56C07FDA1C8B5D0AB92318972A2917B30BD452F2123CF2A90B7792FB27D05975778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000774, "uuid": "06071eb9-db15-4c45-8f2c-8511f69a7bc6", "value": "4d791c7ff8a04656c4df23bdb9ebb892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000774, "uuid": "afd0e572-416c-4894-82e3-f8a9436b3841", "value": "24576:x7pxugvZkqGyGEwjQ498inZml46wvi86XpfEXBelesaKDQepY4sTG3oFB:x7pxxv2qGawk49bZkY96m5e3o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000774, "uuid": "4de7288d-fc29-4a6d-b0f0-6b11bf30ab2a", "value": 2545920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000774, "uuid": "e6b9ee64-efcf-44c9-88c3-83d6e8e73713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000774, "uuid": "82092d28-6cf4-40fe-b072-780277642ff6", "value": "curl_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a35f71-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974713, "uuid": "c1288786-f4c3-4477-a905-1d14dff042bb", "comment": "Malware payload", "value": "b79f89442f9212b7bb8affe130548f26", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974713, "uuid": "ba8c31a4-4beb-423f-83e5-5f98dfe9469e", "comment": "Malware payload", "value": "4492849289ad00c3d99a859b1f0321024b6a1d48adb19e3c4b5e8a3f7b0b250d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974713, "uuid": "6106840d-7613-4c77-977b-1854a7d7419a", "comment": "Malware payload", "value": "852a4a555fe7ca2ee646d0e6c75c710b05dbd00f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974713, "uuid": "5ac33358-87a9-496e-82ab-af3f796a8eaf", "comment": "Malware payload", "value": "d70f1f5854574f02bc2b03e508673d77db7b79689f019b36541f22e53f2727ea3cc5c8f5f04d841a8cba2b28bccd4aa1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974713, "uuid": "e6a0f753-9747-4348-a4c7-d229ff0182c0", "value": "T196515C2826F297B7D9492B3036871DAF4D0B2E10836866087279482CABC02BF053F6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974713, "uuid": "4e1f69dd-d57f-40fe-ab9d-69e5636db9f2", "value": "48:9V3GhEllI5+KB35Cm2czr3xK6qLoP808fBY2HLXGy4IZpFic37Slczwx7Opprm7h:nGGnU+K/x2cPsLoP808JY8rGZIsI7SDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974713, "uuid": "ab32aa3d-eee6-4aad-8c0a-6e90659262ac", "value": 3038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974713, "uuid": "1436cd50-1ede-428f-8313-b70a076b5ed7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974713, "uuid": "0e8aa705-831c-4f4a-975c-ad5b997f4e17", "value": "images_20260724_232842.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc074848-87f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960800, "uuid": "32609f82-9b92-4dbe-a8c1-5a3dc0c9c056", "comment": "Malware payload (WannaCry)", "value": "687136a7d7e1c1e201913a6168e047ac", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960800, "uuid": "51531f5d-e0b7-4e9d-8540-cfebe32563f4", "comment": "Malware payload (WannaCry)", "value": "44acb3159fd6e085d3fce3991211912252edbe24c2a1b94b04d55431edab2630", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960800, "uuid": "d4188eac-39be-4250-a6de-23b11b54dd66", "comment": "Malware payload (WannaCry)", "value": "77bd23afbfc26ea16c6507263fc881d4eed4cb84", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960800, "uuid": "f0acda36-adc0-4448-8300-cd5e6cfaf844", "comment": "Malware payload (WannaCry)", "value": "c8798460927f0d5cb8db955e753ec44e1c22374702613f11b07f25dfa2b0f4fc986184bec61709137d87c2256b1cc65f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960800, "uuid": "fbe1ccc7-1566-46ec-bd41-16a326546a9a", "value": "T11D36239571B880F8D206257484BB8E12F3B37C6A22FA5A0FEB40497A2E53F56F754713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960800, "uuid": "154c7e14-e06c-414f-a5c4-7bfaeaa9e343", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960800, "uuid": "9c44d40c-df56-452a-bfa1-5eeec244f0f3", "value": "49152:jnsnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMGPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960800, "uuid": "ebe5eef9-7610-46c2-8593-65bcbef66ded", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960800, "uuid": "b4c4796c-d17d-468f-a122-c7de5a4d0f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960800, "uuid": "4461c43c-0c8c-428d-a25e-8e6894061815", "value": "44acb3159fd6e085d3fce3991211912252edbe24c2a1b94b04d55431edab2630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846d5603-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975283, "uuid": "389cd185-1bf3-45b4-8b0e-c8cf5982760a", "comment": "Malware payload", "value": "8048cf43e923e48fa6844556a0a5f0ad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975283, "uuid": "e2b4fc5d-3e51-4a0b-b58d-c520524dd0d9", "comment": "Malware payload", "value": "45590953db9243ba98b2a395ab32073e81ffc9394105ff5e45713f0ebac49264", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975283, "uuid": "2c0a1750-6626-44ce-b541-431c585b1b27", "comment": "Malware payload", "value": "a2c0022e3391ef39166cdbf89f7094229f1780c2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975283, "uuid": "8248c12a-0a51-4893-8ea0-c0b1e349a188", "comment": "Malware payload", "value": "6865264772236fb7ecf68028a9b8eafe7a21cd68f638fb3aa8719d98afd6669e0293645bae2d3a425b651c4b1fe936e8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975283, "uuid": "8f8d5a4e-dfe5-4f28-854e-6ceb2589a40b", "value": "T1B442C0F84F1FE426862A0DB544761BCA6D5230AD04D22B49EA8BD7C53C18F06FF6E935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975283, "uuid": "56f947fe-cf82-4b15-a0f9-1972018b6aba", "value": "192:0Owzt0C/6xEAsg59CIPrkuS/4PVUZJh9YPTEUX34EYpDT2rg8Wug1rjRUl:TK5yxUe9CruSgPehWPQUHQX2rg84lM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975283, "uuid": "19561392-0da5-49b5-83b6-7d3d56a322b4", "value": 12495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975283, "uuid": "62c3c1a6-54a7-4d43-9682-3eb9a64e2d70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975283, "uuid": "61b5ff0e-7772-46cf-84bb-166c14a0433d", "value": "images_20260724_190541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904a9e58-87ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784966713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966713, "uuid": "ea7a08aa-7436-49ac-b88d-94a8f4864153", "comment": "Malware payload (ConnectWise)", "value": "c5900fce22615da62bfda61f51e63f63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966713, "uuid": "5ab8a791-cf0b-49ef-9993-cd43da8c7c26", "comment": "Malware payload (ConnectWise)", "value": "459a970946abe6613b2fc55fb2fa1213f936e6375bdbc73b864ccabdc230a40e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966713, "uuid": "225935a6-39a4-4af1-aa00-6b36f400080a", "comment": "Malware payload (ConnectWise)", "value": "7a8decaccba59a6c2dde35123e70dd87522c09d4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966713, "uuid": "8ac6097c-1adc-41e8-b342-5e1d994becc6", "comment": "Malware payload (ConnectWise)", "value": "bc3993cfd4152d8baae9e8f74fb5f93b2751eee5e250fa376616062a8d5f9f270e0366b351d354630ada11a8af312a35", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966713, "uuid": "3cda8fac-8724-4826-9fb9-42d9b75118af", "value": "T13DA6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966713, "uuid": "7351455f-c45b-46ac-b551-70dfe0558cc7", "value": "196608:AoHQjDSOgtMPXDoHQjDSOgtSDoHQjDSOgt6DoHQjDSOgt:AowXS6TowXSUowXSQowXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966713, "uuid": "2e4434e4-cde7-4c63-a1d2-c6f6a38a5ef3", "value": 10223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966713, "uuid": "c813798e-54fb-41a5-8da7-5b3420a770d2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966713, "uuid": "6b3eb76a-db61-4a3a-8aa0-c54d1627d771", "value": "459a970946abe6613b2fc55fb2fa1213f936e6375bdbc73b864ccabdc230a40e.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642507d8-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974799, "uuid": "45eb8834-fd42-4368-b159-73346aa4b6df", "comment": "Malware payload", "value": "2f1f5fda5ff1a09c42553a712ad9103d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974799, "uuid": "cad0bd31-045f-4588-93f3-b48b81fb5cc2", "comment": "Malware payload", "value": "45d1b8d7638e376ec1b3e98f1c17fdc793430dee5369a1a71272efef4f1ccc11", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974799, "uuid": "ff8e4fe1-25e5-4b9a-925b-c0cffb1dbe75", "comment": "Malware payload", "value": "e603be6ca807ca585fc12f8139790a84a86adbc8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974799, "uuid": "4a4e95fc-6997-4fec-9c68-2cad4c4656b5", "comment": "Malware payload", "value": "32df41c4a14c3640dab9b70fbdb06779d9102b4a55d23d8f46f1ce02d37a657a09ddc25cfd3cbec3fffa8a165487edf0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974799, "uuid": "49b756b8-9339-4546-aa84-b6ec31c3d636", "value": "T16262D04693A2407BA43FAE7F34C27F2E7732438F06852EAFA0055E9654759B9301B53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974799, "uuid": "41140049-5bcc-457a-82bf-5eca42499086", "value": "384:fAqnevS+xnBGw94F0X9vyr9FnfnIXkD/jvpniwmI:YqeZS6fX1unfnI0D/jvTmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974799, "uuid": "d0e673be-db9a-429f-aecc-b81fb052b205", "value": 14688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974799, "uuid": "a051fdb7-3039-415c-904a-ecdec1917ab3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974799, "uuid": "e58190c2-6aae-46bd-9556-ea66a36f0946", "value": "images_20260724_192322.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c997ef-87be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784938855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938855, "uuid": "d158c47e-5547-4f4b-b065-7dade21901c7", "comment": "Malware payload", "value": "90310eea1021296a9c933095b4aa4a81", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938855, "uuid": "13716a24-f279-48be-a9b0-d6770ce4962e", "comment": "Malware payload", "value": "466a8dae57b8e22de57a0300845e2cba716e90d0b44a415b395af39f61604ebc", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938855, "uuid": "bdfe4f57-2537-49a4-becd-4f7a5bceff76", "comment": "Malware payload", "value": "e418d28d06071e90d4306676136f64e5e34d31c4", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938855, "uuid": "a51429ec-a0a2-49d1-9dc4-06de8f16f94e", "comment": "Malware payload", "value": "477100c13e3c4da538761969efaaad5c88dedef5671ea00af6f73a42c9b9f6aa0f077d9885de6ee66e51780e83d4ba3e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938855, "uuid": "0a4c33ae-695f-4bf3-ad58-e453447adebb", "value": "T1D6286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938855, "uuid": "8bccef41-d19e-423b-9ae4-1137769575d5", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938855, "uuid": "a7a28df0-50cd-4348-8262-cba9f239d70d", "value": "1572864:3Za7hmguP2nG0/Vyv7UhgxIabc/x7Awby:3Za7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784938855, "uuid": "6818aa7f-7195-4dcf-be32-54f52283df64", "value": 97861120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784938855, "uuid": "2cfa5b7f-8d5b-45c8-9331-c6c9b4bcde02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938855, "uuid": "c56c413b-1513-44d2-8fe2-0b0309177411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2a9cf5-8835-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989738, "uuid": "039821fa-545e-4462-b6dc-3b0b3a16bb03", "comment": "Malware payload (SalatStealer)", "value": "a1afa2cf674e56a055b95de0a7c27d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989738, "uuid": "c6dd7f8f-534e-4996-9bc7-fe654c2ef52d", "comment": "Malware payload (SalatStealer)", "value": "47377911b9784cf8379421a5da97eb06e3931d34ab87086e3384478b7893343c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989738, "uuid": "68180a42-e25f-411b-8eda-d1d9cae95ad7", "comment": "Malware payload (SalatStealer)", "value": "761ab02732bad4e6f5c9c8e7e5bac4845baf0099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989738, "uuid": "1f3cd422-724e-454e-a0eb-69297a67112a", "comment": "Malware payload (SalatStealer)", "value": "5aec73971f19fb2a966d5bdf9f3ca6a578924696a66bd9763588381702834016d67138736218ac08b91913b1d330c955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989738, "uuid": "8c2a0d28-5859-4a32-b283-71b2774af364", "value": "T17DC65B11FACB58F1F9035831406BB27F23315D048B28DB9BEB583B6AF87B6A11976705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989738, "uuid": "3e4197c8-beb8-4427-af43-89640e356bce", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989738, "uuid": "b0e13559-5852-42e7-9e2b-16476d28323d", "value": "98304:4/b7ootQ1bexigv+1vUoddPttof46jEi:ctpjvw5PtWfrwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989738, "uuid": "89afabbb-2828-4491-8a14-bf98c1dd7fc9", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989738, "uuid": "ab6873ea-a0e8-4aca-bdfd-0d0e10521d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989738, "uuid": "cfc4deff-f720-4004-ae95-b1ce9d050352", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9933ce-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975239, "uuid": "d01d4ac3-2674-4fff-bc3d-021ecbbd5d29", "comment": "Malware payload", "value": "875cb269f92335441743d1f9c44aa20f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975239, "uuid": "f2288bec-6309-4c07-90fe-22e388c46320", "comment": "Malware payload", "value": "47a5c1f320a5335f232fa255ea55c61e77f09c72a9418a8c6a08ce6e219b69a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975239, "uuid": "44c4c658-c77d-404c-95be-445f35ce2662", "comment": "Malware payload", "value": "8fc369de392562237972fae99b4942d37086772e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975239, "uuid": "afaf3fcd-515f-4166-9b61-ef4b5d346c62", "comment": "Malware payload", "value": "931c36af09c82b7a4b417f77d6b1d26d377d26b21394cb6d15e5479f4264cd4cd6060425f23d08dec1caae01251d3b4f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975239, "uuid": "c1c8ec3f-1137-463b-9645-cb5812386f85", "value": "T1FC02BFB9C92A99A1CCE4F33FF25309A58B64D291C5605A4BDCBC833CD63ED992BD1D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975239, "uuid": "80e30203-cce0-45f2-aaff-48ba38c9d1a0", "value": "192:UuLqN6j8T3LtzmRCKv72IA0Eyvu9gEFUtxcNXO85a5TK2:nfM7VeyLKu9gEFeplK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975239, "uuid": "2b2fda74-79f6-4ced-83e2-2d41adbb5478", "value": 8985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975239, "uuid": "80fceedf-f5ee-49bb-a841-fb590d7408e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975239, "uuid": "2bcf667e-39a1-42c4-9235-e8aec0cc91a3", "value": "images_20260725_001415.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c48a33-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974688, "uuid": "14ba5472-78bb-4637-8e20-f7464f691fb0", "comment": "Malware payload", "value": "075f83dda5352885f402ed442f62d32e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974688, "uuid": "8e4e8d6f-591b-4e58-b6ea-cbd79537ef13", "comment": "Malware payload", "value": "48f4ee8fa7d00c296a5f6af9e12fdbed375f4851c1792937de0f06c84f79f4c1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974688, "uuid": "1bae19ae-1008-442b-80cf-8a95ac952e60", "comment": "Malware payload", "value": "8d63f8919091a3780fba294361226971f7f5cc1b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974688, "uuid": "0f847976-79ad-47f7-a58b-585792f4ff2e", "comment": "Malware payload", "value": "554db46680800706ec96702d9a43cf6e9ce4348f300fd9e87a9b68dc1235c3b34451e19623e90841576ddaf14023ce8b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974688, "uuid": "a8665017-a7a5-4593-81e4-b704e9bc44af", "value": "T125617C354083B727C9D377F030872AD92A3824A85D19239EA27E11A8177211773F33AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974688, "uuid": "e009893a-ac66-481a-8c14-3cef581024ae", "value": "96:feZCkSGrZOJrCZMPAo9e/xxwTSEZ8pQbQGbOV1uZlL:feZfSGrMJbLlZjbX++lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974688, "uuid": "15d45afe-c2dd-4711-88b0-666c67d9412b", "value": 3373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974688, "uuid": "fbd652f4-b5d4-46e3-adfe-007921eef865", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974688, "uuid": "48b5d924-c53e-4b5c-9075-d7273298adfc", "value": "images_20260725_083905.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6c1777-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984613, "uuid": "f6841f3c-c539-4b72-beac-fbf250b6da85", "comment": "Malware payload (Mirai)", "value": "8e192bac87799320d9444f5d72bdc95f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984613, "uuid": "e9c9fcc1-71df-42f1-b6fd-6d2dff03fe9d", "comment": "Malware payload (Mirai)", "value": "4914ce270a55080b4fe49b6d9b0d16ea1f1d45f4cb60cb77661770d5dfa0dbc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984613, "uuid": "8e72a785-a58b-40b8-a86c-2b6eb8c90462", "comment": "Malware payload (Mirai)", "value": "7f1172ee602686b7f8d295303c29db9bc30d914f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984613, "uuid": "d437d18a-dbea-4b82-aa7b-047fe151430c", "comment": "Malware payload (Mirai)", "value": "fbdf03a896115f47957836351f49378effde0467fabd46c61f90e23cef40ae4743ce3448730ff57d607e20146fa71924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984613, "uuid": "57791aed-7100-47e6-80d7-1aacbc497867", "value": "T13ED33A46F8824A21C5DB12BEF92E218E331257F8E3DE72239E155F2133C669B0D77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984613, "uuid": "b755a82f-9503-460c-bc12-acc96b9526ed", "value": "3072:l+kpOc2YHbGyq7APc6umECLtaPjFTHAb6iZjIHLphp+:l+kc7AP5nECJa5Ub6YIHLphp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984613, "uuid": "38939157-edbf-4494-aa27-0584c48ab9d9", "value": 132892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984613, "uuid": "826a2446-2502-4225-858a-a230026eefdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984613, "uuid": "25a4af58-c294-41d9-9d83-203d27853b07", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d348e6f6-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784979710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979710, "uuid": "b3fcaae7-fe1f-4d46-8d0f-f92dbefa84bc", "comment": "Malware payload", "value": "ad3088366c8be162715af576a67fc1f9", "object_relation": "md5", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979710, "uuid": "997c0e3c-c808-49e2-97de-959c633cb8d0", "comment": "Malware payload", "value": "495a5ef312cfd6d178b8426e0b65d6dd8d75bb21ca8e587de3d4f8dc293a8216", "object_relation": "sha256", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979710, "uuid": "430bbd20-e279-4da8-87ad-fd7f02a0a116", "comment": "Malware payload", "value": "886731240dcad46b0640c1031e89af21108c15d4", "object_relation": "sha1", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979710, "uuid": "8ea60629-a713-4523-9257-ee07891d591d", "comment": "Malware payload", "value": "542a2881e556edd7017eacc29c71dd2200c4fcca91249dc3ac0264d0679d6980e24949c0795469bcb7aa9e9f89f38947", "object_relation": "sha3-384", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979710, "uuid": "fe29aa9e-e473-4ac3-b505-da74bc1770f6", "value": "T18F76D017FB51896AC8FB427549F6431A2707DE168A838787154C72BC7C770E42E8EACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979710, "uuid": "d2337154-4dd7-4272-8fd4-87aee35e6cb2", "value": "98304:mBdzbg21XUG4XZid7UAUtyeXvOxIHbGqhoF6zwE0hXHnEb9GVEo/Krrwes:a9bPd4XZidgRtn/Ox+b+FuQXnEBGVQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979710, "uuid": "9344bd02-84ee-4827-89c9-bb964be7dfeb", "value": 7314528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979710, "uuid": "7a485b50-4e74-4b02-8dfe-fe12a9112785", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979710, "uuid": "76072422-c534-48e4-9e8f-1a4f733cd73a", "value": "495a5ef312cfd6d178b8426e0b65d6dd8d75bb21ca8e587de3d4f8dc293a8216.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99fcdc0-87ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784958729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958729, "uuid": "774f0932-f04c-40de-bbe9-a2c7ff7c12bb", "comment": "Malware payload (Efimer)", "value": "4c4812775fecb59557cdd0a9cf660ba0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958729, "uuid": "41c8bf54-81cc-458e-9946-f5507ed4481f", "comment": "Malware payload (Efimer)", "value": "4a5e7c48738e93e4b9e4a529741c74e4a66094a95939f7252eb832a1585812e1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958729, "uuid": "8ff46deb-d58f-4223-953a-172c550a38b3", "comment": "Malware payload (Efimer)", "value": "50734fb839d760deac8316397750c0425a626685", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958729, "uuid": "78d81ee0-6a97-4900-8128-c9fea3a94019", "comment": "Malware payload (Efimer)", "value": "d08c7beb0520bf61da4714575f1f6df48f4ea8d5a824a59315d773806960167fcdb0e87c53ad660d8fcab9f4dd1a0d7c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958729, "uuid": "de530cf4-ec20-4d7e-8880-aa30f253393b", "value": "T1ACE6332890D062BFD57740786EB15668CDA0B87647B6CDCF0BF887E76E131A18D38627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958729, "uuid": "92622012-998d-45dd-afcc-7de9687053e1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958729, "uuid": "5959e081-f26a-4331-8778-b2be6b874c6e", "value": "393216:FqLJ0GHeJaxM/Tr+fXMCHWUjXscuI3/PGTAI:F4JlecxMrCfXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784958729, "uuid": "be4b6fee-31e7-4b6d-bba8-e5ffbab90a00", "value": 14308401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784958729, "uuid": "8cc99f8b-1100-406a-bfa1-645308a1b68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958729, "uuid": "f364c1bb-f2d7-4103-b451-295394a0633c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75abdec7-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975688, "uuid": "b71b58ba-689e-41d7-97ee-3320bbc40115", "comment": "Malware payload", "value": "24e823fbde23818f172a4b9f49267518", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975688, "uuid": "3213782b-6f3f-4825-b805-4911fd6f0bec", "comment": "Malware payload", "value": "4caae0f550da1fafcaf4aadcbefc71faf6ce44ee40cd7f8e1a95eaf7f3b5e61d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975688, "uuid": "24f9aa0c-39e0-42fc-a168-9d4c808e2edd", "comment": "Malware payload", "value": "5713482597066e8aaa664c419ad3a34c587e024c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975688, "uuid": "a0df0ad7-393f-414f-aab2-9d2ad11d4e74", "comment": "Malware payload", "value": "ec7b03d37af63902cbf1096da7e28423af3ba1d438913a5d82cc2a6cc8fb27d33e869f31f4b8eefb31fdd449a78cfbee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975688, "uuid": "f527cbc9-7bd2-46f7-8016-a5616872fc3b", "value": "T1C852CF51B31674DD5E6E70EEE37E9A24949323C67088CE19BB40463E46183D4370B9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975688, "uuid": "9a1d5e46-a212-4952-b853-0087e0cb400b", "value": "192:g880tz4hZNkbIKIh3gff62aDkRGWl3XXmNAFugMPg7UqtubPQgWAEaDgHOEq:gLym9k6jD07GF1DbDNELHOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975688, "uuid": "2a1b9152-34d8-4f15-b7eb-9f36ba8e46b2", "value": 13355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975688, "uuid": "b4c0da01-7115-4334-8b43-42edca82e690", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975688, "uuid": "5ac8a266-ca00-48d7-902b-f35ba3c08872", "value": "images_20260725_083136.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597a3974-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975211, "uuid": "a299e5a0-650b-423b-97df-2a214f1d7e5b", "comment": "Malware payload", "value": "d15e4117a4ab43f96f2802b9308f3055", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975211, "uuid": "92f30946-b4f2-4117-9e9c-8c6c15e609df", "comment": "Malware payload", "value": "4ef64c8e0fa5b37000a02372f90989af60132829a5a4ec3bdfd45d48d5fcc379", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975211, "uuid": "200f72f0-2d25-4435-abcd-4ff118f779d4", "comment": "Malware payload", "value": "9a46419e7a12e90274ccd122bb220af71e5d8de1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975211, "uuid": "19b06452-958a-4edd-be51-d395664393bf", "comment": "Malware payload", "value": "8b1b17ee828f1ed9915eae884b353c2105e7b8cc521a4ddca4599133dd429f48a643e658fbba44f1a9ce264cf67fce01", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975211, "uuid": "40e21930-d0c8-48a7-be35-385d2f43a3f1", "value": "T1B8615C4E94140029EB4F66B1EA5C3CA486C28FE905E7EC46ABD0F22839D2B83275F156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975211, "uuid": "e6f4b6b1-c57e-41d8-a9cb-4c5aa632e7f0", "value": "96:nPw0RkWBjMY7PqIeG1uQbPfw7ZwPWyUjoM:nJXBj7TqIB3bPmwPkjoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975211, "uuid": "3440821a-6ceb-4b3d-905b-5239aa231057", "value": 3201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975211, "uuid": "b20072b3-af97-416b-944c-23771f0f0d83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975211, "uuid": "dbe77d06-a16e-47a4-a77b-17558890f24c", "value": "images_20260725_090803.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be7cde2-8827-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784983671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983671, "uuid": "b1020820-2261-4755-8fdf-c8a89864269c", "comment": "Malware payload", "value": "9644c33d2ddd97e07067f7d396eccab7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983671, "uuid": "dfbe269c-403f-49fb-8246-4b22c70b070f", "comment": "Malware payload", "value": "4efe4cac7fda5a6744a0ab8508e3a561128aef0ac820d499dc4d2ec0d3568876", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983671, "uuid": "a3206d1a-75bc-4f1b-a90a-9e05871b381c", "comment": "Malware payload", "value": "757113286016dc63961509f41cfa62f327e35df0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983671, "uuid": "a91a4b47-7bb1-413a-9179-d3dd37b6cd30", "comment": "Malware payload", "value": "e4579ad00736934c45c82d304c874dafe8d39302324bfc9c4f9d99a6166498cfeb3182b29f48bf44ed71ae5ebfd0ee7f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983671, "uuid": "6974c4d2-13db-412a-85fe-11d63bf08c27", "value": "T138C27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983671, "uuid": "e4a56b70-b99f-480d-9b0b-a428b6f8caa3", "value": "768:s8vCB+25j6es8R39FYpMSUpi+20qUpi+20YQX:s8l25JRd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784983671, "uuid": "29cdceb2-b689-4e61-9271-93bb90d2c2aa", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784983671, "uuid": "5b970271-c30b-435e-9839-ca43250b4c08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983671, "uuid": "8072211f-3d16-4232-aac3-2b38bfeb8c2e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d658aa79-87f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960817, "uuid": "c53abcb5-cc80-490d-97fc-163860c4ee3a", "comment": "Malware payload (WannaCry)", "value": "a554260842be80f9fddffcb47f203d43", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960817, "uuid": "9515125d-b303-45e7-a7ae-5107f0631c31", "comment": "Malware payload (WannaCry)", "value": "4f4f30d07cc0ed90a92e39b637da4dc99aa76f36cff2362d4d907d77a2465ee5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960817, "uuid": "912ca275-4c3d-4472-9388-19e74050928e", "comment": "Malware payload (WannaCry)", "value": "546db363bcc9266c133b8363c62103b7a2f1940b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960817, "uuid": "0edb08bd-96d7-4eeb-854b-a40acf78c671", "comment": "Malware payload (WannaCry)", "value": "c353065d29a7295275caeffed9b15fea7772ecce81019db26c6e80c82bf6f57138dc492be44b8aeea5ff51de8fad3b03", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960817, "uuid": "6bd99977-374c-4f8e-a13b-0c901d2750d1", "value": "T18236F601D2E51AA0DAF25FF7267ADB10933A6E45895BA66E1221500F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960817, "uuid": "9a540096-6aa5-46f3-80aa-e579cab12a60", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960817, "uuid": "34d71b7c-8913-4952-83db-fb31d246f642", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DXDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960817, "uuid": "7dabdcea-a762-42ef-bbf8-509ed14bc71f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960817, "uuid": "12f6764c-1136-4d3c-8ab6-9870c01bc2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960817, "uuid": "bc267707-b6c7-4829-aba1-e18ed0f30d66", "value": "4f4f30d07cc0ed90a92e39b637da4dc99aa76f36cff2362d4d907d77a2465ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86ac241-884f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785001140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001140, "uuid": "e10e9aa4-d47c-4591-858c-c53d46c396a6", "comment": "Malware payload (Vidar)", "value": "b6ea03ecc9f09124603cfde6c0017483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001140, "uuid": "5ec6026d-83f6-492d-b94f-8fe8458fdc2f", "comment": "Malware payload (Vidar)", "value": "4f8df06e14378fef16c78183525ba7c0dbcc5176e92ae20102d6ea25dbccbf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001140, "uuid": "ff27ee5b-027d-4414-ae0a-e5e8bf28c826", "comment": "Malware payload (Vidar)", "value": "44bc98bc9831d5a22e7dcddd7dbbb6387f9e17cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001140, "uuid": "db1fad58-5247-4aa9-aeae-546f9ed8550b", "comment": "Malware payload (Vidar)", "value": "db2cc84506687b4a16c02763c6a3b05d968c58f727371fb5f691905b0d37362c3d9d6328c43436ad6d98820fdc310336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001140, "uuid": "e9cd100d-cd91-44cd-a7c8-55e4b7e49862", "value": "T1D7068C13AC950AF5D099A331C9B79611B735BC091B3233EB2E60BB782EB27D05D79B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001140, "uuid": "3ca0944f-2701-4e79-8d81-4b70788583cd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001140, "uuid": "6f0dc357-8dbe-4f43-8378-481841c17084", "value": "49152:eupKXGeiLFcVG5VBPYscMAdeHFR0BnPTl//2WJNJuqH:eRqAsFROwWhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785001140, "uuid": "304abb69-7b10-4001-9b6a-7d7f4460b5ad", "value": 3788120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785001140, "uuid": "c70dc588-a08d-42f7-a0fb-6e1b49ab9f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001140, "uuid": "aa8c9556-de04-49aa-ae56-63e1c9e5f5d5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4b8ec4-87c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784941612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941612, "uuid": "b8c5e76c-f37e-4356-a360-81e25c9b038c", "comment": "Malware payload", "value": "f3fdddcd8d4ddf617412cd5ad213dc0a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941612, "uuid": "eb42628a-30eb-4921-bf72-70468104c148", "comment": "Malware payload", "value": "5135d169aa062fc63be67dcfabc9efdb12a3a88dd658b33791f0d392d784dde2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941612, "uuid": "e20da8b3-030d-4118-8c46-6db480842a02", "comment": "Malware payload", "value": "2e64cde2923f2012ff8645a3963f79f5323fa5c1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941612, "uuid": "a76b4848-f54b-491b-ab48-ae0b228b75a8", "comment": "Malware payload", "value": "6909d4d99de7f711bbe33f7dfb5383f728a0f7b78b1f0638e7e1465c8e5537c91be61208efb54be9a82014a5363544aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941612, "uuid": "ed8c5075-5613-4fba-92f7-f595b8b2480c", "value": "T103D09792E573017010E58A14F2C7AC40B422CF7F0CA1C16CBAA3E0B00F11A8DF1C1F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941612, "uuid": "2385b188-4895-4824-8ab1-1af4f99bf443", "value": "6:hT1jCA/ppznervsu1ZW5pAulNXYq9DG+NjVsNXYrkJ:VdCaTmsunyPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784941612, "uuid": "26af0a7a-bfe7-4077-b2c0-7bc263eac1c5", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784941612, "uuid": "cec33f1e-bb1e-4c45-b358-a32df8ae46ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941612, "uuid": "627faf7f-6c17-4ad9-b827-cdd2414d382b", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecca853-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998654, "uuid": "5aad7784-fb61-4ac9-8106-7b272e9f0702", "comment": "Malware payload (Mirai)", "value": "0922f98b6900f30abe48313b38e1c3e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998654, "uuid": "db4a1cdf-4b2b-406a-a131-a41c78f2fb83", "comment": "Malware payload (Mirai)", "value": "513fdafabf21c835cebd9a81046e705f8b0c1722129b90c25bf48e1594cf2cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998654, "uuid": "19ec4030-6d87-4928-91a3-da627481060b", "comment": "Malware payload (Mirai)", "value": "1047061069938b96c354fe3e7c12c10bf0a59384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998654, "uuid": "46c21148-5437-4edf-9380-e4e14fc64cd4", "comment": "Malware payload (Mirai)", "value": "e5f2b83d6a04b788a3a624b3249e031fbebdd4a33326a000028315f695500b75e3ef0bd80db77606a5ae95aa04cb97bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998654, "uuid": "3e800fc2-1773-43ae-be1c-0a37d19bb76e", "value": "T15FC32980F58F85F6C50B8D3060A6F63FDA31D5A981A3C66EDF949F72CA63581921238D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998654, "uuid": "ba198c1c-bb6e-4166-8ce7-f7a6e9aa2615", "value": "3072:U8LBPXPd4yN/ExuVLgv3fv7/tGTXLVOAPRX9qs8Hp:UsPXPd4yNMIVEv3X7t+LCrHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998654, "uuid": "dcb51ac2-804f-43f6-b307-096ad89f842a", "value": 121172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998654, "uuid": "ff951dfe-0a32-42f4-a927-b4f6d32c9b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998654, "uuid": "8d3fa9b2-4d2e-4f78-8f86-95dbf89cf736", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8241d9-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975780, "uuid": "727176fd-0976-4b09-8643-acdf37bb3387", "comment": "Malware payload", "value": "bc097f2c167aa2e735d09413569cbf82", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975780, "uuid": "412dd825-2267-4626-86cf-8efdbd06c027", "comment": "Malware payload", "value": "528b5406867eab28cd8227fec4b374c512cd9fa6931b654e2c6278050c86ebfd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975780, "uuid": "af13577c-808b-456e-bb89-4f3200cc4065", "comment": "Malware payload", "value": "7a29377655492f6d0429c7bac14aebec13fff63c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975780, "uuid": "9d032d04-cd73-4dd3-b223-5de13fe3430f", "comment": "Malware payload", "value": "021d7f9dc71fe57eb48317179fd3001cc3125525a27ec131aae9868482002916e93e77f679b25f8e9457fe64740ae84c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975780, "uuid": "d12583d4-ab23-4bd5-9d11-31296693c2ed", "value": "T1AF72C0F4D543B128F5B02539FB8D7161AB80595B93C67017D6562068398C4EFB33E7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975780, "uuid": "b0a90189-bbef-4a07-a725-a999456efb3d", "value": "384:zNaoUN7rvieaWfR4ykjKbBfV8qzSnr2V8bDwZewt:RaoUN7bieaWJ4yRdfV8Nr9IZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975780, "uuid": "b7b6608c-73db-47c3-8b17-4190686685be", "value": 17399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975780, "uuid": "b02ce20b-563a-4408-8ffd-72ec35ced355", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975780, "uuid": "44b4d42f-ab1e-49b4-b5c6-509a96f4246b", "value": "images_20260725_011659.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09c9850-87ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784966794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966794, "uuid": "fb3ddfca-a9a8-4d16-90c3-970bd18e3f66", "comment": "Malware payload (CoinMiner)", "value": "5a59127af8fcd4d20671f83f4ea243a7", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966794, "uuid": "97ae4ddc-6ff3-40f3-bcda-48cf5f792a04", "comment": "Malware payload (CoinMiner)", "value": "52f447218c94376f552d1c2b5bfa01c4ef2b5d32ac9ac061236cd286a9efba67", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966794, "uuid": "f23f1fed-9c77-4732-93a0-a62746f1bdb0", "comment": "Malware payload (CoinMiner)", "value": "b1979a03b72b7ced1fffb9e4dd34e0e01adbfc67", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966794, "uuid": "90827e9f-37d9-4b5b-bb43-c2ada7f94763", "comment": "Malware payload (CoinMiner)", "value": "7aab23cfb0808ec3734caebe4753503f65e2a48265f1e554913ff2ef263fb0d75db9b38bcc62b75bcbb4f734d59f5d70", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966794, "uuid": "5060a105-15bb-4798-ad32-6bba121c1757", "value": "T1233633EA7DC61070D496C3F88662249DF13ABB229A617C1639CD2C4C8EDBF21547D7CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966794, "uuid": "470edd5d-f49c-4067-92c3-cada141b46e9", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966794, "uuid": "ff9783eb-1fe9-40a1-b777-be0a6327f9d3", "value": "98304:Cjl2QkuIAjZCvdc+TtQ1ydawevYrZdVAsLQWYM3v09ZzoGhs65:YlckjG/TtYydQvCZdrcUvUoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966794, "uuid": "44633173-4915-41ed-a98b-18de5ebf44e5", "value": 5241856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966794, "uuid": "6bca19b3-83ed-4233-8ecc-f326d5422a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966794, "uuid": "8599e0f4-4db1-472e-af7e-ffa8b1c4de67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb307985-880d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784972798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972798, "uuid": "c591da9d-14f8-4b29-997a-a913bd857c7a", "comment": "Malware payload (SalatStealer)", "value": "77307555f8d4076fe040ddc0ab1f0fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972798, "uuid": "8f758847-3e3d-49dd-ac9c-2cac0113a8d5", "comment": "Malware payload (SalatStealer)", "value": "53030654fbe1aef7d34abb151ac5725291f9a880d1fa2ee5b174445abfab6d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972798, "uuid": "2ba43eb3-dfa9-414f-9bca-47b0ddc7bcdb", "comment": "Malware payload (SalatStealer)", "value": "bcf403c073cfafcb22c364ae8e5bcc595437a4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784972798, "uuid": "52e8bb80-21d8-49b1-bcf4-850375537a29", "comment": "Malware payload (SalatStealer)", "value": "a3814eed19498a4dff4048f9c68d91a960a2c38f5bc50e2b92f1591fd05aa1d7f003f8d44bf65c40ce823748f5d56f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972798, "uuid": "bfb9964d-b331-436e-99be-a675dedcc4ef", "value": "T10BC65A11FA8B54F5E9031839406BB23F67315E048B28DBDBEB547F6AFC77681192B209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972798, "uuid": "17b219b0-404e-41d9-907f-f3becd1924cb", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972798, "uuid": "ae060bb0-8b1c-4147-8015-748a54c79157", "value": "49152:v7WEacZOhdrWEV+yPCPzek8TWACNlly7KnJ6CASN8MqRa+N7LpdXHZ50Fj0unVbJ:j5ac0hz+vaTlcWddXstsya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784972798, "uuid": "1cd54554-7e6d-4222-9364-ad84978fa2a6", "value": 11661312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784972798, "uuid": "0df22c23-b4da-4da7-b47b-e841720cdc02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784972798, "uuid": "fc45e39b-ca1b-4163-8bdd-5ee48e3e002d", "value": "005fa4606e1c5f4e382a302d5da1a00a8204316848a2fa7e58600b2faa52f12a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d05b75a-884e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785000637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000637, "uuid": "2f9708f3-6e4e-4dac-80e9-e3a4f5e5a953", "comment": "Malware payload (Mirai)", "value": "ae3af8af72c62c6283431c05b181fcb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000637, "uuid": "56e416e4-4421-41e5-8202-296d22838918", "comment": "Malware payload (Mirai)", "value": "535b129126e50497bc83afe22e97dbcec6236b0836a15b41f3af89dd9c6a4f1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000637, "uuid": "fe31a72a-df50-4291-b465-f6c8710697d2", "comment": "Malware payload (Mirai)", "value": "ef4555dc63fe79aa360b23bab3711c88b609fd1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000637, "uuid": "5c916ce3-63f8-4973-a9a5-9791f87aeea0", "comment": "Malware payload (Mirai)", "value": "e5cbeca8ab7f8f35e7d111642368b9dbf00232f9e0254ed9cdefa5510247f9438b96014306a181b51e44ccea59d8e790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000637, "uuid": "dfb9c68e-6a3b-4846-b5a1-a26f65ed2b4c", "value": "T1AFB30946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9205F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000637, "uuid": "7c78f664-7646-4e75-b599-fd9262b8e5f4", "value": "3072:pqiy9qVvpOFnQfG/7/0NZYjYhOn1NaVF7h1ubWczgflZI04MbHPsf:pqiJKdQe/7/0NZYjWK1NaVF7h1Hczgkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000637, "uuid": "be9b5a6f-126a-4df0-830e-4547d15643fe", "value": 112656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000637, "uuid": "adb61086-a475-41fc-b687-2d9310b02d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000637, "uuid": "47c32c36-21f9-45e4-b324-8381711322ed", "value": "libkys.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e65bf5-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975740, "uuid": "955b3823-a487-4f07-8a79-2d465f60957e", "comment": "Malware payload", "value": "b578c78fb9cb2b94c7ff31cb8ca9bacb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975740, "uuid": "4ecaaed1-da41-4985-b84c-a76c7039208e", "comment": "Malware payload", "value": "53623e0711a41f08b777a50d46a79dc390b64ce7a080a9dd02417beeb0a3d06e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975740, "uuid": "0431e9a4-1ec1-4217-8bb3-00e1fe7c152e", "comment": "Malware payload", "value": "5aa607d2fac92643a234417a223b8fe671d4f806", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975740, "uuid": "f5aa36e4-b117-4fc2-9a70-045247d2dac4", "comment": "Malware payload", "value": "36aa745724437f0391eee69cc9f8f4153e47f15fdb27ff7e9387ac70daa8ab051a53e01724b848e47c7298da2635e644", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975740, "uuid": "2b700f57-039e-42d4-8062-baf22cafb037", "value": "T18002C0262F44AD31E036B64CAB78A27A53FB64742BDC224369AE277A3753700D3DD518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975740, "uuid": "658af786-4a45-48e3-8b45-e10460c696a2", "value": "192:Z6wug3ZZKAj6XbLUoxvMJRsFSLn0IthnSGcwqJQhj3Y:F85ZMJGFSLn1hHUJYTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975740, "uuid": "402f32ff-7683-4851-a7d3-36f6b016047d", "value": 8840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975740, "uuid": "232ff202-bde7-480d-b5b3-bda13b6b3b4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975740, "uuid": "b6d9d9ff-06a2-42e8-b4d8-33f1644be1aa", "value": "images_20260724_103416.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c998ef-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975634, "uuid": "014e883d-430c-4586-b540-4f88aa353479", "comment": "Malware payload", "value": "275bc1f48dbbb6d140972a08d4fe61f4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975634, "uuid": "24078e22-c82d-46aa-ae7a-5c3a2da2454b", "comment": "Malware payload", "value": "53c5022aa1f6ce11f9bdc74231ea47ecbc6c91c54a3ca4a25ba730107bad556f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975634, "uuid": "0a32fc2c-0840-4799-8bdb-76e213b66442", "comment": "Malware payload", "value": "e052256ce1e56c5641c52b68954215ddc1071f6a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975634, "uuid": "606b6d7a-16b5-4d76-a016-fea33e0264fa", "comment": "Malware payload", "value": "c5e0b8af60686e8b5e13a7607d0fe85ab2408ff9dd16e23d7939a2fa504e35c7ad12eae512e89e343147ec6b3067a584", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975634, "uuid": "ce32cbb8-d7ac-402e-84d5-3cadc4c0f7cb", "value": "T134718DCE12216917C0C9BC3E49A8B8754717C0E0E3C98E7EC42C63091BC2A336D5E5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975634, "uuid": "7793c011-d156-46a8-96a0-53d1a4730a59", "value": "96:UtBXnVYp6rUyxlyJOC7nZGS9hw8X1cFjnGo:UtBXnVxrUyQOC7nUSjJKdnGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975634, "uuid": "92e00d04-4c4d-4a25-863f-ac19906c7d87", "value": 3727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975634, "uuid": "111ee13f-ba73-4b68-8c5b-420777bd418f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975634, "uuid": "0046c0cf-9ac4-4f29-87e2-871747aeffc7", "value": "images_20260725_044509.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c54dd4-886c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785013562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013562, "uuid": "cc946acb-1423-4406-af85-cadb5a8640a3", "comment": "Malware payload", "value": "700a8b7e8ddbaf6e41ca3f2fd40f6289", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013562, "uuid": "23df726d-8617-4d71-b3b6-dd14c9364604", "comment": "Malware payload", "value": "5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013562, "uuid": "0705ae70-dc63-416d-b18a-120d3d671b2f", "comment": "Malware payload", "value": "22e8d4f1c8139d93c94fc266ee4ce71f37ef272a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013562, "uuid": "632906a2-b351-48bc-baba-b9b604c3ae6b", "comment": "Malware payload", "value": "a7f1bb02a6f8927d8737669076a2e7b46db059f51e0c222d757015d4c9abbbb1a49c9e10d0e2cdaac2c1113b4b4dd606", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013562, "uuid": "770de9dc-8b58-4889-948a-c2c82c8f0252", "value": "T17E410FE0F479CC38B688E039A48F11683C96546F58997E18BDDEB83C5B5C50C20BE3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013562, "uuid": "3d76e694-8d54-4103-a65a-1eca035bf79e", "value": "48:nN4YAKdjO5f8XVyOWyBZu6Y5oAl4KxY5oAlXKG:nqYACO8XVyOjBZu6z9KxzdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785013562, "uuid": "34485511-a189-476f-a981-fd764cdd2cde", "value": 1973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785013562, "uuid": "77094a8f-4a3b-4d85-b41a-e82b0e456729", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013562, "uuid": "e47cc473-1193-46fd-aa3c-612a1e0b0742", "value": "5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bad659-8859-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785005273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005273, "uuid": "4029c52e-6785-4c4e-8ed0-67477e923be2", "comment": "Malware payload", "value": "797b6854e9063df0803ed118373965a9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005273, "uuid": "8109baac-f8bd-4bb9-b4ba-8d2a3144f164", "comment": "Malware payload", "value": "54f3f2e7df81774a39f1495389d76826758c76f2a86536b4e67b17c0f624076d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005273, "uuid": "c99959b9-14a0-44f4-b06c-404c86c662b5", "comment": "Malware payload", "value": "d3425e001a6e58653b90b92ff29a851453453a7b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005273, "uuid": "542c9cdc-af34-476c-8534-b555735a5e51", "comment": "Malware payload", "value": "58afa7672f8f35b76c03fa03ae1afd5fa7562c7e5b277677502f080cf268d6b5290a5e3019ae5be8217c505080ed571c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005273, "uuid": "b2f0b49b-d9ff-4875-8271-7d66308b38a4", "value": "T1A8623B0BB8814036EAE14079477F4226447A6CB623C0F9DBF7F0A98A59B46E1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005273, "uuid": "8389e370-9ffe-42bd-b2bc-c3fbf70e3919", "value": "08e71dc3a4ed4919ed4f88f99fab3457", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005273, "uuid": "ab5e70ef-55ea-4b3e-8a87-a4a3a51b7d8f", "value": "192:r9BErjXgjo8P0UI+TemM2l1WFeI82IKUSfEzQyFJxTmv8U9cthI9c+F:wu0IzWUoERav8U9c+zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785005273, "uuid": "f3336238-9a52-443a-94e0-fc877eb6bc2e", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785005273, "uuid": "039a30c8-e89c-49f9-bf28-b9ca3abf5e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005273, "uuid": "2c49babb-5bd9-49aa-bdf1-191e2cc21080", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e933c-8876-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785017816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017816, "uuid": "cc7174c1-f4a1-4215-b0bf-0a7ed3bfe615", "comment": "Malware payload", "value": "90262af511f7d47e973977cc3997f46b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017816, "uuid": "f587f435-7672-4820-96ba-fa148796dafd", "comment": "Malware payload", "value": "55035e8193aa4548ea63d72c51744739cb51b1fb3e19a40907233608c62473c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017816, "uuid": "d4eb0d43-a952-4934-9930-b1485bf338b0", "comment": "Malware payload", "value": "4d5b5e6514031b70af9f43fe77bf5352df47f0dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017816, "uuid": "96c1e223-9037-4442-81b0-c9b91c4bb80a", "comment": "Malware payload", "value": "c5407afd6e17f819bf3076b9213bf2cc8b16ab92480b16c2a25b9b4c38303a6ac6d4d6564036652ba27f5cf7476c18c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017816, "uuid": "808e5703-fc84-4653-a31d-66732e6cf0ed", "value": "T1DC1253E1FCB0ED38378EC03D655E9596384B142F08593D14B58FE4196F6C228A3B97BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017816, "uuid": "c9bfff2f-46ad-4003-8f27-b15fbbfc6a13", "value": "192:Q5HBE7lI7lR9vvPboG5LTGh+oKq801l0z46UOaWF+HKm7X+tBTLG/znZiQ:Q157RPR5LK01a0MHUF+F7OtVLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785017816, "uuid": "d5c4cca1-6b5b-46aa-a66f-0c579cfd6106", "value": 9026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785017816, "uuid": "00b441c3-9b38-4d99-990b-37d3390f58d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017816, "uuid": "6f940c7a-5ff9-4809-be9e-c88cd3fcecae", "value": "55035e8193aa4548ea63d72c51744739cb51b1fb3e19a40907233608c62473c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6897ee-883d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784993174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993174, "uuid": "0aa830c0-f8b6-4d3b-b082-252dc8c0c993", "comment": "Malware payload (Mirai)", "value": "3258984d06d9fe56365a0571f1606976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993174, "uuid": "d655f7c9-a5db-4b18-abfc-bb9db54d36e7", "comment": "Malware payload (Mirai)", "value": "560f4a3c055e94e41d361e263d432e5cd5a55d08a13dc6528f9e3723057a305b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993174, "uuid": "c4dd27f5-4fbd-4832-9cc1-6d89601a9f4e", "comment": "Malware payload (Mirai)", "value": "3c8b41f70d58bb0199ce65a7e508c03bfa304965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993174, "uuid": "80d034bf-4e59-4127-a68b-3b8a0980c8e6", "comment": "Malware payload (Mirai)", "value": "068660d2be78547baf622bd3749e06f0517373d17cdf6bf83e09443c11d61f80b38e055cdced5e5e88280c58a0c1f1cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993174, "uuid": "e7a7ed80-3a79-411a-92d0-ab20346fc797", "value": "T13EF3F719BB610FFBE89BCC3705E92B0518CD565732B87F36B530D918B64B28B25E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993174, "uuid": "9e64e368-3500-414b-a5f8-220fbefc1179", "value": "3072:35MQ/jMdZtaieD+fK+QKWGNOKQolzt9sDUzZKH6:35MWMdZsjD+fK+QKWGNOKQ69sDfH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784993174, "uuid": "0fd70605-4d60-464f-a299-ea66fa21c506", "value": 161088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784993174, "uuid": "14dc638a-49f3-4814-a15e-f015f425c418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993174, "uuid": "669850ef-c21a-4846-b8f0-c1613bdc37a7", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5f0bf6-8877-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785018304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018304, "uuid": "995e6d24-e57b-4424-a521-28c05e645ead", "comment": "Malware payload (NanoCore)", "value": "e31ab3eca717e815f942f242e1cccc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018304, "uuid": "1b122865-9ce8-40e9-b039-1e129f3f45e8", "comment": "Malware payload (NanoCore)", "value": "56c44ee6a052c9679d8dd05d2338bf2c2a0a2e0ce0242bf5472e870768ab7466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018304, "uuid": "af730eb6-0b3b-4686-bc21-c0f8743a7f2a", "comment": "Malware payload (NanoCore)", "value": "0c13d9cb3704eb6820a3043f5931b39853347824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018304, "uuid": "31d6052c-1445-44ff-b1a2-544b3dd30257", "comment": "Malware payload (NanoCore)", "value": "cd152d35f0115f4dfe7adc1450864797e061171f26c98ca9fa13987e0323d346385db895765efcbbad293be751f63d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018304, "uuid": "5e7d15db-ec09-47cc-86ca-793d4e0e00f4", "value": "T1FC14CF1677A84A2FE2DE85B9611212129379C2E3A8D3F3DF2CD451B75F267E14A0B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018304, "uuid": "80abc16f-d006-4d87-a27b-d3559b10b486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018304, "uuid": "6cfa778e-99dc-4138-83a2-16c8dd7e4456", "value": "6144:MLV6Bta6dtJmakIM5VRytPfyPxvc3sNr6:MLV6BtpmkOAPKLNr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785018304, "uuid": "0ca94eef-9453-4a8c-9ab8-006924f93bc8", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785018304, "uuid": "21bb4cb6-150f-4a06-bd15-e9566528b075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018304, "uuid": "5b956598-eb4e-460b-b07d-21ea06207294", "value": "E31AB3ECA717E815F942F242E1CCCC09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee86982d-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991352, "uuid": "7a836f12-f050-44d6-96f4-1a8d5f9b462a", "comment": "Malware payload (Mirai)", "value": "fc7986d1b3396fe51d711a845d5b9e11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991352, "uuid": "14c0d352-a6ae-4e35-a1c9-46dff12ca747", "comment": "Malware payload (Mirai)", "value": "56c9dc30d712995cd070d14ee4204081a07a04779455fcb4e2d9c7dbaa44b258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991352, "uuid": "dbf74b28-6c8c-4eb7-91c6-6969c979c7f5", "comment": "Malware payload (Mirai)", "value": "b35ef3c6c61c64181379e69e5002efd2f13d2d97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991352, "uuid": "0bd16a69-fae4-4fae-9c32-adca968ecd56", "comment": "Malware payload (Mirai)", "value": "2518a9b41f4c403532b9f27d274de5236a2c10e97aa440c452ca2f303598d267ad3d2874ac7ee54468a7a7a5c6585c79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991352, "uuid": "6303f590-04a2-47c0-bb0e-e38eb73f4cd1", "value": "T17243F2499386343BED97C4705F980E223D6162BB1413FD42BAB869E2B4BF5DC054AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991352, "uuid": "c33a724a-0e8e-4847-982b-5415f3e57398", "value": "1536:C8TzM4m51WTQ/YuvX5RCSdRKQEu/EDGvE0/fVJun:j+51W8g4fCOJEwWGvEmfVQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991352, "uuid": "c4070b13-acae-4c3b-bb91-eb45f6052918", "value": 59784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991352, "uuid": "7bcecee0-e08f-4515-8dbe-83cf87c78006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991352, "uuid": "331b0a47-512b-48c0-9550-882986b945cf", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8042b4c8-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975705, "uuid": "55d0d7f0-c337-4b0c-8094-10f017ca5b43", "comment": "Malware payload", "value": "7a346e25a06f319ce45a5955fcd99df9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975705, "uuid": "ceeb7e4a-e6be-41ac-84a0-619c57203de1", "comment": "Malware payload", "value": "572ad9e7066ee139edd47e42d6dc9aeb0da0f01304a58ccf9b3fc1c9d454e1e6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975705, "uuid": "f4fcba47-5790-44c4-b015-1a3cb0a50ce4", "comment": "Malware payload", "value": "4077943558d62634ca78da5a3f344e6d84631dd6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975705, "uuid": "4cb9fed1-a64e-4699-a3e2-517dae2592b5", "comment": "Malware payload", "value": "e9279c80aa2ddb257888152028f513e072916920bb81da94496fa6595d966ee94a759b59a3a34daa9587085ef308dc63", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975705, "uuid": "65839ccd-9dff-4a13-a9b9-f48f05cd4cdc", "value": "T179513B384F675635EB55E3751CD75EB90B0E29A60C93D76B74C4A079A58C53D10120EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975705, "uuid": "decf42fb-706b-4778-a329-b15c8e167a0b", "value": "48:9XvV6TOxbKmeICpjBxqGL3lWwg8vNst+GnNvrgVtytEnj3iGozN3z:JtGOxbXWCWa9nNvsVt8EnjSGaVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975705, "uuid": "e4d6170c-6711-4494-8b8c-868fd4b6f0c1", "value": 2913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975705, "uuid": "2f3ff9cf-601d-4fce-865e-5c3abad178d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975705, "uuid": "b52e1c10-703c-411d-8449-cff8ae8bcbfe", "value": "images_20260725_094357.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420bd368-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939094, "uuid": "8bb0235d-d195-4ec5-96b5-791a33b459db", "comment": "Malware payload (Mirai)", "value": "edc5ee1ad19d1b70b009e363b0cfd2ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939094, "uuid": "5769c3b9-ebbb-4a49-951a-63a5ce842f4b", "comment": "Malware payload (Mirai)", "value": "57d723677f70dedbec3a5917b9f361dc634fefe38d13b2bd3ce73da519ce01c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939094, "uuid": "18a757c8-296b-49ea-a526-ac1602ffa475", "comment": "Malware payload (Mirai)", "value": "f45838cae0ec65fb348372a08550ed4a7fbaf3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939094, "uuid": "838dd196-0fbc-4f1e-8484-45a572992850", "comment": "Malware payload (Mirai)", "value": "67bdd3acc68504def4933046f52169e7d853965c8433eeabbf065355b0e684ce3a85f20768a3819c1002e1bfcfa56f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939094, "uuid": "306c98c4-8fb7-47a6-b39d-3816f3aeecfb", "value": "T13F23F166A22B2430D7604DB19374C7D5833A87BFF2F5255932090FA850B647A74BBACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939094, "uuid": "217db04c-f4d3-4781-9755-a1753743db1f", "value": "1536:DGnf/JuqrRh67F6eSfvmx+zNSMwMFIPzL:DG/MqS7F6lvmxwNQtPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939094, "uuid": "e1ee3da3-c786-46c5-8e24-24ce66d91bd6", "value": 49984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939094, "uuid": "dc0a3326-da9e-4959-9a43-4969f6f6e8fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939094, "uuid": "474d4893-d8bb-45aa-a611-7249f519b6af", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d6b2a7-8861-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785008600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008600, "uuid": "8795bfbf-c439-46b9-ab6c-1778243fbbdb", "comment": "Malware payload", "value": "7ef5af0e6e1118cac43b9228b03f0f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008600, "uuid": "d4f1e510-fe77-40e3-a084-50ac77ec738f", "comment": "Malware payload", "value": "57de376767a78229701434a2efe5d6410132b208417e8d9fc0891405dfc7be09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008600, "uuid": "854cc33c-56a9-446e-ab63-df4588a24768", "comment": "Malware payload", "value": "6ef59381a18edcbb4f6a3214ce8c889cf0429486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008600, "uuid": "a6e5d482-c380-4d4f-a5c2-f3bf50469a6a", "comment": "Malware payload", "value": "779733410a11314afc6bf6a497ce1220d37c10090890563c6284a41f5c977e1f58dcd94e02573ef60d14fd5aec840fce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008600, "uuid": "408260d0-9d41-4961-ae08-52c804da3315", "value": "T14B85337BF919F930EC00066F7F7DE510AA3872FD8F4909F86B6C16E8AD1A641466ED40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008600, "uuid": "564a1f36-0814-4555-bc4a-66ee73a01a95", "value": "49152:gX5cEmPm23feVa0JN/IsAZ7+FnPwM9MUwVM1B7VFg:gX54O8feVBUsEYPwKNBB7VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785008600, "uuid": "9e9a2146-c135-4c2c-af2e-a6450ae45b7b", "value": 1759980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785008600, "uuid": "fe32fbe5-2dcc-4e34-88b5-8974fdda2745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008600, "uuid": "89530ae3-564a-48ba-8759-bd6d8e33340b", "value": "riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc7aa60-884e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785000830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000830, "uuid": "ce17b2af-dce2-4f6c-9860-2272daef307d", "comment": "Malware payload", "value": "dca0c8f9acd74a49eb22b849943c3e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000830, "uuid": "e6fbb3fb-8997-4e1d-a2c5-06a1e5138d37", "comment": "Malware payload", "value": "58285829ced385a7d48785af5efa36f3f99150af8c1d73514653c2b62b9abb04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000830, "uuid": "bed31e10-465b-4857-b395-e937cea51ea6", "comment": "Malware payload", "value": "264ec9388b930c2e6e9a3dfbfcfbae465745f88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000830, "uuid": "dbead55e-7fd9-437d-b868-3f725dd4e65c", "comment": "Malware payload", "value": "754a2dd924ff9460895e79de0de4f3c025eff10615ee23007435ed5a3354b72ab8f536932af3c72fcaec35c9da854b7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000830, "uuid": "b294dbbe-1d9e-408c-8899-abbf838a7f66", "value": "T1ACC52907BD9148E6C0AA92318972D7A97B21FC442F2123D73EA0BB793EB67D09D35354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000830, "uuid": "ebc294ec-5068-4b00-b5f7-8607932c72ae", "value": "f23ee6cae9102afbfd90f52d60f792d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000830, "uuid": "26c3ab3a-2e28-4d5e-8ab9-1f0432bdc2f4", "value": "24576:j3sq0P+RXi9XkdvsgTMiUMCuiF8XLPMrIJjcT8fEXBelesaKD0kov4sS8cXL:j3sbPiXiSdkgTjrnbPR6fc8cXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000830, "uuid": "3cd882a3-1c97-4e80-9fcb-e23901c833b1", "value": 2524136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000830, "uuid": "9e527423-f5c1-4ef9-ae9f-2a38b9aec65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000830, "uuid": "02b45845-43a6-4134-b7eb-87d60f8f4747", "value": "HitWave.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4354ad31-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939096, "uuid": "71386576-dd36-425c-b31d-490ce9dcbfbf", "comment": "Malware payload (Mirai)", "value": "5e35a3d429a3ddcbbf76c0722bc58a4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939096, "uuid": "5c9031ea-7fb9-494f-b967-7594693990c6", "comment": "Malware payload (Mirai)", "value": "58df44ab6dbfb246d0b3df1beb23563c1fe4eb3c32a0b3a2a09feeed8868ca36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939096, "uuid": "570fd3ca-5938-43f9-a966-96843b53d85b", "comment": "Malware payload (Mirai)", "value": "c401a1f039858cee4fcf346c6a51b30f9bd1ed72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939096, "uuid": "629c29fd-a275-4991-acdf-d2a44814e68b", "comment": "Malware payload (Mirai)", "value": "14de510c3878ec74be906f365a6b696c01c618990f732b2542bfd9b5de0dba922c70603b775ff525fe4815e4aa0ee2e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939096, "uuid": "445c0d73-d953-4e2e-be5d-b6bc9b58092c", "value": "T1D3C36D22B5391E27C4E0A47A12F75766F2F257CD14A8CA0E7E720E5EFF151902907BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939096, "uuid": "6b377a5f-e35a-47f0-9acd-4cb85d67ee4b", "value": "1536:8lITTILIMV1nW/cQM3PK8A6kT6ciM8GvTyEeodvcHyHq4gsSwJ1AeJ1StGrPYm5C:rmXH3SeoZHr1NsEDYOQ+4Xiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939096, "uuid": "235df058-6da6-4717-be6c-84400cc1c6cb", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939096, "uuid": "01480439-c1fd-423d-bb34-f3306d4dde22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939096, "uuid": "0e42d002-a210-4c7a-ad0c-c74e2ef2aad6", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d250ee16-8877-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785018363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018363, "uuid": "c8ddacd0-81cc-4003-b3f8-a05055b0badd", "comment": "Malware payload (Phorpiex)", "value": "ac6e007de84a362b97f5614d4725d534", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018363, "uuid": "56e2e80e-1d4e-42af-914b-cb5a52e517f6", "comment": "Malware payload (Phorpiex)", "value": "58e1678501dae58d824c8e305be61ee55f642af2e0c36259cf14501cf58c9687", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018363, "uuid": "5aa5dba5-5844-4f8b-a983-d2265c7b1447", "comment": "Malware payload (Phorpiex)", "value": "ca3414eddd6c823a58bb6c315009a61eca0c23d3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785018363, "uuid": "f55ad8df-367b-40e8-8eae-1c9a182f3da6", "comment": "Malware payload (Phorpiex)", "value": "5d494445479c2373308fd431945a5d25d3db7abf49b7d6089df68d91ec45b0cd5b09b0a51bcc0717dceb711da3a04d48", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018363, "uuid": "79ce5079-35da-4585-9a54-8572f49b4860", "value": "T10A624C0BB4808035EBE144B4827F526645BDADB623C4F9CBF7E0648A5AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018363, "uuid": "9a351348-c7be-41cc-99bc-22b1b1bd07b1", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018363, "uuid": "94dca73d-beb6-4497-8925-61a95dc00d23", "value": "192:AWpsGnjXgjk8LMRI+wBdzMRJFeIFFBKUSfEzQbd1gJxTmv8U9cthW39ik:AoSMygUlEOyav8U9cWNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785018363, "uuid": "01437d3b-3b19-4d0b-b504-3b71f360e1d7", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785018363, "uuid": "4aedd31f-da1b-4db1-9f1d-d522d76290f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785018363, "uuid": "21b66c0d-0a3c-41e4-9450-3e6ce984d600", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acb484c-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984689, "uuid": "59a19d2d-971a-438a-b6c7-71c6b66fc4de", "comment": "Malware payload (Mirai)", "value": "b007c730c95f3d12eb054f3cad1551bc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984689, "uuid": "c84196f5-318d-4fd2-9a26-6501d8c2c566", "comment": "Malware payload (Mirai)", "value": "59ed3a97657e04ac5a0e53e3902da424f9448bb1b44b0181a117eb7cc7e54a7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984689, "uuid": "21f991df-66f3-439a-8284-34d1fb7b6ae7", "comment": "Malware payload (Mirai)", "value": "103eeeaf589052cbbeecf662faf957e2da94504c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984689, "uuid": "4d622d86-d943-4fec-a99b-8cb7cb16c71b", "comment": "Malware payload (Mirai)", "value": "5a20a022b7baeb391334bca63a2027563eade3ef74f0d966b852844de32eacba9434a6d79059f61bbe1187344da3d8e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984689, "uuid": "5adf8a8b-8cb1-41ba-89a3-a68391b2abf1", "value": "T16701CEC6D120480050AAC96C32E75064F871C3C7158B4F78FF6CB839AB88D18B076F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984689, "uuid": "68090f94-5e75-4e20-b596-0241716d81ef", "value": "24:kXCKysE2hi0ziQvZohaTkwYFO1LVG9nIwX:e9Qp+MsTGFO1LVG9nIwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984689, "uuid": "8c7c187f-1ce1-44db-9148-8dec315f5004", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984689, "uuid": "eaa7e26a-6c2f-4a20-b1cc-93ee645b8e9b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984689, "uuid": "0db47212-24ec-4e43-bd12-0bb67ddaaa18", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1357b585-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "9020c9a0-e611-4e96-a587-7aab9e9e8fee", "comment": "Malware payload (Mirai)", "value": "9f09686f346f5a893d8d8851019f9f5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "f4a4e3b1-be11-4879-b691-e740ba1ee1d3", "comment": "Malware payload (Mirai)", "value": "5a69f79a35ba2ef2714c2e0babded61cd52f4bac1b67a53fdcf7361ca261670a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "563ec289-08c6-4b46-8f99-d310c52e785a", "comment": "Malware payload (Mirai)", "value": "1f6674c0fcf51a58361cbb0ac58f09548a5b2da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998715, "uuid": "dd97fb52-33c9-43b4-9431-5d6be1fc681a", "comment": "Malware payload (Mirai)", "value": "204b785bedb708b65caaae17566ccb89cd2fce7dc4f11cb4a384c2883a02f6fdbbdb7201c88c28778d319c00e6d498e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998715, "uuid": "cb5cdff6-b141-48c0-a1ec-51d7c588a0fa", "value": "T11BF30715BB610FFBE89BCC3705E92B0618CD565732B87F36B530D918B64B28B25E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998715, "uuid": "85c9d00c-b8f1-4f82-ab15-41704c193b6b", "value": "3072:RSMQ/jMdZtaieD+fK+QKWGNOfpolzt9sDUzZTHU:RSMWMdZsjD+fK+QKWGNOfp69sD+HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998715, "uuid": "bcc2824d-27e5-49c5-a5e4-215ad91236e3", "value": 161088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998715, "uuid": "1c59a317-1caa-41a3-86d9-15e2b1ffa7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998715, "uuid": "ce78a805-e5af-4624-980b-ed48258873b8", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720a8b78-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975252, "uuid": "0ff5066b-a1e9-47be-9dfa-c30666bb9e30", "comment": "Malware payload", "value": "c5ed8a71ba249064a7382add723520d1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975252, "uuid": "355a911e-43db-4331-9058-ecf897709a42", "comment": "Malware payload", "value": "5aeb25b9d4a7f6ae82423d6cf017981e77e8aeeb8f90d1080fe218ebfeed5505", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975252, "uuid": "e5be209e-970b-401d-ad24-0b7c423476c0", "comment": "Malware payload", "value": "d4656af4d1b081baab8ac4ae3fe6b290df32cc25", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975252, "uuid": "3777ac25-420d-4ff5-8eac-6bad108fc45f", "comment": "Malware payload", "value": "17ec569e9913b3380f9f26c7eeb087ae3e032f5afd615c4b7b75125506b4d1d17fec12e66cf5a7de307ae62e541d2e69", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975252, "uuid": "b06cb727-5af5-4aad-847a-37359c2631d9", "value": "T172515ACCDFB884A2CD7FEE3DF0D40E3E164B8B5328460A2B209D8C206203421C9DB794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975252, "uuid": "027f3d42-a585-4e77-a0db-ecd27c9cb1e5", "value": "48:9qyVtxuEpYfMIFBe2XzvsWq0PSri6lYC3L6iKaJS2pgs4aRNfsjyA31:3VTq3Bv4YapKWVpt7s++1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975252, "uuid": "397c8adc-43e8-4fc3-b690-cc99cd38f64d", "value": 2552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975252, "uuid": "2c500b9c-4708-41e9-a6f4-6a276dfe4bf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975252, "uuid": "66d08c4f-ac99-4b40-86c7-a5d8046e82ac", "value": "images_20260725_005953.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f107441-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991460, "uuid": "382ce0cd-c151-4ed2-8f0a-7b7c4586f822", "comment": "Malware payload (Mirai)", "value": "a96a031bef8dbca23453e484bcb234e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991460, "uuid": "296c93a0-ce1d-4196-ad76-96813f2a5977", "comment": "Malware payload (Mirai)", "value": "5b8b8cc13a32bae6df9477d430ad7f4cd416d50b291abfeeb88902e9859214c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991460, "uuid": "cc8056b5-c72b-4707-b14c-0234dc33f2e2", "comment": "Malware payload (Mirai)", "value": "869a22f45899d9985fc93f555f64713e060d0eeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991460, "uuid": "20a55504-4de9-4a1c-93da-69958dccff4e", "comment": "Malware payload (Mirai)", "value": "0cd1ffecc5acb13c74e04928f3790686bdee7a9c23c2fff1e23dde6e7ee14f72ae7d18ae9aaf59107199d8c82f6a9b4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991460, "uuid": "e31ffc9e-4d3a-43fa-81e9-655ead534695", "value": "T1FAC31902B9C18DFDC085C134477FB93AD925F0AE0238B2AB6BD4AF27694DED11A1DE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991460, "uuid": "7f69aa39-e802-4527-8128-83ed00c052bb", "value": "3072:PHPA2sqGzlNlHN4SsvHICh4mymGJCURIFfrTl0ihX1Wr:PvA2sqGzlNlt4SyHICmm1tThX1Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991460, "uuid": "36fd2437-14b2-4724-bc8d-e4fee7fe310b", "value": 119280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991460, "uuid": "0c8a4e8f-8b22-4d11-90e5-5ebc2b675da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991460, "uuid": "650b8f23-6c49-431f-9dd1-d7e5f2b06e3d", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353de975-87ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784958829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958829, "uuid": "15c91f7c-93c8-4603-89fe-963301f225ab", "comment": "Malware payload (Prometei)", "value": "735821c4ebda85a960d7e5283b43f78e", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958829, "uuid": "cfe74846-7a30-4aef-ab01-c6893353dbeb", "comment": "Malware payload (Prometei)", "value": "5c007abb9c02b3304f96955ef085be0b8e80def28498813c9a5770bbfa7fc5d9", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958829, "uuid": "0171def7-f837-4d95-8cbc-764a74dc44fe", "comment": "Malware payload (Prometei)", "value": "6b2bcdd6136f1d943c57ba68d037e198c14b383b", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784958829, "uuid": "1c8424ea-68f3-4b2c-9e5a-ef51d93dde71", "comment": "Malware payload (Prometei)", "value": "e3d913af57431e9cbd054ae97a87d3f61f8cd40dce3637aadcbe7f1cc0955569ee8ff4d1f47813a7f9008a325aa6ea2f", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958829, "uuid": "7ab30f43-a3de-428a-b2c0-7a73ae02e810", "value": "T196B14354BDA1A970670EC43EA99F4902318B531F051C2C25B5AEF6603F3D576A2F83B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958829, "uuid": "f5d70e2c-2328-455b-aece-db671f65c0cb", "value": "96:zuq17ooDszVLJog64IUwtNlG0x+Fg7PHFdqP3xmkMhblD/NPB:zuq9TQzVLJog64IUwtNc0x+Fg7PHFd+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784958829, "uuid": "48667e40-bca2-425e-8c6a-e0dde3bef7f6", "value": 5422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784958829, "uuid": "7b4dc7c9-802a-4920-b067-68e48dad62f7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784958829, "uuid": "a329cdfa-6ff8-463b-b368-8dc6cc08fc39", "value": "5c007abb9c02b3304f96955ef085be0b8e80def28498813c9a5770bbfa7fc5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95850bf-883f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784994296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994296, "uuid": "9a87ceaf-188f-456e-9656-d85335d0db04", "comment": "Malware payload", "value": "4ec4720c798a642c73f00531663d489b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994296, "uuid": "acb3b02d-05d7-40eb-a884-74f9b7872d1f", "comment": "Malware payload", "value": "5c5260c9b9b788d4a94e62c4bc92c0eb4eebb97980fb31091333892629c6ffab", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994296, "uuid": "5a00528a-a564-4683-8914-9b617d5c28bd", "comment": "Malware payload", "value": "ff1b61d8efa3147fa9d49af3fce5abb5640f6664", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994296, "uuid": "e42767e8-f174-4266-843b-9882bea4218a", "comment": "Malware payload", "value": "a25666ac9d08b0c79451b4c44ae423491fa05aedb3375082263ccd4808b55c02cf73525d4656a5e35bc121c8de3b941a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994296, "uuid": "f32d6379-5ef2-416b-baef-e3bd6b5329bb", "value": "T183283331F16768A5E21F637FA068AF8845347DA1B31BD5ABB3787FB1887498250B1C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994296, "uuid": "a5c9f17e-bf70-4cbc-98cd-9a2ed12b8249", "value": "1572864:Pxyzop3xA9HoS9coQcqTv9AIkX9JTB7wScm6S3VTnXM2ZdW8L2j5dANDuuPynlOv:pOoDsx9/hqTv9ARTTyMT82Zdqd2TPynm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994296, "uuid": "5b842de7-4dee-45a0-bdf0-3c68a2ca803d", "value": 95619072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994296, "uuid": "a3974f68-0bde-44a0-9077-588a9875fd2f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994296, "uuid": "fac6fda3-6f58-4806-b20b-fc5131058cbf", "value": "sysdiag-all.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5daf61-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974734, "uuid": "9bd127f9-d56f-4b04-a801-57c76b74384a", "comment": "Malware payload", "value": "e8e7eff5cfde1b3a672df25661a2f7d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974734, "uuid": "80a00e68-ef48-419f-9d9f-f8bf07466444", "comment": "Malware payload", "value": "5cb2aa04596f201daf73456118ea5e22952bd57e09c71d4a136a5cb2cd1b495f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974734, "uuid": "90a9e76c-c573-4c25-872d-31240a68560f", "comment": "Malware payload", "value": "7587b84674a0a97eb3c6c92be8948d9433b33288", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974734, "uuid": "d5a19244-d236-42dd-8f34-d2193ee5782d", "comment": "Malware payload", "value": "40bd24ccac4ce675777b1bbef3839a055ab5246d6743aeb11640004d439c3551dff8178567d6c54e3f56f7606ed4fac6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974734, "uuid": "95d75168-1bc5-428b-bc84-6503c6cb66ee", "value": "T19C916C067F18A14BF77A19F36AC34533466DDE31C4185C8EE7C89163EA1AFA6520E90F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974734, "uuid": "a0652965-5741-4a59-b92d-1df375bf8b4c", "value": "48:9958flFR6dcVLRXuzm+UM0Oq9Q7t/uX2DniTCFRvbX3aVCDC67KGW+fgAKLyttEM:EFRcSLACuqWtGm26tHaYD3uAQy/SIksF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974734, "uuid": "9a798258-a10c-45f1-8ce2-4ceef7ccf5a2", "value": 4402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974734, "uuid": "100bc749-eac8-4de5-b254-b629cd37dc29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974734, "uuid": "a27b37af-d4f1-4898-82f5-51df4ea6d98c", "value": "images_20260724_164933.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64fc830-886e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785014478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014478, "uuid": "33d72347-45a3-47bf-a6ae-65879551c1cf", "comment": "Malware payload", "value": "95e8cdb73cd2ae5ae5cf67c0b1df7705", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014478, "uuid": "911952a9-8551-46f9-b938-d1b5791a69d6", "comment": "Malware payload", "value": "5d6baae899049b430146689556c6b7e9668996b5e64449ef733ac061cf61451b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014478, "uuid": "3efc7538-00ec-4b5c-b0c1-00a6c8fea530", "comment": "Malware payload", "value": "ff43ef2c451a968cd2b9b02fe6abacfc43683a07", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785014478, "uuid": "edea92c4-59c7-4d23-a84e-f99649fe5c83", "comment": "Malware payload", "value": "4ca7e8e2a0e062454d44894764c9e1be73505ffe4b6862ea064d9a1f80cef2957459771605c786f36516274033ab413c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014478, "uuid": "13e50daf-3cc3-4473-a38d-aedbf1839e16", "value": "T19F623C0BA8818036EAE14479537F422645BE7CB623C0F8DBF7F0698A59B46E1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014478, "uuid": "08cc42a9-1343-4fa5-b27c-e30c9c2452d0", "value": "08e71dc3a4ed4919ed4f88f99fab3457", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014478, "uuid": "44f76500-e6ad-4bfb-9975-3ef2f87963e0", "value": "192:J9BErjXgjo8PEUI+jum8mBzfxmF5oIsGIKUSfEzQiFJxTmv8U9cthG9c+F:SuEIxfxmroIEBav8U9c4zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785014478, "uuid": "523ac894-022b-4b77-863e-c96447bd3c03", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785014478, "uuid": "ee16bbb5-8527-4bd9-a4ae-beb2a30cec30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785014478, "uuid": "3b2c883a-0476-4dad-ad4a-31fe5e5c2b5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6923e66a-87de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784952474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952474, "uuid": "d2d41a0c-7f06-438d-bea5-496ab66a3dd5", "comment": "Malware payload", "value": "7127f076a99bcd294d50ac4deb707915", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952474, "uuid": "cf923363-ebf1-460f-bd45-ba6f1382685d", "comment": "Malware payload", "value": "5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952474, "uuid": "ac0eac05-3505-4538-b1d4-e1c6eca6a9a3", "comment": "Malware payload", "value": "17d33eaa2c360c36c5c1bc112add9454af1c77f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952474, "uuid": "60584c18-f66d-452a-8bfd-ee5858c3af60", "comment": "Malware payload", "value": "e3a5b83e76613348e443bf3e6b825da052a8bec53a095d41829347fe7840977cd091ca24466336298bff4c84313d118b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952474, "uuid": "8020ac4a-735b-4fbe-b8a5-59e1a33de497", "value": "T1C901AFCE8500A91080D9D92C25D76159F410C3CE158A4F69BF6C6E3EEB49D14F076FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952474, "uuid": "74b5f52f-4030-496d-b1a1-915059ecaa54", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka7CT1C7JfCxWivC31qFC1HX:kXCKysE2hi0ziQvZoha72MALreHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784952474, "uuid": "c0c8e5b5-02bf-4aba-bd12-26d0c2627571", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784952474, "uuid": "5766853f-a707-448e-b49e-df87d93543ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952474, "uuid": "a28efcea-fe2b-4bd9-8cbb-6bdbc6cc7beb", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b521be-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784984630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984630, "uuid": "04bf26ec-b885-45f4-9771-3ef21401668e", "comment": "Malware payload (Gafgyt)", "value": "c51d19b0e446f72302982845289cec80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984630, "uuid": "7dead9cd-12fe-47cc-859d-2c68a2a9cc8b", "comment": "Malware payload (Gafgyt)", "value": "5f6bcd6d4a67cfe9a5340390f087138d443ebd17415ca3ee2f8c47aa833e024e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984630, "uuid": "a1ec914b-e7aa-4bb2-8e40-68fd80955f96", "comment": "Malware payload (Gafgyt)", "value": "2df67b7d63517ed8d877de651ccc6a36ca265d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984630, "uuid": "15369d33-7ff8-4869-b218-b5ca9d32fb16", "comment": "Malware payload (Gafgyt)", "value": "752af25a5836f88a5d6d7e5ee5ca8104313b2a99af95d58216feec30cf30d90148b3fe3c3c977252d90338bfd11b9027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984630, "uuid": "89279a07-cf7a-4b85-89cf-e06b1790e1a7", "value": "T1E5F30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984630, "uuid": "01382667-3492-4bd4-914e-6400789266c7", "value": "3072:smpaNJnxpej0LmzYqNyB6wvk4JX1DRextqziQkp:smpaNJnxpejlVwB6wvxJX1teH+iQkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984630, "uuid": "db25a5a6-dcda-4273-b500-6b243cce8c47", "value": 157400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984630, "uuid": "64429c7b-8a82-4b38-9fef-7232fd752459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984630, "uuid": "728f8716-64de-46b5-afea-a476229b2824", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105c8f1c-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784988832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988832, "uuid": "33ce3e80-c0c2-404c-9877-8d670bc54f4f", "comment": "Malware payload (Mirai)", "value": "18d928e138d41cd6a6adfcb54e63baa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988832, "uuid": "d6521896-da20-4609-9b84-5085c2e109c5", "comment": "Malware payload (Mirai)", "value": "5f707042b39dc8e1ab3e536d349923d86cc64bc29c92a0f6349a383a49dac801", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988832, "uuid": "13e8ddbc-420c-4397-9ebb-e6f0b0f13a2f", "comment": "Malware payload (Mirai)", "value": "e71978f09ee33d8c6767335a43166a9b3e1d148f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988832, "uuid": "271d117e-45d4-44ca-984d-b26c2891b705", "comment": "Malware payload (Mirai)", "value": "9149a3d17c90016cc44feb8824b1be191bc9273ccba5bc40a9ffc211e73dadfd034226038e30f8b88ede7438cac585ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988832, "uuid": "0d204117-0799-4d19-b907-b9ce875657a2", "value": "T148E2E1D792A45F30C2705270EA1C81861E638156D27D3AE76028986CEC8E75AA7FCDE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988832, "uuid": "598558b7-8798-4d5e-849d-d5a65d65ecc3", "value": "768:fHvo6suXYvlTKoD+js5n7S9OfeBldds3UozBW:vv5Z8OC+js57SlBldgz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784988832, "uuid": "4b29854c-403d-4200-bd6f-c543631685f4", "value": 33540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784988832, "uuid": "a9cb5f63-0008-4f35-a5c1-bb5c8c608d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988832, "uuid": "cd7e7332-1332-4789-9034-66cd7aee72e9", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea052a55-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998646, "uuid": "d86e3450-67f1-4215-8be5-05b53135895e", "comment": "Malware payload (Mirai)", "value": "4c683ceed11c06b6c8c7e99114662db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998646, "uuid": "4449c0de-ba06-459a-abb1-9d9a676fbc63", "comment": "Malware payload (Mirai)", "value": "5faecbdbeddea7e5ed5ece4e4e303f5060e0ca01abb5eb2c9ffb129582638743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998646, "uuid": "5bfd8f05-a6d8-4a0b-99eb-7c895388c00c", "comment": "Malware payload (Mirai)", "value": "de351d82ddc590447b6d39bae9846de0eb70a9d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998646, "uuid": "7beaa7b1-2690-49cb-85bf-603dc267297c", "comment": "Malware payload (Mirai)", "value": "a08f6a3f242a2461ecee40c7f64adc8e7a0b2f1301825be5b2711e22d537a0df1a7b6cc90636d2199a5a41c34205ef07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998646, "uuid": "3699782a-055a-4ab9-9902-739acea675b9", "value": "T1F43302E9160551EECE6850F17B0A07CD19A11BFFD782D8761450A9C788F68F6F282EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998646, "uuid": "3b4daf8f-70bb-4888-96c2-bf04a3ac988f", "value": "1536:RKK2sabuva4aOFc0pca3N/RvKEm8BVJuC1:RKLbYaHn0pB3xRi2VQC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998646, "uuid": "7ee4ee29-ce32-4fe4-ae14-9fc046101466", "value": 51020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998646, "uuid": "a0cf7cd1-4389-4479-841e-41625f521a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998646, "uuid": "c560810b-1681-499a-b929-86b0307848d9", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62228077-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973937, "uuid": "9db9c019-935b-452b-a4f9-5fd5d595bd50", "comment": "Malware payload", "value": "c97e5975677e92e705e10ac491462b83", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973937, "uuid": "04c1b139-aa31-43a9-8dcb-0d2fcc5dd979", "comment": "Malware payload", "value": "6135b2d76f1f6e3f42366fbb8d272dd6b738363b12deb58d3e70cf0f218b0d5e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973937, "uuid": "e1d4a84a-d6b4-4635-bdb5-259b2d251035", "comment": "Malware payload", "value": "730bd6fabae85ef5661c5045aac8db16da5d1968", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973937, "uuid": "b0cedddf-cb51-4872-a0e4-08a5c494b892", "comment": "Malware payload", "value": "fc62276ed13e1f9fe6b3d76efed6e5fcde0f96224dc746a55c5f2279d619169ae52b23285c7ded42b6f8407c16321be4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973937, "uuid": "10e04308-bac5-4a2f-98bf-fb742d695a13", "value": "T1B306CE4AFB489B6AC0F3523A0C355A61415B4CA68F83D783BD24733C58BB9D41F5AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973937, "uuid": "6b0a8ac0-8876-4dbf-8b55-f69c75a5ddb4", "value": "98304:N1ij3XV6R/pEhgMT1oMsMUHtu5CvBiToK275gLc:NZQW6LUo5LT07iLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973937, "uuid": "3d8ca9f3-9649-444e-9416-12d7bea662a6", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973937, "uuid": "baf78c61-fab2-4abc-8449-9a3546002bf9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973937, "uuid": "5cd4f4b6-b2cc-4159-b125-21093610d5b3", "value": "variant_05.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fe4aa5-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784979653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979653, "uuid": "7fa9fee0-0c7c-4013-80b8-207a063d329e", "comment": "Malware payload", "value": "287f1c7775b1e76cd31ed10033e1a111", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979653, "uuid": "b7992f9f-7b10-4860-84b2-23c13051196c", "comment": "Malware payload", "value": "6270f38bdf27aebb108331a484220a8bc0b9a1e6a2c4bba6dad89a2f3665bca5", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979653, "uuid": "1bef68a7-5c23-4ad8-b5ef-d391e3133bdf", "comment": "Malware payload", "value": "155b0d50a983cf737394a1e5b9b69412e99f73b7", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979653, "uuid": "06f487a8-53d2-4653-ab1a-4330515bc004", "comment": "Malware payload", "value": "51cb1efbc2f7ed8423c23b9478a1446aaeeae226c0452ba9c38a269024c70b7c09bd6f113261ac4e8aaa736287714b6f", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979653, "uuid": "f1370899-26c2-4a14-9da1-72a582b0257c", "value": "T16533E90FA742A4D8C91FC1349BEA4773B6B1B81154A26B1E23E0C7211F64DEA1F3CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979653, "uuid": "9e58ee42-0df7-47bd-8ecb-8ab13adf29c7", "value": "8e7b065c967657cca657d11206f96e23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979653, "uuid": "1a4be4ea-b439-4da7-8fba-b4133c3b38df", "value": "384:didi+dL5bd0tFi0huzFp52PzxM1eDdeXbGMw:MQ+p5wwcuzn52PVMQdkKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979653, "uuid": "8507558b-c5c5-46e9-8861-bddd8a1772b6", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979653, "uuid": "33fd739d-8b6b-4631-8dca-b368bd6b8b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979653, "uuid": "e950b213-1c37-41ee-8e26-51c0076c9868", "value": "student_s.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b36d1f-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975607, "uuid": "c016b7e1-ced6-4c48-a752-8bb7985d022a", "comment": "Malware payload", "value": "94084793c81790328212c073217324b8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975607, "uuid": "1122c622-6708-4df8-b760-971e4199bc9a", "comment": "Malware payload", "value": "62b1befa39b58f6f20c55b0a497e4864735cef17eedffa6e454e56b6d50cbe3a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975607, "uuid": "833b0299-fae2-4713-aab7-89ab2bab2697", "comment": "Malware payload", "value": "994701ba6f6f84ee97567151add8b42efdf45c8a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975607, "uuid": "fc5755ad-2274-49de-a01c-e8cd308b6b25", "comment": "Malware payload", "value": "3f96b95738f6dd8b0a509add35e9d718a140978e208129441defdb1adc36bb4c0983a3ce1e40637c5fe5e34964c75a48", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975607, "uuid": "96f03138-f26a-4568-baed-d431554e6cd8", "value": "T1AE72D0876727934FD5278F8AE7D1B2652BB8E4398FD344A2F0358B41B421F0101EB6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975607, "uuid": "6141fa3d-e07f-45b4-961d-917c77b2a035", "value": "384:XisMhBxwqNUhsB7OXFvwzXh1r1VS6ASMGA7oy+hFyoVuJoOjJTz:XU3xwu3BqXyt1rSxjG5LV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975607, "uuid": "86f03648-cacd-4b3f-8423-ea35b71ef0ed", "value": 17326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975607, "uuid": "9a6fbb77-3ffd-405a-a6b5-6bf546a166f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975607, "uuid": "de1bbb8f-719d-49d7-bd05-2e2402001ffb", "value": "images_20260725_034659.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e6421c-8823-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784982286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982286, "uuid": "4c0eef26-1f36-4f81-9842-35758d3dbfff", "comment": "Malware payload (Mirai)", "value": "f9d530c2a1321a934c2e43b15d4dee32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982286, "uuid": "2d090d07-8600-4acd-821f-6e6f7ca40259", "comment": "Malware payload (Mirai)", "value": "62f6b3bb68ecf7969a48e7be27d35d6d4ebf99eecd774cbb7bb95de36feb0610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982286, "uuid": "efc9a74f-9d27-4ae7-96ff-f86b51a65204", "comment": "Malware payload (Mirai)", "value": "51237330407d9380951c636de7797e0ea2ac8ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982286, "uuid": "a4233906-b4dd-4d33-8246-0eafa6eb3d88", "comment": "Malware payload (Mirai)", "value": "4f4cb7b5a3ca78dfdd0add12974c8de309037860dd81c1937fb55fb0fc7dff861828c6b900728407fe2082016f9ab9a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982286, "uuid": "bbe04e54-25f1-4218-a5dd-f7b9366e1372", "value": "T185A34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982286, "uuid": "bfbeb93b-e7d6-4586-9114-7d64e6368a28", "value": "1536:fw1BTZX/rhDtZx6q/Wc3Ra/oiDQ9VPJUN310vntiZvnwl7/4qKU7yPpxr:+hr9tZxoc3A/oiDYIClSCqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784982286, "uuid": "9412ab18-2d7c-41c1-9c78-711ace8c24ea", "value": 100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784982286, "uuid": "ecf3ae9f-4e50-49b6-831b-91a317f4ef18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982286, "uuid": "53a5f4be-cbf7-459c-8356-492382eaa483", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0459fb63-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974638, "uuid": "6018b047-ab4b-4df0-a2e0-e3f44e31a4cc", "comment": "Malware payload", "value": "1b8cbbca2fa8cc8e6e1e28213e1bb8ef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974638, "uuid": "2dd5f14d-980b-42aa-a1fd-e89ccee3d1c6", "comment": "Malware payload", "value": "631fee34bb6c4761b04042bd6c249904090d01d053853e77527e4ee12abdb61f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974638, "uuid": "59c8c9f1-0b0d-4dce-b5e6-5193d9c0f528", "comment": "Malware payload", "value": "a8679fcf9461fd60c702ea1d9d94b828fa74fad3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974638, "uuid": "89dfa0e0-0b02-480b-ab97-6e158907bcbe", "comment": "Malware payload", "value": "d52500973502ead302c9f1ae387611727cc82b2d09cb70134bbc5f45b5fe7a55407ade65e4e2dcd4f108e793171597fa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974638, "uuid": "84ecc751-2361-432f-a287-08c9b7fe6683", "value": "T1D772CF44154D8C71F906F6320A99527A4B060065F5102E8FAF5CA7A5FE9C8B8CDFF8D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974638, "uuid": "deeb8aee-a179-4a1e-90f3-9ce5bf90f6c7", "value": "384:9muSCk4jMvHskbtvhmpkfpzbtFBEqoRBJ5xXw9:9QCAvMmvgpkfpzybRBJLXw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974638, "uuid": "101dc730-a47b-4ae9-9e99-71f1e317f02d", "value": 16729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974638, "uuid": "cf77cef9-3cef-465e-bf58-a244680818ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974638, "uuid": "a36f006b-bc5f-42dc-96e2-04aa4fbf672c", "value": "images_20260725_075423.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dcdb52-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974804, "uuid": "a9e5e969-9f3c-4242-b473-6cd1323d181f", "comment": "Malware payload", "value": "a87199aad34d55be0ee2a1ef932f4e9a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974804, "uuid": "6fc43df1-2ca6-474f-ab40-1b9bab3f606f", "comment": "Malware payload", "value": "63366eded797e1fa35af444d760460617a26951c3986381175b6f6551adfacdd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974804, "uuid": "74c87e02-fc47-483d-9706-e89fb2f066ec", "comment": "Malware payload", "value": "0fe2a3354db513e2d09a5c0a0e6b44489add2882", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974804, "uuid": "08b09e6b-3a09-4498-a279-30df70b8ed3c", "comment": "Malware payload", "value": "2c631ffd0218b5970e78d1143c4ac8de6f670622a7fd876d9917437c6081e17218ba9a4b3db363d3f440eff2b39bffc0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974804, "uuid": "152a53b9-4eeb-46d2-a751-6bff38bd2e3b", "value": "T198F18ED14DC8A876E84BC37168671AD1425BFEE343C1568AA73084DF863E28C976859F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974804, "uuid": "442bf903-1f61-4166-bc63-a7569b1d506f", "value": "192:iPFEbuPtSW95eN1jGsEl5+6EWFgq68IcL2:itEyAWnuoC6Xe8IcL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974804, "uuid": "d637fbe3-f49f-4a97-ae70-b47027aa7118", "value": 7697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974804, "uuid": "8f871387-21c7-4e83-b61f-5f4fbb8b3c71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974804, "uuid": "57085a7a-eab1-43e8-9a63-b066f1227bef", "value": "images_20260725_044900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e7d6d7-87f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784963046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963046, "uuid": "a3e5c9f0-7215-458c-bb3d-2185825eeb75", "comment": "Malware payload (Prometei)", "value": "96f47224c70db5ad8e6c00a7fd47de5a", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963046, "uuid": "06c823be-76c3-4ddb-bf2b-b090e9fe3d36", "comment": "Malware payload (Prometei)", "value": "6346687be3206983eab8b942233e642af693e13df0c6977e774e28a852567b13", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963046, "uuid": "e3a25053-4164-436e-8ee0-5e83d7ac3c99", "comment": "Malware payload (Prometei)", "value": "fc09bcbb86c02baf1d4904aa504f8b552ef94c4a", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963046, "uuid": "7d3dd868-68ae-4c72-a313-a438f698371c", "comment": "Malware payload (Prometei)", "value": "de1ade0d84575bdf44b9e9bbd63d16e31208fc3b549034ab70f45f9cd76c96c88b94fdcecdeee81c51e69d2a865579aa", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963046, "uuid": "809c7c6e-01d6-465c-a4fb-b2c42f9872f4", "value": "T1A6D15562F154963C36A6407D789BE4E2300A411B56993C58B54FF6A03F8F378D2F629E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963046, "uuid": "c988c488-600b-431b-bde2-e95fd13ca176", "value": "96:lcdHw+tFMNN6Y14cD6DqmLA3J9gjrLJrjhB9VN:l2dX+N6fI6TLiJ9gHLNjhB7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784963046, "uuid": "1dda8840-58a7-47b1-a30d-36ca40f7dce2", "value": 6174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784963046, "uuid": "8bf8c4ac-5ee6-42ae-b393-a594fea6f9c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963046, "uuid": "89fe2815-605d-4852-9e40-52e8e47aa497", "value": "6346687be3206983eab8b942233e642af693e13df0c6977e774e28a852567b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5084a8e5-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975625, "uuid": "df264c08-2257-43ef-9c40-edd76f141ca6", "comment": "Malware payload", "value": "9b88e63a666bea9cbc4627c38bc8e895", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975625, "uuid": "b833c840-9613-48e1-803c-9bdb54080cdb", "comment": "Malware payload", "value": "634bef6e54d4c795df01131de8f38d9e8b7fea7a562b600beb7307a325669cb2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975625, "uuid": "83ea793e-ff66-4ba3-83d9-362d4482c3e6", "comment": "Malware payload", "value": "711114398890dc526ea252e7693fb14838e811e6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975625, "uuid": "058e6407-7666-4410-93cb-bab5b20b918c", "comment": "Malware payload", "value": "7424fd649a1c7b17180bbe9abdbf4fe43e1c4babef0d0417fdb7c2b2e86e7dbf16a95ed0b5674652e349415accab5a63", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975625, "uuid": "7662faee-6b90-42a6-ba16-9f2fdabcc620", "value": "T13A42CFCD9FBC0D53A0A8EFB92C43BA20702CB7370675C36AF2B5AB769A1D9544035A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975625, "uuid": "75903b32-f82c-4377-a5da-4e01e0ffd38e", "value": "384:WeJC1vINmUoWEi1fp7YCrR2OgKaN5DK+/F6OtgrVXKI:WeYtIN5BE4p7JrfaN5G+MOtgRXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975625, "uuid": "169c6c43-4ddc-414a-9ce8-e833aa52667c", "value": 12957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975625, "uuid": "bd4884ba-3f88-4c3f-9cb2-6d688c58ab7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975625, "uuid": "788babfd-74fb-4e43-be8a-055fec30fd81", "value": "images_20260724_151353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cd5dba-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975656, "uuid": "35e2e193-5b8b-4b91-b888-79d7e558752d", "comment": "Malware payload", "value": "633e837cde520a59ab3802357cf1b9c4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975656, "uuid": "288a6108-4899-42f1-8310-8e2fff666dc8", "comment": "Malware payload", "value": "64dfa6d3e4d3ef8783ac2f57fce3848d0754528bcaacd6565638693f07f02376", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975656, "uuid": "dd7b96b6-65b8-48b7-9979-6bd351a37267", "comment": "Malware payload", "value": "a1e3ca468b47f3bbefbe21b9fd431a2f585fae35", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975656, "uuid": "588953f3-89e0-49c1-8821-6dbdc347b572", "comment": "Malware payload", "value": "02b5fd73a6557906ed103a24f6f84c3223fb9e32c3ee4b540c569d884c36a4f2fafd60ccd381e3d16ac47106f23fad78", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975656, "uuid": "3542915e-834a-478e-8a98-fc8c0b78d90d", "value": "T105C1AF64117F0AEBC1E39DBA118E775DD5804AC9DBE0DA5B3AD1748F6C083C811BC264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975656, "uuid": "21e61615-5fa8-4001-8f6b-f668e939f343", "value": "96:DqT26ggZFcdT6TjMfP9Ue0L8/DXDxxecRSdS18WP8jNaESO4:M2eZk6T29904rauz111ESd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975656, "uuid": "efb59a2f-c6be-4de3-a840-cb768d295e04", "value": 5846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975656, "uuid": "7c019663-f689-49e6-93d5-376ba0d34210", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975656, "uuid": "496cd28e-e4c8-471c-b741-abd69703686e", "value": "images_20260724_151200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5581dda4-884b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784999256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999256, "uuid": "a77b9cf7-cc16-42a6-a412-c637dd4c7592", "comment": "Malware payload", "value": "414491976d6da13dcc2d624dbaee0a5c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999256, "uuid": "925236a8-2f09-4601-b7d9-41a25e45e467", "comment": "Malware payload", "value": "655762d13640a024bfebb418ce4d1a349ddfdef357600eaab420b7a4d9c04b98", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999256, "uuid": "01ec419b-a430-45a7-9901-3832de50b7bc", "comment": "Malware payload", "value": "c1f4d46c62eb48db7c1521f41feb61a7cee091a8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999256, "uuid": "110c2976-95c7-4d79-a702-c48f2bd2545a", "comment": "Malware payload", "value": "9a7cebe903b5e0e6661d70654571fc0e86b9cdab12162f78cbc6beb49c14cb3e9e2f11d2121e00a24afe7d06f7de6303", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999256, "uuid": "3749167d-1cf9-4609-b45e-022d87bfd9f4", "value": "T13C136D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999256, "uuid": "97c51d75-86b9-48a8-ae81-b7edbcf3d1b4", "value": "768:WXRWNGxVC9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Slxtco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784999256, "uuid": "dc3e1564-64a4-42ee-8cdf-2988777471f2", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784999256, "uuid": "5b0332f9-44e6-47c0-a036-721de971213d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999256, "uuid": "d3b27031-9dbc-4d8f-87af-98186fca4a0d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfd8c80-8854-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785003375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003375, "uuid": "e222627e-9594-46e5-ba65-c1018ff5822b", "comment": "Malware payload (Mirai)", "value": "872b08c43c7293a1626625c92030ab17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003375, "uuid": "3fc40f31-edcf-4438-9aae-ea98bdea8f4d", "comment": "Malware payload (Mirai)", "value": "655e66d1fc8aa77dae0bef3ffd4016566a6c3e4e7ed44d163d7adc84361fe326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003375, "uuid": "2fb3dcc6-a1f1-4072-8acc-58f865f7fae4", "comment": "Malware payload (Mirai)", "value": "0215ddbeed30d7fb451a8f56f74d4795c724e287", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003375, "uuid": "6f566a77-f15d-454a-9b1a-9c641d65f7f2", "comment": "Malware payload (Mirai)", "value": "1a070fa8400fbdeb64379a240ef8e4d046f61733a61669c34fd5291bb95e17aefff0c863602b4b4c6799947c643d8384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003375, "uuid": "4c2bc0a6-f00c-4d50-b5d1-5933b5d9b182", "value": "T1FFE3BEA7F78B2091C96302F407CB6BCD6E1722825F5BD9E76D6F303B597A0DA0502B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003375, "uuid": "b575fa4c-a445-4b26-a680-da98cf14cf3d", "value": "3072:iek++sK6WpE1JyQ1U1s9jbvEnVOkvg176q:iedWcfDbCg76q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003375, "uuid": "d6c155a1-40f8-4965-9ebd-ce191f60c6f1", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003375, "uuid": "76b27cf7-bff5-49fd-a9ea-9e7afe882fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003375, "uuid": "b588c1db-8e0e-4c23-9612-25fb4540f834", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16d80c0-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991357, "uuid": "b8b5a634-ee52-40f7-973a-9532fcd5b48e", "comment": "Malware payload (Mirai)", "value": "1ee0962f59b43da514bf333ccd0392c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991357, "uuid": "7e41cc16-ea5b-4a11-b31f-fc4a2a246ef0", "comment": "Malware payload (Mirai)", "value": "65d7f4ea236d6a7427167bb20118605ab4f30609c36e13848e84a5355f747565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991357, "uuid": "a0ccfd24-c733-4b61-94f0-6fa6f2b0a782", "comment": "Malware payload (Mirai)", "value": "4815ee42c2ca64f7afcaacf69edafef520fe1bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991357, "uuid": "365622e6-6501-4366-a079-8ebbe33a3db0", "comment": "Malware payload (Mirai)", "value": "3ce42a8141ca30eeb4177c56a309733c0dc936e56aebad1f9f0f838dafcfdb599ce6576a07afec3150620692cf8349e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991357, "uuid": "b99155a5-d782-4c1d-8046-8d87d920c3c0", "value": "T128F329D7F900DEFAF80EE33688530909B230B7A255925A373257797BEC3E1940467E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991357, "uuid": "5d021c10-ee65-45fd-bf05-72241b13bf0a", "value": "3072:nMp15shp3W6aO6+uSzzRMW+X6qbFfwjV/jbiILy+nF7MoyO0HO:GHshUFSzzX26MfwdLh9yOqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991357, "uuid": "917dd512-6db2-4e55-866b-cc6d103d64b4", "value": 159616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991357, "uuid": "1e077bcc-2f57-48cd-8be0-505c50c34636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991357, "uuid": "423001df-828e-4f8f-a66b-58a5e21f78bd", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580869da-87d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784947291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947291, "uuid": "96ee0372-b217-43b7-8a7f-c39b738b8cf7", "comment": "Malware payload", "value": "582f8b1b91dc1a6fb4f95c2df1116c3d", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947291, "uuid": "bb58b854-36c9-471b-abb5-877ab4f0c134", "comment": "Malware payload", "value": "6642e8df29c72b30e3c143c1d5dacf06e556da8f935bc28c1b7c0db542894f5d", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947291, "uuid": "ac010cbc-582c-4d64-966d-d003b86e3e47", "comment": "Malware payload", "value": "d575ac6d6f165f807593ddff52ab3939857a6fbf", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947291, "uuid": "ffb5b18e-239f-423d-9fbd-50acd190db67", "comment": "Malware payload", "value": "c6441cc8538d925626014dc81c2d9ea2f584028fda9f433268eaf2d4937814c9b78615b6d80043ecb01c31d3a1d1c11c", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947291, "uuid": "a09d4cd0-8c65-4226-a6ef-b20843ccdd8d", "value": "T198D5239AB5F62A71C87AC7B28F82E47DF03D778507228F9B768D68009D131941C7A376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947291, "uuid": "42b46f52-6d64-4153-a4a7-c1c2cf9495cf", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947291, "uuid": "02d57963-2f84-4713-9e17-e37a9dfe4218", "value": "49152:rZdNjHV5Ha2BypAaCT2pNteCmzr2a1N/E68mhPaPGLmHIDYLXVkv:rZrJVFuS2Ht5a46gbo8LXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784947291, "uuid": "a4b416af-1be6-4fde-83da-1eccd651eb4d", "value": 2954240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784947291, "uuid": "d18c8c05-4744-4157-8f4b-19dcb6a20967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947291, "uuid": "6d69cf68-74ac-4bca-9f1a-6a34d9696411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bed1e0-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974746, "uuid": "935f7716-e6c1-4849-ae8e-73340aaca1d3", "comment": "Malware payload", "value": "03078ddb622c1edc3d92d4863d25ad67", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974746, "uuid": "68840317-9b97-4593-8946-5b1efeed8090", "comment": "Malware payload", "value": "681d0da6246a98658878976142050bcb53457085d8dcf9762d7a98d0a8ee34f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974746, "uuid": "e6dff399-ff37-4591-b756-d25206d5b049", "comment": "Malware payload", "value": "ba00a092524fda5ad5cb1abc54fb80ffe5101aec", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974746, "uuid": "49e21c90-4771-4d9b-a6b5-5a4c3161a7ca", "comment": "Malware payload", "value": "9fe929c5add0a165f2143497e692c5e7cd831bd620f728a70577dcebccce89657f0d1d2922eac38de2a0ad8f55b9445b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974746, "uuid": "07802951-556d-4703-9b9b-a78f5bda801e", "value": "T1F872B075E10065EEF6FA22FB6543992F6239942750030389A12EC75F8D845AB53B815F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974746, "uuid": "1e5cd3ff-28ee-46b0-bf76-0b4987fda7a2", "value": "384:9gaPCtBAp8cog4CZvMuFForNoXPtOYdusUBOsXOjIp:HPCtUygxkJOtOYdutBOsejq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974746, "uuid": "9acd4c05-9b20-4896-8f9b-5b690aea5b58", "value": 16773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974746, "uuid": "ff647b34-190a-491e-b1ce-ecc10daaeb43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974746, "uuid": "10b9eb38-9d0b-45aa-b816-62122eaed480", "value": "images_20260725_083841.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bf97db-87f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960850, "uuid": "66a7c11b-f807-44a8-8ca2-f56e4494704c", "comment": "Malware payload (WannaCry)", "value": "f7a9be6e4140bb14d916bd73f0868aad", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960850, "uuid": "6a8d2067-e73d-44a8-8401-5b2bfae9da84", "comment": "Malware payload (WannaCry)", "value": "6925fdec115ca580da0c37cf3804ec6252d1210a4af5acc205bf695aa8d0e0e9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960850, "uuid": "356ba5aa-7387-41fa-b045-15b772f933b6", "comment": "Malware payload (WannaCry)", "value": "6ed8767b85a5ddf99b4e7ac4fbc7e50c6db44027", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960850, "uuid": "608dd6bc-3797-42f1-8046-cb3f5d86c267", "comment": "Malware payload (WannaCry)", "value": "65e38cfa2d00e1c59505734a18c34e717866cb6c1d445dbcaaaa199e56fba52401cdf9eb513565beb104ed31b8bb5145", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960850, "uuid": "5d83d0ce-87bb-4153-827c-16d33ce9bf9f", "value": "T18B360214B2E86764E7B35EB2217B8B1047757E46896B934E1760A04F0C33F5CEEB2B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960850, "uuid": "284b936b-563e-460f-8642-9da9a1e17267", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960850, "uuid": "22b69b43-491d-40af-b827-3954f4573d1f", "value": "49152:jnsnFQKMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAYh:DMeKPoBhz1aRxcSUDk36SAth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960850, "uuid": "407f78b5-f843-4184-86e1-7d3ce5468cd0", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960850, "uuid": "c585387e-802b-4663-9cb3-38c974368cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960850, "uuid": "4c22fe66-d43d-4e05-99c8-e75f42f4ac27", "value": "6925fdec115ca580da0c37cf3804ec6252d1210a4af5acc205bf695aa8d0e0e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74500a9-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975341, "uuid": "d979feff-4ee6-4886-96ff-59ad1e8f094e", "comment": "Malware payload", "value": "07da8ba2c8f7b6899a761aaf501dadfb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975341, "uuid": "46c113dc-1517-4215-a9df-30abefa73fa8", "comment": "Malware payload", "value": "69a71df91a020efbbde9901687857b6ad80ef0892b2f5b0c1914cd0175081125", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975341, "uuid": "ffd53cfc-70b6-4751-96ed-7141d614751a", "comment": "Malware payload", "value": "583fb8549d74dd28e11727a8c84cc3399c336d0f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975341, "uuid": "59c32f11-5b7c-438e-a46d-7bce18bc160b", "comment": "Malware payload", "value": "799f03121e0b0491de4f3eeb629079e839ce88908141a933fac53e76ffbd4d4cb3c680b76c3e6786b93e546caafbd783", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975341, "uuid": "479149d8-0820-4bc9-a1e2-639e26bf5d30", "value": "T1F1816C692B5B0983D69BA4F2C8A8D46E821D8804378A40D6CC36710F7F12EAA7357170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975341, "uuid": "378f5e26-3b22-4531-81a8-b9490c43638e", "value": "96:4iBB3Kyz1IpCyNTztIOJwfjO2pJqNuHfzw:FD6VjNJwfjNguHrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975341, "uuid": "218afef6-e375-458f-89cf-c06a0ec552b7", "value": 3943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975341, "uuid": "4aafba55-116d-44ee-8203-4b0066141709", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975341, "uuid": "20504f49-a66c-4dea-a12f-6789c4cadac0", "value": "images_20260725_015136.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74316624-880b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784971820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784971820, "uuid": "f75ad324-9152-497c-b8b7-f07c7382a8bb", "comment": "Malware payload", "value": "e54cf96088c0d97df5f3f3b572bced9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784971820, "uuid": "08703da1-3caf-40ee-b66e-f9c16ae37b16", "comment": "Malware payload", "value": "6a4af8a73c08a4006dc17a7965263bb54090ac50c9a4a0bd568b80a996e8d42f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784971820, "uuid": "a304ecc0-8706-47f3-9644-f1f2dc56d86b", "comment": "Malware payload", "value": "33670c35e2cf7cd1cd5c55d629f125d059fe5225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784971820, "uuid": "cb9296e6-0f09-4e5c-9942-f3be5418b998", "comment": "Malware payload", "value": "03f4403f99e9167c2372cc8a5bfa3e50117c6000164876650469efe010c857f7d673ca9488bae6e8b09c64378f69f0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784971820, "uuid": "6b3cd0d7-4480-4964-a4fc-30a721c853d4", "value": "T186E68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784971820, "uuid": "8a077916-2415-4c0b-aab6-664b446ac15b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ6:cqYUQuVDt0TZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784971820, "uuid": "1d9de9c7-8cf7-4945-8577-b73c3a9622b7", "value": 14221312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784971820, "uuid": "19465425-3420-4d8b-9bea-ab4db9f159bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784971820, "uuid": "66c01fa2-d110-4518-8361-de6bc63fc6d4", "value": "6a4af8a73c08a4006dc17a7965263bb54090ac50c9a4a0bd568b80a996e8d42f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f19766-87bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784938189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938189, "uuid": "37a97ba3-7282-46e9-9afd-00833ca18ada", "comment": "Malware payload", "value": "511d7299bfe0d682678ce1ce90bd55b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938189, "uuid": "d174034a-c9cc-4e87-901d-2afa5424884c", "comment": "Malware payload", "value": "6c646999f22c128e286a54d09a40c305a085204840fb6774de664770ce46aeb3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938189, "uuid": "b21bfa86-7dea-4cf0-a1cd-0734723df760", "comment": "Malware payload", "value": "510ce8afb363e7158ac2db09c00d1df4d28962ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784938189, "uuid": "403bd80d-72cc-4f55-8279-ef2907208a02", "comment": "Malware payload", "value": "040fe490c22c2e2afbd4a088fd6a6dbfed149c1156447d48ba8931229ee71023ff330dc55af048d1043db0620587b9d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938189, "uuid": "02540fda-2702-4774-9ee1-48bb4b30dc16", "value": "T162137D6966857C24AE99883B1C7E2F0CB9A983E1310851DDBFCB3CF58C09A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938189, "uuid": "c878e901-4dd3-455c-9eaf-ae904e0acabe", "value": "768:q+T9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:q+0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784938189, "uuid": "3c64b1be-ea14-4264-b44f-94922b736bb1", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784938189, "uuid": "8e8f7e64-0062-4f6b-b233-ea25c639faa1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784938189, "uuid": "c5143363-19ce-4919-b008-f36fd9535389", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9a3373-886a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785012606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012606, "uuid": "eee6eb41-8def-4070-8266-ac978a9b9d47", "comment": "Malware payload (ValleyRAT)", "value": "5d5477120a75161ad3ed0023c36f3284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012606, "uuid": "b1094c2e-36af-4536-b315-eab3474057b4", "comment": "Malware payload (ValleyRAT)", "value": "6ca95860452483923f168b85287051f7914f8d30c608147542237262a603ffb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012606, "uuid": "cedfdf81-0323-4fe1-853e-56aa977ee3de", "comment": "Malware payload (ValleyRAT)", "value": "c8ae9e00ad2f9febb8cb1eb6a47b75f8e716890c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012606, "uuid": "f9c1a99c-7b0e-45be-ba2e-31058a42d857", "comment": "Malware payload (ValleyRAT)", "value": "75c80c470cfcc9a5b65409ff7ab8fc5c352124f469d8754b1b0bd20a0a75296e4b71599af5cb32969446cf072fe43613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012606, "uuid": "a8150c08-e57e-47d9-b30c-2cbe42db4290", "value": "T1E5B5E123B2CBE53EE05D0B3B4572A25494FBAB216523BD579BE4849CCF250602E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012606, "uuid": "925e7e7c-adec-4017-ac06-387672a17fb8", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012606, "uuid": "fcf1a7fb-00aa-443c-bfcb-9e70a0f759b5", "value": "49152:z+MRvHInhFxqZ2JY467MZ2Z9ftchfudg87dqn7iMb:zrcxqEJp+MYchXqdnMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785012606, "uuid": "08ec9287-9ffa-4b1f-b9a6-9c317d435e0d", "value": 2276208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785012606, "uuid": "ed1eff3f-07e3-419b-a5bd-bd653990e0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012606, "uuid": "7e0ef6be-aecf-4981-9267-e6ba214d7b75", "value": "5D5477120A75161AD3ED0023C36F3284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18ac371-886a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785012752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012752, "uuid": "655b684d-9c89-4fea-ab82-d54aaaf1f7d9", "comment": "Malware payload", "value": "e6aeedcaed66e73c88766f39b36b033e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012752, "uuid": "1a4f5598-340e-4119-8a3f-c6be958ab786", "comment": "Malware payload", "value": "6cd950c1729a136be666fe0f23a9de400124c0e301a03b7f0095f8b41576bb11", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012752, "uuid": "53081695-edc1-43ba-9a5b-ee46fa679c6d", "comment": "Malware payload", "value": "14f03d3697922304f19d25e885cba9eee5934e39", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785012752, "uuid": "fc26ed35-5f3e-4066-a8a9-60a0ce042fa1", "comment": "Malware payload", "value": "6e4973da0b4f2a34ee0855acc4ad75b62fd4630e76bdfd5f644babef56651eac466d0be1ad88870b90e4162afd94afaf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012752, "uuid": "3adf51e7-1fce-468e-bf6c-14e4efda8b47", "value": "T191E633185AE041FEE6A7C13C9E928866E195B4B22732C5CB4BFCC7656D6B2F0493C317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012752, "uuid": "90e2dcda-0eea-429f-9983-09f43042437c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012752, "uuid": "24f7071c-68b2-4fdb-8bfa-e453404fbdf5", "value": "393216:hk2XXX7mMYM0rz1lkinG7eUjHFoXMCHWUjXFcuI3/PGTAI:hkvrz1mE8jHFoXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785012752, "uuid": "8226def2-ec47-4f9d-8747-3c37bada88cb", "value": 14304290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785012752, "uuid": "82bc1975-286f-4b65-a783-632343ce3108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785012752, "uuid": "18949ded-9e26-411e-ad92-0090b216436d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658867bf-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975231, "uuid": "19ce714e-6f12-41f4-8f85-4ef172e6ddea", "comment": "Malware payload", "value": "ef7bd01e762b6b19455c683464b8a24a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975231, "uuid": "a3fee52c-ee31-43f1-a704-5cbc6a169300", "comment": "Malware payload", "value": "6d55bcc0aaf8d70c74c6fe47d8bf5d62fb0daf5fa22a61bd26226dcd1ccfacb5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975231, "uuid": "9262ed70-0d4f-49d3-b586-bcb3304e5bc8", "comment": "Malware payload", "value": "6a305e1b292df5b4ce1e9e0faad9d0227ad21e85", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975231, "uuid": "dacec2b5-1768-4856-92a5-173463bd6a67", "comment": "Malware payload", "value": "2473f441c6ca8856efde5c0d395b6424349518475baa5546fd344dea936205eca01d04ccb4203c25e5b1185767686d35", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975231, "uuid": "9059d4fd-495b-400b-9bb5-ac4451e9fe1f", "value": "T1B6715C2188437364D53FFAB790EE058B4A7802450F5E4D48EA4D4FDC6C862A3136211D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975231, "uuid": "995fead4-cde6-44fc-8c0b-8520611f39b5", "value": "96:U04bglqoM4UAP6Wtp2uCasvysHo3SOSsW6oreq:xVlFUAiWtpYasvxH+HW6o6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975231, "uuid": "3941ea0e-6bdb-41e0-a8ec-d07f272ea1c7", "value": 3728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975231, "uuid": "c70260dd-966b-4ea5-b862-1cdfe4e1fb4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975231, "uuid": "46969d26-239a-4204-8728-8d63701ec164", "value": "images_20260724_185018.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155cfee2-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998719, "uuid": "c1190d79-83f5-4af9-b9c2-e8ab45fbffa1", "comment": "Malware payload (Mirai)", "value": "7a7c208feff1f8143f042a38e01fb577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998719, "uuid": "5b949ca5-12b9-4c2f-ae1f-1e862494600c", "comment": "Malware payload (Mirai)", "value": "6d8249f94461455b8fdf679cb0c22c40e6d87d7ed7e79bcd7a48ada72e75ec92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998719, "uuid": "53c1d4d0-d691-4481-a904-19582c0528ef", "comment": "Malware payload (Mirai)", "value": "4653f4095c08a8ee0985d3548c245d54bc9e4c14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998719, "uuid": "3471dcec-a99a-4c98-801d-9e209c8d4bba", "comment": "Malware payload (Mirai)", "value": "b4c772cbf6682f8075009ab0d0ed13939d46a8e5365f26fab5dc6e4d8e11d7ca4da0749b3d78afdd1339bd779f7fda45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998719, "uuid": "a72d3180-6c3b-44fc-a2d6-7c2a42bfffca", "value": "T15C730112854094FAD0681873DEEF9FE91B1F1BFA637529673B76C79834020867BBCA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998719, "uuid": "92f75685-233a-4b4f-aba7-47ed14557b8f", "value": "1536:VjqvyRgfCD7QpWJh/D9IJA3mtMGviTMNRHSLrMDZYFIfflg:VjMCDzh/D9Ie3meJTMNRyLoHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998719, "uuid": "f6f5fdf6-1d22-42d6-83ba-49bac7274348", "value": 75504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998719, "uuid": "deea40dd-debe-430d-8136-ef8fe1a93c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998719, "uuid": "a6b496ce-378f-4345-911a-f96c593fde41", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7f42db-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975722, "uuid": "b41dca4d-df84-4fba-8008-16475eb78e2f", "comment": "Malware payload", "value": "99e8a2a03262e5ba0f3bba17bd49af2b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975722, "uuid": "1034ad85-8ad9-4e27-abd6-8e5466c52696", "comment": "Malware payload", "value": "6dd5ecd4549f70b9adb1db3a588e3cb7f401e3b0ce2c80101bab939ba0954f53", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975722, "uuid": "900c2ec1-e64c-46e8-af69-0cf209ee5030", "comment": "Malware payload", "value": "6c0704b3d9f676adf627bb8b4752a225c7221f38", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975722, "uuid": "1bbcb032-f6cd-4bd8-a731-cad5b6d442bb", "comment": "Malware payload", "value": "bb288af81da7ff52d0f426cfa97da504257bc6ac93a7e88ed1fe7d17abdda5acd64789b26cdd0f04984d81ed93e1a251", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975722, "uuid": "2f2e0510-07ab-4dd6-82df-16e4ba3abc3f", "value": "T1AE12AF2C6678DA18F547C471B8F9AE84021E34E5395DFAE2B688E0CCFA85B31793351D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975722, "uuid": "c09607a9-7abf-4ec1-afa0-57713c73f436", "value": "192:G1cV+N5ia4msDRHpyCpof0s831+fEwWjpzFtCZELvbl:9VPa4msDRHp0fYl+fOpzFGQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975722, "uuid": "c0184100-d321-4a5f-b026-96784e165279", "value": 9882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975722, "uuid": "9640af21-4b74-4949-99e8-91e13e4e0b95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975722, "uuid": "72e61785-dece-403a-88f2-37b79c3b4c14", "value": "images_20260724_185722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66196dc9-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784979527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979527, "uuid": "602d2524-239c-48a4-9f07-293fdef70e46", "comment": "Malware payload (Mirai)", "value": "71e76bb61c4755bce10b2b0b4c711333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979527, "uuid": "e5f9e59a-f887-4283-b1b2-a4939e807234", "comment": "Malware payload (Mirai)", "value": "6ec1fd39b1adf388ecbae488fbed926a9b31aee967705f0a5b322e7f90e72897", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979527, "uuid": "93918d0a-b847-42b2-8f10-bc0c277e5065", "comment": "Malware payload (Mirai)", "value": "bc780843f0458a22b3c53f788e7bf8a275a51c52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979527, "uuid": "8c1e7f4c-31df-47b9-be12-c6c1df5f2e07", "comment": "Malware payload (Mirai)", "value": "7c8e16c81bfd8421fb9ceadad253c2974b8aa5c28746ca55d8d1c7fa5f4d8c355571d0e9b1861f2976e591850d711ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979527, "uuid": "a12417fd-c435-4612-8900-a02ab4fd8f49", "value": "T1A3431895FD419A12C6C115B7FF0E438DB7264398E2EA3303AE256F21378B86B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979527, "uuid": "103d384a-58f7-42da-a096-bd4a7982f17b", "value": "768:/96FQz2YGiGNQ3GhSVYz5QvFWWWhSxFMIzEwTlkwOCUFjjK1jcKI1Jqj29Pk22jk:YlnQ8havdohIzjkwOCkAjjIH7kPkERZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979527, "uuid": "de9f0826-2702-4eda-8dfb-537ec24ed8c9", "value": 56128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979527, "uuid": "0cfc11ef-2a0a-4d1b-a7e8-5ff27f9a3a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979527, "uuid": "be953ac0-fbb5-4abb-b966-a470cfb8f891", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90513a2-8840-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784994779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994779, "uuid": "010c5088-27bb-4ae4-8b2e-d2ca2457bbc4", "comment": "Malware payload (Mirai)", "value": "2b98268664a13400b05e4de0f0945215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994779, "uuid": "43ab9691-70c7-49ec-acc6-d857ad1f76fa", "comment": "Malware payload (Mirai)", "value": "6f1edddba8fc5d2db069a1cd51fb4ca9138fde8970e7ad8ee3b49cf251f88edd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994779, "uuid": "23d4fe6d-9667-47b7-8bdd-1fb4eb96bc6d", "comment": "Malware payload (Mirai)", "value": "04e658b2329032d5a43181bcdfa4fe428117f07f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994779, "uuid": "d7c144f0-3f12-4834-b830-2ab304b25ea7", "comment": "Malware payload (Mirai)", "value": "9b30ab4df2f8d9bb9d5559ad2372ee4fa9a56bc6102b513477e44c55bbcb302ea4e7fce17b0ff08dad845af538eb1307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994779, "uuid": "3f39653d-8e94-4daf-b37b-63df3c8594ac", "value": "T13F23F159EAC239E3DEEB8878B86165C3A3F2754A2334C794D18DDF403423073A9557D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994779, "uuid": "c104d4e2-96b8-48b8-b3d8-95c8412ac3e9", "value": "768:NhQgHbQjcqCxdpf/eZk7pwkB6VmXJ2tQ1xwGkjfOeTW4uVcqgw09i:NhQgHUDCTpaRO6VmXJeqwGkj2p4u+qgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994779, "uuid": "dcafc6bb-5581-451c-b12e-deadf6c36d4d", "value": 47476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994779, "uuid": "cf3ccd6d-19f9-4574-be01-2e58bf239d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994779, "uuid": "f7f21639-6daa-48bc-af6f-023f2fd0f6f6", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa020bf3-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975775, "uuid": "4ec9c821-cca5-4bb5-9cf6-24febe61dbde", "comment": "Malware payload", "value": "24eb4328159892b57d01c98767919739", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975775, "uuid": "7ae3e78d-492b-44f6-a0d1-d61d2961cd8a", "comment": "Malware payload", "value": "6f9ec2ebde7ed3ada92734deaba47f6df65c85c67a0987cb630ecf20e9f89d5e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975775, "uuid": "77c6758e-7cd2-41a6-9c2b-b3a37940a3a8", "comment": "Malware payload", "value": "18c57a86901c3439df226987e48313294f2de53a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975775, "uuid": "8cd0da31-2b74-45c3-b42f-35e3cdd0096e", "comment": "Malware payload", "value": "9770c31f44be62e9d15835e957980ee2b5a2866e776fe1b2347dbbb04b967c55dfea2a6a3f6d3de287f64ae7ebb8181d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975775, "uuid": "a588faf4-2b0a-4325-8a06-d6677265fd2e", "value": "T16452CF44FD28345AF419AEB4593278E7848B8E3514BD28E1924EE611F31ECBE0DC6544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975775, "uuid": "42bbaf16-3109-4a60-b3c6-9055b286c3ea", "value": "384:VEQ1NT/0PHWwtzmy+OULCtr4mXLNNCOfdaPeZ:mQ1J0Jxt+hL0rr7zCSdaP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975775, "uuid": "3880b490-017f-46da-b144-be7aba5b389c", "value": 13336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975775, "uuid": "febf74f9-dd4d-48a6-bb3d-d9ec81f865d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975775, "uuid": "c5b94dad-350f-4dc7-afba-ffdb15fa5358", "value": "images_20260724_171549.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff11bfb-8811-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974631, "uuid": "8a3a1d1e-a142-48eb-b630-21406239e55e", "comment": "Malware payload", "value": "a0334a0a01741ee3ebaf35aa4e204bc6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974631, "uuid": "acb0597c-aafd-4e4d-99eb-7d21382c9815", "comment": "Malware payload", "value": "6fa58419f320ce5eded08ebfd05961fade450b6a37bb8b98bc067a0fa82b2030", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974631, "uuid": "cdc2e830-397e-4b4f-9fc6-02bc9c76749a", "comment": "Malware payload", "value": "013ac40d882fbf26cfebba639c5d25ddb4f3401f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974631, "uuid": "908048f1-586c-4f5e-b432-c264918c640a", "comment": "Malware payload", "value": "b95e1466878b77bac554122b8670e5feba093ee21b4f2fc89b8e11f72ffb28635e9f369f7c2fb8d6bdb43539410d6935", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974631, "uuid": "a65d299c-fc07-44e9-a36f-4ae934d299a2", "value": "T11612BF459006C1C3D72BA7B055D65D4DBF93DEAC37BA57414860D58932EADF03E20E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974631, "uuid": "20b6f306-da5d-4f1b-9bec-58cf9ef50893", "value": "192:IjgL0M7Xqsv5dFUvN9qgkbi5JGuv150hHAbc02VgNIS:Idr5zzJDPncSNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974631, "uuid": "fd3b15ab-17ca-4113-b1fa-96bc88eac9a0", "value": 9241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974631, "uuid": "8b4f25e5-5165-4611-a81e-0371573ed36a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974631, "uuid": "7c3e467e-da87-4c66-acdc-394e53150eb5", "value": "images_20260724_213913.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537a55d4-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975630, "uuid": "b633e163-a001-46bf-8c33-b71fbbbc881c", "comment": "Malware payload", "value": "014d25454ff41db3b67e485064e20a2c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975630, "uuid": "351cda2c-ce97-44d9-82fc-2b674c577626", "comment": "Malware payload", "value": "71527db7b30a97a6c230506290df8dd8a61e164bdae3b09d243e02a4b4417e07", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975630, "uuid": "e5863aae-aee6-4e73-a16e-3f5e8a5b09eb", "comment": "Malware payload", "value": "a60d03dcacdb728778fdce01175f28ef0e823365", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975630, "uuid": "9ed83f99-2659-4c09-be71-4277a5ab445c", "comment": "Malware payload", "value": "9f8def7a308bea06fa8fa3452a97ed263213ba7af7a4b02be5e43f433b17cf2c24f21affea190b3be95c91ed6f5fbcf1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975630, "uuid": "1fa235ad-0028-4344-bf65-79a25580316c", "value": "T13312AE0587501BC4CE03BDB871AC1BF66D268AE3285F1405AAEDB12D618702E681B52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975630, "uuid": "f3a6602e-27a4-43ff-a59b-1900f955d857", "value": "192:GiK9Pz0RCmoZ0JTyb58s+mlZzbojT3ynju4Volg3u:aPJmVyb58tmvzaF48ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975630, "uuid": "1e01e3f1-a0ac-4cf9-a364-1977989dc41b", "value": 9112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975630, "uuid": "14f3f7c5-119d-42fa-950f-ba4debfbe273", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975630, "uuid": "1bf6a15d-5090-4d4b-9ddc-5806f9ec60bd", "value": "images_20260725_052019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f529634b-8815-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784976331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976331, "uuid": "1a407032-6f5b-43a2-a9a7-3bdef0deabc5", "comment": "Malware payload (Vidar)", "value": "9bd97475aa0d8fb22a284d070a2ee795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976331, "uuid": "b4bf5dac-681d-4f25-82a9-8cdd9cc45230", "comment": "Malware payload (Vidar)", "value": "7153c7609816c1a5c2882dd7889cd2db9050813f3e5220f76e19f238709ad2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976331, "uuid": "008399d0-11f7-40ae-bacd-f576e4166916", "comment": "Malware payload (Vidar)", "value": "87a59eb6074958aaa81799312861574b2ea90527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976331, "uuid": "9de3d07e-c8fd-471a-9609-4d9f0cf75f8d", "comment": "Malware payload (Vidar)", "value": "772e9ac9cf0e28a2942786f75e1acbce1e32e44f0c327421e6e19f963c9b0d4cb11bac12385b7f8aa3b13be39837908c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976331, "uuid": "8a98f06a-af9c-4e34-9939-7696bb1089f8", "value": "T14D36AD07BDA259B1C499A631887A53127B38B88F8B3233F71D60A6343F723D1AD79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976331, "uuid": "aff94ddc-3563-49f7-92ce-6ce64881ab3c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976331, "uuid": "9c949d72-a4d2-4dee-9583-bbec3069a2a3", "value": "49152:2TqeX5o1/VAvgJS092cxG9lJJSTbQ02GP/MbsWZY3c9XNnUNmSqllf:2TlyDswG9lQbj0bpT9XGnilf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976331, "uuid": "ddfa19e2-5f79-4c69-960b-b3b427761162", "value": 4904744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976331, "uuid": "81f09ada-3c14-43d4-9515-8da45466106d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976331, "uuid": "e8da8ceb-2c84-49df-8f0c-a639f494456c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fea35d4-87c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784941211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941211, "uuid": "a7609b7c-5693-46fe-a3ef-94fee2403bb6", "comment": "Malware payload (njrat)", "value": "306038f5b80551285855f65f1cc13045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941211, "uuid": "e9c3effd-b9fb-4a02-a300-ffd4326030a8", "comment": "Malware payload (njrat)", "value": "71b9449efaa11bc7e3e82a3df58a0730faae3b0e4ed1f96b36f71a4d675e872c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941211, "uuid": "020c47cf-750b-4432-aa49-b31488583d04", "comment": "Malware payload (njrat)", "value": "c52a9e0817361e99a6176e679f81e4b85a8e5316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784941211, "uuid": "c2157fee-79c5-4ab0-bde3-8bc0ed69a6fd", "comment": "Malware payload (njrat)", "value": "abba7dd1b6fbdc6fdf2fef83440bbb1cb0c0e36ecbff18f078cd703dd2bf1612901158a9509294d31f95a885aded53ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941211, "uuid": "36f16b12-d943-4135-92d2-d4c1ba40edfb", "value": "T137F733627BDCE469D7A8971CD8FC9B93039F708B96FA1A4B294CB0314831AD9D1B1473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941211, "uuid": "53864ec6-9370-470e-8909-257b9179efd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941211, "uuid": "6ad3fa66-c201-4cca-9725-9c227a9b7dab", "value": "786432:h5gBg5BsLJAYg/MIzSCk4y/xQkP8iQPtm0cwnReqJl/3QeqOPWbxEcIhsmn1cr1M:PfNUGE/FP8iQPtm0cw3PQBSPktjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784941211, "uuid": "61e53d95-355f-4530-9315-e2e86661c6a1", "value": 70986752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784941211, "uuid": "50bff9f5-a77d-4b69-8bfd-eb91b02939e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784941211, "uuid": "be697bf6-5a6a-4e6e-b67e-44279a3d6744", "value": "306038f5b80551285855f65f1cc13045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97610c23-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975744, "uuid": "022202ab-e17e-4335-916a-53559158783b", "comment": "Malware payload", "value": "8540a9c121835d5c703f8c2efc5f6bb3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975744, "uuid": "e827a36e-e1dc-4007-ab68-4335c570049a", "comment": "Malware payload", "value": "722542bf1c290b62382482a38f25ebb8bc77deafc255d4fad3ff05b2c5ec8365", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975744, "uuid": "1df3661e-5371-4728-a45a-f3b5d9ba8c01", "comment": "Malware payload", "value": "9f5816a8fdace43d7acb2fbe1986a2361b4c246f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975744, "uuid": "1affd9a5-dee1-4cea-9af7-f9e68fdd58c9", "comment": "Malware payload", "value": "7b2252e954b7d8eb5815d7fc405113223340bbfa64431a18fef69e8c7de8824684c72ca1aa9503db0630bc1bec92ea02", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975744, "uuid": "3903635a-f534-49ac-b267-3e8ea90a41fb", "value": "T12932C0D6CC6BF3829EFED5305DACBC3A148D108704034EE2550D55970A73E8BA4BD9EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975744, "uuid": "07ee9947-e342-4896-993b-53b9ee20d06b", "value": "192:roCVxXPy1lfqFlPbXypxHV1fj7MpOn5p/J6N+D0mQqaCUPqbOPF0Hk9H6:VVxXPalfcDXyplV1vMpQzJ6N+AmGC7b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975744, "uuid": "6fcd45c9-1de0-4c0a-9e00-eb4659557982", "value": 11482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975744, "uuid": "c443601b-4440-4832-aed4-f57ba5771b4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975744, "uuid": "f412f919-d063-4ac7-a93b-11e0e38292a2", "value": "images_20260724_153434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7b6abe-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975266, "uuid": "2a1623c6-98ec-4954-bd51-3929a20de918", "comment": "Malware payload", "value": "d9118e50e14540ee892da503d9de83b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975266, "uuid": "f77775bb-4102-46b4-b179-de3469d920b7", "comment": "Malware payload", "value": "723c237d03dd52dd07455133e68530ee0dd84bdaf9ffb4512304194decbe20ab", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975266, "uuid": "fa7247cf-aa8b-4f07-9b32-b6ed2eeeb95b", "comment": "Malware payload", "value": "605991a222639f188b32989aecf46bf4512e3cdc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975266, "uuid": "9a87599b-3261-4523-a7c8-c82f657cb7e5", "comment": "Malware payload", "value": "fa06321a2e0a6f3bae8365247c040de37b220f5f2851076d61b785ab65a23d7392dc363c9efcea42ee16fb62ee2db8bd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975266, "uuid": "13daf61b-a361-4076-b901-e381e04046e5", "value": "T1A422AF150AF6A16A971B3378F8EB9C685782D4304062D64ABD77F840DC47F072A58B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975266, "uuid": "e0e2dd2a-b92d-4a59-8860-d0c736fd81de", "value": "192:jov5PRoiuxnYwtv5c1rHkXaHwL+oVAY3fkKwgigNJWq:EhJzctO1rHkXaHmnVAYc1Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975266, "uuid": "783f7f92-2523-4527-8fd0-0635f76f448b", "value": 10866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975266, "uuid": "39f14d80-63ed-4f49-a042-30c36fe3961c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975266, "uuid": "dac75776-0f73-45de-9543-75c340be0128", "value": "images_20260724_170355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c038534-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974785, "uuid": "04be7a25-44a7-4eaf-9624-6e89de31dbf3", "comment": "Malware payload", "value": "f298216021e708426b42c65d769ae06b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974785, "uuid": "8f048948-7633-4b50-95bf-daa1f1949244", "comment": "Malware payload", "value": "724c152727ffae403b5a599e725895d17e0bf4eb2bd0f3e8920509536a1263a1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974785, "uuid": "e8eeb5c8-0683-45a0-8489-39698b677b60", "comment": "Malware payload", "value": "b84508cdfe882a84cc4cb6e897d47f485b407ca6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974785, "uuid": "c2e569c5-63cc-4852-9021-9131c781253b", "comment": "Malware payload", "value": "2b28d3bacf27d23afca8f1432bb82c5b6bedbaeba323837764a8820be8a0710055827a34ab1f356212d2549dffd99e03", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974785, "uuid": "2e56be15-7124-4bf0-9082-241561170ec8", "value": "T18F818DA08D15F800CA25F93F70B85AB1E7EA25D9084278A1727EDDD76902781240992A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974785, "uuid": "807b0d46-862b-4613-8fb1-0ebed1c0dceb", "value": "96:kqsrsnLWAHwh9JqkssgpLK9VNNB4twQoBL/s1+bd5GgKi1NdzN:7tWAQXssye9VNNBYwbJ/s1wr71Ndx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974785, "uuid": "a828d2b8-dbb3-4260-a9e7-ee11b4df13a0", "value": 4080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974785, "uuid": "9447ff10-dca1-478d-b5b5-f4e6d174dd43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974785, "uuid": "90205ea7-2a0a-4b6f-87c4-d73adc87c3f5", "value": "images_20260725_052247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922cefe7-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975735, "uuid": "611b5095-078f-4f75-92b4-c7af6f68db4d", "comment": "Malware payload", "value": "5beccc110fa5ea99186eaee70340ba05", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975735, "uuid": "8add3535-fe5a-4c3c-a095-7bbed91a2a42", "comment": "Malware payload", "value": "724cc098b972eadfc56c55bd0369e1b6adf33a24e9829258c2f3e4d947406a22", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975735, "uuid": "6226db0d-f1f3-41bd-983a-9152ff9f7ce1", "comment": "Malware payload", "value": "264a205190a597f02d1c955b602dba6129f0de04", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975735, "uuid": "65876569-db29-41ca-9b9b-6bdaa6e7ec4b", "comment": "Malware payload", "value": "ba35c8d073648e69189744a806cc184d0cd95a4e6b4a1b9065743f0ed0d28f69fe2deb09d7b290e3eb650bf0037cb4ad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975735, "uuid": "72dbe4c1-0731-44d0-bda0-0ace4944dbaf", "value": "T1D642B0D9E0ECD074E53FDF3830D62FF5C74FE1431612924A90E98892AE29C27626468E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975735, "uuid": "0fe0f8ac-4312-42d5-83d4-433ffcba84bb", "value": "384:kJvoOmzzz/vxKPcwc5qaa87QI0DKA4u9i:kJvI7/ZKPVEqZvm6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975735, "uuid": "d3915b73-e891-4f6b-95b6-c48e786c5473", "value": 12627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975735, "uuid": "d5596dfe-88a1-43eb-bb74-7af711f64dc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975735, "uuid": "632d3b0b-fe80-4fc8-9a39-533b23a66164", "value": "images_20260725_094736.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61633642-87c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784939576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939576, "uuid": "50b234be-9df7-46ad-9bb6-630b7042dec5", "comment": "Malware payload", "value": "00b25d06d4caf9172cbed772e33dcace", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939576, "uuid": "a7f1a47b-933b-4208-9539-36f64a40e492", "comment": "Malware payload", "value": "726a97ced0634c7d5ff426836ef784eb62d2dc87f19609eda722ea40b48f4656", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939576, "uuid": "e1c30c34-89bd-4a03-ad21-24d0455feb5c", "comment": "Malware payload", "value": "4ece8ddb35df770497141e63833780a5deb094f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939576, "uuid": "683e3183-708a-4cd6-b369-b4ef8be6326e", "comment": "Malware payload", "value": "e3ef62201dd14adf1f176d0b4906c5dd8e107d6f54363d97828be029cb0e756db4a6ba2e8b03e01acc1af8dca9a60edd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939576, "uuid": "a7e34abb-41d7-4bb9-a21a-21ade6e3b4eb", "value": "T1F8C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939576, "uuid": "20a02f46-f6fe-4c39-90d0-8e434aa1314a", "value": "768:R8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:R8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939576, "uuid": "e67573a4-4394-44c0-9bba-2fe1d6a2b013", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939576, "uuid": "c45df843-ed1d-4a87-ac97-4e14fcad32d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939576, "uuid": "7b5eb013-6c31-4fb7-b8f6-17754d319feb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f23d1b-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "376fc47f-c423-45cf-b2fc-04dd8beedf9b", "comment": "Malware payload (Mirai)", "value": "d045723afe105822684c1215764aa6f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "7b978210-656f-4231-8b07-23d18843ec7e", "comment": "Malware payload (Mirai)", "value": "72715b5e55871336b8edc4d23d970792b1422f052c7c599c191d72b3d191f5eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "3ff609ac-3f74-4403-b2c7-7443670b6fa2", "comment": "Malware payload (Mirai)", "value": "d2d38c48e39cb46149cc486f70549e40e39f47c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998713, "uuid": "27c34a19-8443-4ca2-a5f6-c2d8d850bcf7", "comment": "Malware payload (Mirai)", "value": "2cda1b470e551d06389a59d2bc382efbfe3e4764ba54dc94cf5a184d2734b521f5988f06a3dd321689c4ed4e1de3a9cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998713, "uuid": "6e74502f-410c-47be-8ab0-76b481b494d1", "value": "T1E0D33A46F8814A21D5DB12BEFA2E218E331317B8E3DE72139E255F2133C669B0D77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998713, "uuid": "65e37200-099b-4bae-a413-c00a2d8cbd51", "value": "3072:Y/KgDAvbqH7rJ4cSJN+UjX7qapNoOxH4BatMIHLRBRo:eKQrJ4PAUjX+aM84BTIHLRBRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998713, "uuid": "1f194780-7ece-47a0-b436-97ef555345ca", "value": 132884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998713, "uuid": "24866eb9-2521-46c5-b8b5-64341d4c7f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998713, "uuid": "7b9ce311-159a-4e95-974f-34659f5f0772", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8506417-8825-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784983128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983128, "uuid": "9ead1f2c-c08b-41cd-bddc-82cc6cf033df", "comment": "Malware payload (Mirai)", "value": "7a7a38ae85eaa6e9502f47dd74cf2d3c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983128, "uuid": "b3ef114d-2efa-491a-9eef-6110ca91f033", "comment": "Malware payload (Mirai)", "value": "72cff98db2a06004c63d97f5229995f991fa7178b79939ed7c7c4bf58c8a4516", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983128, "uuid": "6eeb9ccd-0d74-45ac-8d2f-61b9368d343f", "comment": "Malware payload (Mirai)", "value": "9635824e33cb8ec257da50175049c96b0583ac19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983128, "uuid": "5f930bfe-5ece-40df-b51f-169a2cb697ca", "comment": "Malware payload (Mirai)", "value": "3b428020976851c97f60949bffd4b1d5a055000695e28ca2e2df9d5731bd8626927935663011eb14a24758aa8a83b826", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983128, "uuid": "01a7d77f-ce5e-43a0-a864-2664da0dcdcb", "value": "T1D4018ED6D2605900502AD96D72E751A0B871C3CB058B5F78BF9C642DBB9CE18B066F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983128, "uuid": "82293d4f-f02b-4853-a80a-f592cd47bb8d", "value": "24:kXCKysE2hi0ziQvZohaTkeYFI1Lt3GDIM7:e9Qp+MsTiFI1Lt3GDIM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784983128, "uuid": "8b69b0d8-b0d9-4737-9b54-9ce62a1d1e29", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784983128, "uuid": "6f728981-3bfc-423a-b201-540e8dff88a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983128, "uuid": "78e13b9b-8ec2-4bdc-b779-15152956eda6", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b54eb64-8820-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784980878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980878, "uuid": "f3639918-73c6-41f5-8d00-8bd046bf2252", "comment": "Malware payload", "value": "d89a8645f78302ffbd9751481c757a24", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980878, "uuid": "a529d44f-7bdb-4312-9c33-859d4a9df4fb", "comment": "Malware payload", "value": "730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980878, "uuid": "817aff18-f896-4461-a9bf-7049d7d395ae", "comment": "Malware payload", "value": "5c9c8eceba71ffa54b2866e24928339405b936a2", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980878, "uuid": "da416dcd-3f9c-4d9e-9e1a-5be490dcaa92", "comment": "Malware payload", "value": "7651e1f4bd382e16dae94b59a6959ece9aa90af262dd965f0cbec4ee81c2463eea2231c65db08a09698a19c3faa5647c", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980878, "uuid": "a5dbb4e2-db1c-425b-b1cf-ff2359cfe87f", "value": "T1D431618B492429341303DEDE73AA394CB00D85F768DFCB64DC484EA956881CD7532FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980878, "uuid": "43119316-de48-448c-864f-a1d606dd0819", "value": "12:U66kqszAz6O76813U4M6+3mOyGNg6N3YtnXV2EI62EaPllS6divR3YWNb6NOGu6S:rcSmOUX9TQTyRIUM9/f/Az1k1Nyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784980878, "uuid": "5bcb2941-c11b-40ac-b216-0ccaefbce2af", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784980878, "uuid": "3f05b4ee-f186-4a0d-8d3d-3961408dd8e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980878, "uuid": "b60a7f7b-edfd-4c93-a03f-64652393cf67", "value": "730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf7fde1-8826-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784983429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983429, "uuid": "20f78fb1-e47c-4743-bb25-15a2b674558a", "comment": "Malware payload (Mirai)", "value": "c587d2889cea7be54f3f1b97b6c78419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983429, "uuid": "5bed3264-862d-4dff-924f-b17f6a73bb07", "comment": "Malware payload (Mirai)", "value": "733347ef5ccd49fe2e54c3984c81cf95351394a574269b761c01eace403a46d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983429, "uuid": "cd6da8ca-cf41-4b13-925f-2f32cbb9860e", "comment": "Malware payload (Mirai)", "value": "b3c294db6b323dc936d176bb5f72fb2434277385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983429, "uuid": "ef5cf3db-974e-4b2d-8bd5-433370214ab7", "comment": "Malware payload (Mirai)", "value": "ecf848f4ab0c03839fb6a5aaa975c0637f0d41169e9aedfbdbf844c30017c3380db41a53a2b695e5e73f4f73a9e4af94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983429, "uuid": "5ac49f47-8c70-43de-9d0a-9b8940d7c721", "value": "T1A824C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983429, "uuid": "12f3f0c4-34cf-4cbc-a7d5-5ea52f475edc", "value": "3072:PD/6gT7DbU28Mn0NawZ5aMBjv+7GYNRgh1:PDND1f08wZ5Fj6GY3gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784983429, "uuid": "9a9106ac-d516-4879-b177-ea1e3a82be40", "value": 211648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784983429, "uuid": "00a7db3a-bb20-43cb-b0b7-f67df27fe9d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983429, "uuid": "da059fb5-b290-4db9-959e-c8465bf3ebb1", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67971453-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975664, "uuid": "27c00002-fd55-4a82-a142-07d58532c7ab", "comment": "Malware payload", "value": "163b8cc3c59b8b4d6afc3e621c25348f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975664, "uuid": "ea80a60c-1c69-4084-a2e4-35e66ca54ead", "comment": "Malware payload", "value": "7430988645cd104d24cb20e92b2961f1cab53166b17dd6d941c9c15c90d2bd05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975664, "uuid": "41f88759-dfae-49ed-8db8-a08efac45513", "comment": "Malware payload", "value": "e88154c22b2fbcd20cc54cb23981f76e417d21de", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975664, "uuid": "d058ae56-ef03-4ce5-bd38-ba2d66e31262", "comment": "Malware payload", "value": "684e675733ff22d0467c4c5bda744a7f621d3963f7ff5304c842f0ffbd818f6a6faf3c37931949b6edffdd7f98b75088", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975664, "uuid": "1f62d498-8dc1-43cc-af6b-ce9202ceed85", "value": "T1AD62D0C0FA86D933C5BF9972D1B23AC3CAE67D2A9CD221E3D908766016381D14A7521A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975664, "uuid": "2f4f7c91-6fbe-48f2-96d9-2c236bddb0f8", "value": "384:R6qw50Pl33f2XcWoLl5CtDGEZav3J+2/eEXkF:Rii9ewHkav5+8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975664, "uuid": "ce7d5e4f-6ff8-4769-85f2-e6de4cbd8067", "value": 14836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975664, "uuid": "b839a21d-36ae-4039-a17b-ec14dc773dab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975664, "uuid": "70189d06-88da-4c3d-9295-d2df1e22071e", "value": "images_20260725_010429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b62a698-8848-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784997924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784997924, "uuid": "fdf66546-2292-4bf5-9a1f-dfba042c5115", "comment": "Malware payload", "value": "bc012968ed0c0e2c5ad7def7e9cdb5b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784997924, "uuid": "6d90c6f2-a210-423f-99c6-e6251b68f68c", "comment": "Malware payload", "value": "7451f07c6b02ae04a7b5e5a7f73a99a24516ac7b7f87df4cdea73a071764155d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784997924, "uuid": "e897ec48-d26b-45d1-acee-da24ec13384e", "comment": "Malware payload", "value": "4c3291c185f905b0f780d869afecb055ee5371cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784997924, "uuid": "2ee25902-39c4-4044-bee7-30045897d240", "comment": "Malware payload", "value": "b07c3fe45a7b35cd84e03c7b2f241921e4c6c203cf44a14bc586e3573ef2b4fc75855d398af6ffd3d310fb18a00ca38d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784997924, "uuid": "63c76485-a91b-4015-a3d6-5689e7df023b", "value": "T1AC137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C09ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784997924, "uuid": "5e292f96-d309-420c-bc27-1b0bd83a46ad", "value": "768:H+a9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:H+Pco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784997924, "uuid": "156a38c6-4cb3-43bd-8b04-12b981815f88", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784997924, "uuid": "154e5180-640b-4888-9c35-6a548930401d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784997924, "uuid": "697bb974-c4ef-42ce-bdbb-5e868ad47e14", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b776f81a-87ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784966778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966778, "uuid": "1689f3f9-c2f5-471a-9255-5f8d341bab4e", "comment": "Malware payload", "value": "93243e5288e57545790ad29a6beca0c1", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966778, "uuid": "4799e54d-4bba-4dfd-a21c-4ea7f7bfa4a0", "comment": "Malware payload", "value": "745ba63ac24397d876a68cb455a01b9fdef3a80e857822eba893b0c06921820a", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966778, "uuid": "8a5ec496-dc93-4df9-ab3e-b0986a9d5b46", "comment": "Malware payload", "value": "5f20474d3cad69a21ee7f0f0ed876c23cb150810", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966778, "uuid": "a949aee6-6728-4bf5-84f0-19d90d255b35", "comment": "Malware payload", "value": "8f77fa6e715838e4780f1b85c0273ae0ea865ec0dd85faba254485ec5d8096f364d723ca3787fa840d4640946200e00e", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966778, "uuid": "ab6d32ed-6f83-43c1-b69b-f773a28aecfd", "value": "T131D523C978F61AB0C437C3759F82E4FDB13937880AA04E6BB98D29409E535596C3B376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966778, "uuid": "e80d4698-5f05-4caa-97bb-9a455d1c3bd3", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966778, "uuid": "1d6863a4-363c-4654-8c42-e12a24c8df31", "value": "49152:K7W81kL7F6OjRkrWBm/rUYC0sH2ZKIeIwy77Q7YF0cZcwIlArFGiP0ZYBDRGQz1x:wB1kfIrkmlZzeIwyY8FMNWrF12i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966778, "uuid": "0e8b65c5-df65-4452-a821-4b02b07db873", "value": 2931712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966778, "uuid": "e8c85e97-a208-49bd-850c-e398a55ef11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966778, "uuid": "7a8e5f3a-54fd-4bf4-ab2c-7bf4244ebc33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f59424-87fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784966298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966298, "uuid": "0b07dafa-7b6d-4854-b702-877fedbb014b", "comment": "Malware payload (RemcosRAT)", "value": "c29ddb54bb464846ba7e2de1d3eff471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966298, "uuid": "f8c7d7e1-5af4-44ad-a68b-b807ad65eec9", "comment": "Malware payload (RemcosRAT)", "value": "748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966298, "uuid": "bd8e281e-5b10-476d-881c-6fec8637e7fa", "comment": "Malware payload (RemcosRAT)", "value": "49d293bee3fe99fbc0cf857347d9e5259dc41b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966298, "uuid": "6b9f17e2-cbe9-444e-b1be-80bb8d4edbb2", "comment": "Malware payload (RemcosRAT)", "value": "ed5cf94779f614ffb6cdf3de858fa670cf7fbf23f1485a4f5d3ae7fa69b41671c6edf2311f32c73234bea17635fa02be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966298, "uuid": "ef841bae-9683-4bc5-8fcc-8da8adb97a04", "value": "T122B4BF01B6F2C1B2DA7654300935E735CEBC7C21183699AB63D61D5BBD30291DB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966298, "uuid": "81384f67-c6f2-4cbd-b527-9fba4b8ab185", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966298, "uuid": "74626674-edb7-49ca-ad1a-491428aaddc1", "value": "12288:C97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOrys:ClxDmRnkvVkhYHk2c+DZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966298, "uuid": "6b1654af-b743-41b3-84cf-0fd4f4424724", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966298, "uuid": "ac8bab5c-882a-4365-9c29-2e5d8c80a851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966298, "uuid": "3dd36c57-39f4-4836-8f6c-29b48f5cb5c5", "value": "748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5f41f1-87ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784966706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966706, "uuid": "a44a6ed7-ad04-427e-92c2-3338d7c62d92", "comment": "Malware payload", "value": "462c2f27d91ba601438f4997e3940fae", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966706, "uuid": "035f7ba8-8174-4a7b-a107-3ea85387d1af", "comment": "Malware payload", "value": "75338e51acff92703ce4bf8fce411c46ab7af04819e5f003755cfea6e6f0b2da", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966706, "uuid": "2ae73097-edc3-467e-9728-687299a7373a", "comment": "Malware payload", "value": "e9fef6a9ef5c5312b2b2cc8266e4e0c2a466a041", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966706, "uuid": "8c7ddd5f-b532-4887-b266-f248ec597254", "comment": "Malware payload", "value": "e8c43266914fb1ecd1542736f2df16252839f12bb0685bef295aa923f1234553682805e79692d5b3f8a0ecc4b362a1fb", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966706, "uuid": "4f5357c3-6926-4731-8b9f-ff99db81e5b6", "value": "T186D5235DB4F259B8CC37C7B68FA2F17DB0657B4987A88E9BB2CD29004D221485C3A375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966706, "uuid": "635963a0-75a2-4643-8168-c567eea6b86a", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966706, "uuid": "330c5963-9124-43ac-821b-3eb0466c0b45", "value": "49152:ZWpeLGQRxJKfd7I56Ti6ttTixLbQMrKCIAYl4gDIBphsFZUGoaN9ma:EpeLpRqJI56m+tTitbQMYleDhstz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966706, "uuid": "a00b4fb4-8931-4928-b345-1ff3d0f651f1", "value": 2966016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966706, "uuid": "c66144b5-3db2-4a06-8bb7-24794dec13ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966706, "uuid": "2303a5a4-db69-41c6-8f8f-4bfd415bbede", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c681840-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973954, "uuid": "cf02104a-0564-4f58-923c-cacdf4bf3aa9", "comment": "Malware payload", "value": "8346647b4b70c9db864787ffb9d542ec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973954, "uuid": "ac74bef6-9d67-4b4e-a8bc-18634d4c7d9f", "comment": "Malware payload", "value": "75e58444958079b49e40e6632ebeedb6fb34893074f054e95334b3403dd0db41", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973954, "uuid": "2ebb192d-ac3a-4ac2-a0e0-0ec7913fc704", "comment": "Malware payload", "value": "dc76e0b306fd9cf62dfb76b1e27e0a4f679aecaf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973954, "uuid": "96b07ac3-6ce8-46d1-a96e-11f4f0359dd7", "comment": "Malware payload", "value": "8f372781387ae09da8f931444a5c06826e7b4aa6f534ccba45e133aecd2bb8f78fa7d0087427243d29e693d9fb059093", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973954, "uuid": "4e9ee156-9c6a-4448-9b7d-6eff708a99c1", "value": "T1FE06BE4AFB489B6AC0F3923A4C355A61411B8CA68F43D7837D64773C58BB9D01E5AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973954, "uuid": "4cde5553-6f57-467e-aebf-202ae9337eb0", "value": "98304:EV1ij3XV+9zNEhggTXi30wFvgFnsshK62D:EVFkuWJw0p2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973954, "uuid": "cde4f17f-4a28-42b4-abd9-880a71b6b9ed", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973954, "uuid": "aafddc31-603e-40d9-928f-31b2b1723ac4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973954, "uuid": "e9af6a99-b2d6-4b96-a347-961f11e0b0ce", "value": "variant_08.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb70b6f-87d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784947302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947302, "uuid": "6c68cc22-617c-46a5-9057-9912171a3689", "comment": "Malware payload (CoinMiner)", "value": "50aa301c3d0e992be3807e3141a3039c", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947302, "uuid": "6a5d2c3a-68f6-4904-9073-b0cfb0f66bbc", "comment": "Malware payload (CoinMiner)", "value": "76da85ad5be21209b93a67040dca0e5fff144730fdff49ec8447b8b2b3dca7a2", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947302, "uuid": "68add8b2-766a-45b7-a021-3c63ccd50f8e", "comment": "Malware payload (CoinMiner)", "value": "f8fda401095e16e54af74a1c4edaf85536ec6c7d", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947302, "uuid": "9963e3c4-abbe-4b48-83d7-419065b0575e", "comment": "Malware payload (CoinMiner)", "value": "083b03d8a2eaa7017c7706a4d2c728d270cfc78120d50e59e0188a16d3d29f4ca96e067066fcb9f19168e86a9a19d061", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947302, "uuid": "39b13dab-685a-438a-8be5-52af57cd0be1", "value": "T1EC36339AACC6A4B4D896CBF8414BB07DB67A7382C565BC0375CC2E185D9BF04143DBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947302, "uuid": "85b59566-f5d6-4c15-a10e-22b6d5aa2bd2", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947302, "uuid": "4462c30c-5605-4d1c-a77a-28944193f618", "value": "98304:sSbMyWcaPypYWfJzWlOOxgJY3F9eg9FlBGiy4aX+1/7l:sSbKRWhzWrxgJY19r7AQaXA/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784947302, "uuid": "b680f24b-5fd3-48f8-bea6-9b26f427b0c3", "value": 5250048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784947302, "uuid": "fe5b460b-b5ca-49d7-a420-95cf04188f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947302, "uuid": "5cafa417-fe6a-4a74-af9c-ab3c131fdd42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf04e2c-87f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960880, "uuid": "42d18d5d-d5f4-44e6-9437-2a64433868e9", "comment": "Malware payload (WannaCry)", "value": "b8d3dfe5aff8f0c8955038c174e70195", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960880, "uuid": "763e085f-fe42-473f-ba63-cfc607dad4c0", "comment": "Malware payload (WannaCry)", "value": "7949631d3490ed9fb6b63aff678f7b203df719fe75e671ea16975c6b873010dd", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960880, "uuid": "b5f7e421-8a2b-4e7e-94c8-ff3c4c6ff11e", "comment": "Malware payload (WannaCry)", "value": "c480d041069d0c65ffd75eba89ce1135c7b91ff5", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960880, "uuid": "0b706d4e-7393-4519-8908-dd39f27b97d5", "comment": "Malware payload (WannaCry)", "value": "64bd332a290077324fb652fdf0cf05498bd03a85c25ec80246fec34fdc8a1acc1c4c7efd6b162a1e578427c0221c0fca", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960880, "uuid": "8d1ccf78-f55f-46e5-bb09-b3ba0300dad4", "value": "T13B360211A2EC6728E7F35EB1267B8720473A7E8A9957921E1364514E0C33F5CCEB1F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960880, "uuid": "41433c60-fa49-42f0-ba88-f2848eb622b0", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960880, "uuid": "ff9e3bc5-a259-4e7c-a577-3c4882c57e09", "value": "98304:Dy8qPoBhz1aRxcSUDk36SAEdhvxWa9P593Run:Dy8qPe1Cxcxk3ZAEUadzRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960880, "uuid": "1b8b60e7-a49b-495f-ae2b-55848c0a74a2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960880, "uuid": "bef6cf7f-9e98-43e2-a934-06b2b5afa240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960880, "uuid": "ac5ea234-3c5a-4ec6-a2dd-7a433bcbfe21", "value": "7949631d3490ed9fb6b63aff678f7b203df719fe75e671ea16975c6b873010dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b844ec-8830-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784987631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987631, "uuid": "411dd2d7-9a3a-4d6b-8d75-a5926c6388ab", "comment": "Malware payload", "value": "bf3518988de65edef69dd62e5a9eb6ad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987631, "uuid": "5184e0d8-ba9a-4621-85f5-fd00dde92c51", "comment": "Malware payload", "value": "79f4b0b4e953f24a92754b51182463357e3484e4ef0635c000145b0228a628d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987631, "uuid": "609be8f9-1770-4099-9489-913f774f719c", "comment": "Malware payload", "value": "03612e5366c4b7c519f85f8898806ae1bbb2949e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784987631, "uuid": "52f8fbe9-981a-4f9c-9e03-65eacba0bcba", "comment": "Malware payload", "value": "b8d7397aec046caf11e093dd2c2957199b02a41685ef21458e1fb143fb3655505f4d7a8feb5feb58fbb7cb020a6424de", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987631, "uuid": "ef591153-277a-499a-8162-8451919ed213", "value": "T1B93143CD10B06962D74DCE01F0F697C4A246E9E472E01BBAF8C12C72559AEC07C52B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987631, "uuid": "ba884dc5-9065-4dd9-a3ac-ef2f9b8482ba", "value": "12:rkfV0dtDNaKc6JODOmXSfiUK1vk1YfVb8Vb1LBNN07N0KvtNce77HLBgChwlD+6X:ofqDFaDzXiKlkWq/272MtjHXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784987631, "uuid": "dc5cb2c9-1e36-4466-9412-7bdb0856477d", "value": 1470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784987631, "uuid": "9ed3b2c1-26b2-4bee-9152-37c2dc5204be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784987631, "uuid": "13462d88-fe8e-46f4-8d44-4747f7d444a1", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d98b045-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975325, "uuid": "d5919a39-0f47-4da2-a5ca-621214ea5088", "comment": "Malware payload", "value": "5bd454c6a85b8b4603816acfd86dfe93", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975325, "uuid": "46cf2f62-6fb4-46e6-b06d-af9f85e6381c", "comment": "Malware payload", "value": "7a0588b896d1b67ee280cd2e61449e33c408c02be6d87570ad23ee00ef537d34", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975325, "uuid": "0510d687-ed8a-4f17-bbe7-0614943f3c37", "comment": "Malware payload", "value": "3fc60179cfd0b55ea490aba969428bcdf61ebbab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975325, "uuid": "3de92f45-ddc4-4fda-af88-b05bf3ffd3f4", "comment": "Malware payload", "value": "295d41f12de0af6d5df53b8a300864cd9ec6b6b280315447b111e24620d141d6a68392c866d1ce5fed2d6b1924eef9b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975325, "uuid": "b10ea128-f1e3-4283-aa3b-9a2f4781b7e7", "value": "T1E852C0131F2301D6E122E3717C6BF9C391C022D1602ED5AF7C9E5B7E8A44A72B90795A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975325, "uuid": "f901027d-7558-44c0-81fb-4941deb90d00", "value": "384:BRCb89dVUAf8euqUeE/olU9rc1MOxsddC:BRCb893Ulq+olU9rc1NSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975325, "uuid": "eb994bda-f4cd-4cc0-a229-16877565294b", "value": 14400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975325, "uuid": "f5416106-2010-4dc1-8980-09dd45aa9660", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975325, "uuid": "5dd99886-cf3b-46c4-8c4c-9a05fed97923", "value": "images_20260724_125101.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a51f550-8807-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784970058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970058, "uuid": "287c30e5-ad6c-4131-a3f9-856bea501992", "comment": "Malware payload (ValleyRAT)", "value": "8fa335df29a65265e791f22f053200b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970058, "uuid": "0be36bc4-8f09-426d-96f5-3cc89e009cb4", "comment": "Malware payload (ValleyRAT)", "value": "7b16b0dda74cc8410364fd32d1b16ec9d2961a77dfbc6167f4bf908904e92a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970058, "uuid": "e351916e-bb92-4198-9703-4743f88359e3", "comment": "Malware payload (ValleyRAT)", "value": "a3092d70c8380f0fe0fc7cdf3acaae3df0c75fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970058, "uuid": "65692deb-2ff7-4e33-ba49-64862b3d0218", "comment": "Malware payload (ValleyRAT)", "value": "64729d1c52f92bf58f7314918749fee3082932d4439beddd034273940b33146a5cd19093a0047136ece0b15c9b5d0d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970058, "uuid": "9a85e81c-c0e8-4842-b7d0-8c6ddd8c1073", "value": "T1FD959E4BB3B400E8D1A7C178C516560BE7B2B45517609BDB46A4C6EA6F23FF21B7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970058, "uuid": "b6592a58-c420-4fa2-a4cd-3da3c7b512cc", "value": "73ae46a1e861386755d3586c2776a64b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970058, "uuid": "f1e35392-4203-4032-a26c-e30608d88d38", "value": "49152:kSqMNPfUyM0p50h9Vk9mLQXDUJ+hTQb+f0:/pA0cwmLQXDUJ+hTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784970058, "uuid": "c98d9f0e-0237-4c76-a0cd-8785643e0c22", "value": 1881088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784970058, "uuid": "e157c696-f5e9-4187-bb2c-09d5ac745965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970058, "uuid": "ad562587-0c5a-4936-9970-f36ff255af8f", "value": "SMS-Activate_\u63a5\u7801\u5668\u66f4\u65b0\u72487.19.06F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5399ad86-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975201, "uuid": "25cff90f-7454-43f8-acb7-2dcf3185f445", "comment": "Malware payload", "value": "d90ac70a006d5ab9a03b9de02c0b041c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975201, "uuid": "ea071ebd-07ba-4cef-b8d6-62902c34c738", "comment": "Malware payload", "value": "7e86d2e6aa06652909d4a7e754f8ff5d2908a93d63bcea204e870fb4c1e656be", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975201, "uuid": "366aa643-0380-4a22-b783-b515ad7d3d3a", "comment": "Malware payload", "value": "495b912cfe0dba5a4725ca7d6f3e61660ad88559", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975201, "uuid": "71129fc0-ead9-4e0b-8c82-7e564f3e009b", "comment": "Malware payload", "value": "0c9ce215b2d15c3f71861e392f997c84b347e7608d9075eec38a10e464422e08ab6c0ebb58a0575f487e78fa1eb2db2e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975201, "uuid": "049ec669-e3ef-4161-b200-57257885f9eb", "value": "T1C251392B82283142DEBB84318C9D9C85BB6850F8A92BDEE5B59DD0ACE536D0206135D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975201, "uuid": "a60f68d9-3ba7-457e-856e-a0d2e9b2061b", "value": "48:9WrzNEysGx8yqnSGjzPic8uWsRJH9HSSScYGmGKONB9Bsj9fdo:wrzNEMxTqnnzPi5DsRJH9HSyYzGKOZYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975201, "uuid": "143e5ae3-71f9-4613-9539-514cfa9a6d25", "value": 3147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975201, "uuid": "41ffa015-de98-4efa-947f-16543e894890", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975201, "uuid": "114bde54-3ed2-4796-b6ea-66deb01bba8e", "value": "images_20260724_215416.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0bf676-8823-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784982226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982226, "uuid": "a2fb32c2-ec8f-43aa-93b5-132a5848116b", "comment": "Malware payload (Mirai)", "value": "f874595b326b3165f1c6b2201f0304b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982226, "uuid": "f3765b2e-3102-4ffa-84c8-0edc4843a9e7", "comment": "Malware payload (Mirai)", "value": "7eceb77b5905f02f225cec47f74b7b6ad4165b974ccf42aac7f7c729438b0896", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982226, "uuid": "b7fae853-84ef-4aed-92db-29fca0a6e1bf", "comment": "Malware payload (Mirai)", "value": "2d436fcde272a95b1e82ce7b578a0d8ac2250a93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982226, "uuid": "2cde8cf8-d7aa-4167-a823-b650b6afd08d", "comment": "Malware payload (Mirai)", "value": "d3b5510a176a1a907f393c1e0288484aa4ab1ff929ec478926e678ef5233a7e922b33c6d600f7c557c251e06ebbac494", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982226, "uuid": "953d8485-1676-43e3-bb69-38b3413de5ad", "value": "T19A4172D973E2A2722CB9DDE3BAE54104719C91D7B8CB9F2A54DDB8EC445DF4C6040AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982226, "uuid": "25acf422-9a38-4969-979b-5754d46161e1", "value": "12:JCkp0FXatkX0Fq6Xx0F2TiMT4EO8lo0F/SiX0FyLgxjaO0F0i+88HkX0FqOlvv07:ItHs/i6XCOJKcL058MkstUMaPrVCMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784982226, "uuid": "a4b35ad0-f439-4ff8-9683-71c0adc8212c", "value": 1997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784982226, "uuid": "e369c7c1-2f22-404c-a125-4192f8ace82a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982226, "uuid": "0ecd7e56-31ec-448c-84e6-de4ed20fca84", "value": "awoo.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdcd032-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974738, "uuid": "b96bd022-25a4-40b4-97f3-a02e4e5b109d", "comment": "Malware payload", "value": "40aefe81a240d4297144fb8de9413c6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974738, "uuid": "59e70326-467d-4de8-98e2-239a275039a9", "comment": "Malware payload", "value": "7ed7c1ada9f7e47b423d2d0ac5fab7db29ea1e99a93d5659f0a2b559c122a542", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974738, "uuid": "2664bf5e-dca0-461b-8283-eb9cc4181f3d", "comment": "Malware payload", "value": "2a1e0084f5accf2503b1bc9b38089f2b700cd702", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974738, "uuid": "f3ac9c76-9cc7-4bb8-99ea-5ed766ef40bc", "comment": "Malware payload", "value": "76c51f0ccd88531457dd92d5770bb6a145342787d60b5df68c2976d287404cb29d5e29961134c0a3a03548fb3fc4e1ec", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974738, "uuid": "e61eed64-3318-4a1d-81d9-8d8e6b95dff1", "value": "T1ED32C0076C6107035043DABD7022AF2FDA8F62591298A41366C78DBDB16A570BB837DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974738, "uuid": "b0fd1c0a-5ddb-41a7-acfb-4a8dc73dec24", "value": "192:a+pzIB6GPkvxjy6Ny8tvMxgqLHFyhMydSWw52ct29AZWW7zYkebM5GgDVx8gLoiR:a+C6G6by8uDIhNd5w72az/EUVLj4lVB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974738, "uuid": "4ed4f50d-2a03-49b1-a535-62a0a49b9e86", "value": 11969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974738, "uuid": "f81ed59b-08cc-44c4-a6be-973a71f7dd33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974738, "uuid": "24316baf-6593-44be-b22f-a38c7171ec08", "value": "images_20260724_203525.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317c55b0-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784976862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976862, "uuid": "bffa35cc-22e0-4cdd-b9f4-acf9894f67f4", "comment": "Malware payload", "value": "0fe2a01dc88eafc8530119885d4dbec6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976862, "uuid": "3e613e9e-2766-4955-90ac-aeafd9f84a31", "comment": "Malware payload", "value": "7f348c1e4ee6c58f50e0cadd09b4ce8f0336cd968cf62b05c14aa7f78bdb7845", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976862, "uuid": "f6a84e29-14d2-435a-b4dd-8311c3d98e41", "comment": "Malware payload", "value": "d6db6c0ba71d8f33b8fb34df8dbab567ef61529f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976862, "uuid": "313c863a-88ee-4bbc-98cd-1f5d88d6a6d6", "comment": "Malware payload", "value": "f7a844548ddaec0122475e174f0699fde23047a225ca627fb018f03e0006801bbd54634b5246f24864898694d4cd3bf1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976862, "uuid": "cfba5742-f1ff-4ade-a564-22297bd58c7e", "value": "T18B64F78863CEB450117BBCF76AF26151FB589CA1D14850E4FBD477AFEC903398CA9A24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976862, "uuid": "eed0a9eb-5ed8-452a-b5ba-6fcc1783ceb0", "value": "6144:NyxhaFYCQEZh9a0As1mLXaZU7aGGdLFnXsBvOXfGqPa0:ya3Gx74MvO+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976862, "uuid": "ab36c5ee-e08d-419e-91de-f56f0509eba4", "value": 311832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976862, "uuid": "ad818376-6965-492b-89f9-99db1c62bffc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976862, "uuid": "c0394257-c75c-473e-a75a-3a420a17a479", "value": "7f348c1e4ee6c58f50e0cadd09b4ce8f0336cd968cf62b05c14aa7f78bdb7845.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0b32ae-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975646, "uuid": "8a2a8737-30aa-427b-b12a-7d7d1b967349", "comment": "Malware payload", "value": "8cc0938a0ccb16fd6475891bac3e6ea7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975646, "uuid": "dbac2a08-877a-401a-89f0-1c96d6a5c2a1", "comment": "Malware payload", "value": "7f9a59eb2be88c3a8029535088fc408651776018f63eb74e9805002040d41521", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975646, "uuid": "d59d45e4-7c97-442f-abc7-04b7d7c8b69a", "comment": "Malware payload", "value": "30592827fcd995f409d18f8355cf08f86e559673", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975646, "uuid": "3cfa1932-19d0-41f7-a656-e1b5c7ab3e8b", "comment": "Malware payload", "value": "5158ed329019cefe174ef3ac2c02ba9b2539ac4a7a5d3488759f978c4a9f911ebf6c358e02a057aaf7462b63fffd85d2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975646, "uuid": "65a9fd61-817e-4d02-b537-fadd0ac4f05a", "value": "T11D42A01D23324A12BDA9F53C351FC61E5F1C1153EC1FD52087D5E29D78333A624A6AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975646, "uuid": "0df8956e-efb4-42c3-9873-ef7394835161", "value": "192:Yr8nGuqK5lQETAMpbrJPpxAqepG+ijTVGz4TCkRRIUC1IZ9mXXO/j+P7CK:YYGNKnQErvJYqepG+OVtwArSPWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975646, "uuid": "be8129ae-4500-4f98-a8aa-831c311ed2b7", "value": 12328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975646, "uuid": "d339f8e7-3977-4c4a-a04f-75480dbe09db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975646, "uuid": "4cfd304c-93a5-4de5-8929-083ac6b7c577", "value": "images_20260724_115828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4d4ac2-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974843, "uuid": "1116ec07-4aec-4cf8-80cd-1fe5f827dcfc", "comment": "Malware payload", "value": "d374717059889fffafb03c4aea4ec5c5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974843, "uuid": "dfa4af54-7b6e-4efa-9cd5-bb402d3e5f34", "comment": "Malware payload", "value": "80dd4a4507597099734217224f714ac58c4d19a69f866bc9fa14e13ef0d47f8e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974843, "uuid": "d1d5c696-d1e7-4d52-9a6f-8022c9b5b7c7", "comment": "Malware payload", "value": "8723cd07b544412711a5996c0dd5be6556285b84", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974843, "uuid": "e95b1efc-c636-4d29-a255-3e3f24c008f1", "comment": "Malware payload", "value": "759d573240dc2e42467e490830325f49f4e15c4ff6bb40c088dbb4d5782322845f896991e22b0fc27a7486df8fce703e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974843, "uuid": "e451bb68-09e5-4bb0-aec1-9430d26a359c", "value": "T1DB816D2F5BC7837BCB5E233EDC7780A805249170C5879B8582F6BC4A32A05C0190FE28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974843, "uuid": "798559ba-8a76-4133-ada3-417e52807468", "value": "96:ycDM7lnLZZEZ5+RlVYFyYcMXQazhvt/hbL5AuZq8V7dm197yl4REw:ycDMNZZEZ5+RlD8xzhV5bNvq8RdmX7gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974843, "uuid": "c73ae931-ac7c-4133-a0cd-b8704e57a90b", "value": 3976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974843, "uuid": "69d9e583-600f-4887-8cc7-c2893777fa12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974843, "uuid": "a32c0eb3-48fc-4db6-8165-2f5c12bd5b75", "value": "images_20260724_113156.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b525d43b-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784981807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981807, "uuid": "991d7b23-501a-471d-93e4-50c2b593ba47", "comment": "Malware payload", "value": "eb4411c70ee41e6e46c99e43f312a80e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981807, "uuid": "869685e1-50d0-4e02-804e-29665a13bed6", "comment": "Malware payload", "value": "80ebbee570985451d98e67e9a40b743636ec2794d8a311fa34e0a8a5e3b4b986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981807, "uuid": "fafc456c-9409-4296-9374-4bd0a8d6e785", "comment": "Malware payload", "value": "5199a12b787593881b894daef48dfcc3e41d48c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981807, "uuid": "ed8d32fc-35ea-4c1a-802a-5158524b1cf7", "comment": "Malware payload", "value": "9dedfc9529552c3c8bfdba8ccb6b3963b9416b7403655df9dc957953de5281bbed43f6898f6c347f6bddc90b889a44c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981807, "uuid": "022bc834-9fe1-4f95-a1e3-3a5f53a9f764", "value": "T19016337451B0D8377145BF771D76B8553B0A8208317A7E2A27B1E9ED012A81B3F0BBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981807, "uuid": "36bcd9dc-b141-4d3c-ac0c-dd2f5e0fffa3", "value": "98304:ZWZhEHiXLOqg/wRFLZJsAvifBSfSS/vgm/+tE1Cpr:IZXrtlssfvvgXS1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981807, "uuid": "ccb19ae3-192b-456f-a490-a3d8c318c9ef", "value": 4268158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981807, "uuid": "6ec5d924-13f2-4d18-b00d-29ebeb8ad92f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981807, "uuid": "9829d1d4-a707-4103-a79f-f6c8b25137cb", "value": "perc.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d126d52b-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975841, "uuid": "17210dda-5cf1-4eb6-a931-e5fdbaa38611", "comment": "Malware payload", "value": "a5c9e501422aaabb4017bc42e033b83e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealcV2", "colour": "#AF61C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975841, "uuid": "010656c0-8db1-44e3-8114-5b36dfad9f75", "comment": "Malware payload", "value": "813f98fa393632b4a6e50d5ed613cf0716732bf159687dd5380794f7d65e7115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealcV2", "colour": "#AF61C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975841, "uuid": "b6281825-18e4-42ae-807a-56b78bfd4d81", "comment": "Malware payload", "value": "bf9fddb8a0f10ced61de4a017b53e66111b75039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealcV2", "colour": "#AF61C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975841, "uuid": "db174b46-b9b1-46a4-972f-20aaca1275a3", "comment": "Malware payload", "value": "917f54a5ef4acf6aeb0e939356f81565f166562cc4a62621e3e62e96a0615fed6c94a3aec972cdd521abe360da08db66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealcV2", "colour": "#AF61C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975841, "uuid": "d96d4a0a-f768-49fe-9724-0d3395986ddf", "value": "T11AF57C07FC9149EAC0AEA33189A75556BB75BC081F3233D72E90B6782EB2BC06C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975841, "uuid": "2c14f95a-8634-446c-8af4-b37731b5954f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975841, "uuid": "0c9a3712-99c4-4bfe-880c-fbe89e823a8d", "value": "49152:x1OCdQTieTUKWn5S+cblGAgSN2uUxSbWgrXF+1pb25oT3n9nvglnKbpE99II:x1bhQXMjBv9yoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975841, "uuid": "8e023172-19d8-4178-8901-be1d2491aa1d", "value": 3331920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975841, "uuid": "d074cb94-1120-4880-a3d7-8bf4cf4c942e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975841, "uuid": "4add6048-a4b8-4847-9e95-17ccf0d6fd92", "value": "QuickFetch[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4843bfc-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998637, "uuid": "1d7c3a5c-06d4-4960-b2b1-56c8fbad7deb", "comment": "Malware payload (Mirai)", "value": "a8a8b4cee3275afb06c5cef2003b55d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998637, "uuid": "26460550-c782-436b-a6ea-6f8236650a21", "comment": "Malware payload (Mirai)", "value": "8163638bf3fc8356f3fed714b003ca5017e3837c759497861c82aabdf6de5074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998637, "uuid": "e1f1072d-ee83-4e27-af26-d6fd48b1b56f", "comment": "Malware payload (Mirai)", "value": "a2456d8b341a92875c61b1d92528872994ef0ba8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998637, "uuid": "3602547c-72d2-4342-8fee-c48f7bbf1499", "comment": "Malware payload (Mirai)", "value": "b38183a72669c7f7ec91bf62e8140f30c2434b81aef401c843bbdd57c52d88c9d47032340836d9ecadadfaec5f372508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998637, "uuid": "86980d31-a6f3-46b7-8151-6707b97e874b", "value": "T12323F1B70233D728C1756DB14EAB67C4BB996953BE1247DE51A100ECEDBFC7C8221A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998637, "uuid": "910cfa9c-8cbf-406f-9bd7-bc5ca4948a4f", "value": "1536:zdoBwyWBscPsfgXw0VM3fd23U6zI9idzDc:wwyEscPsfgX8fd2qSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998637, "uuid": "ecef4b2b-72b9-435a-9a64-b0b4099eb4ba", "value": 50064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998637, "uuid": "9c640ccd-fe0f-48ba-85ac-d759ece145f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998637, "uuid": "d2280ac8-d302-423d-a6b9-f41e3b115b81", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1032cfdd-87e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784956190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956190, "uuid": "b4be5dd9-a8bb-4d1c-be14-19a9b059c18a", "comment": "Malware payload (Prometei)", "value": "ce521ba6bfde4cb66b393d64a6661a84", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956190, "uuid": "313c62b8-7631-4771-97ef-29eecf2ed0d8", "comment": "Malware payload (Prometei)", "value": "816cfc27b4b97cac7493d355ea0fb0f111d57db0fbf611b0aa8819e0ed9c0044", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956190, "uuid": "75ba9d96-c45a-4649-a872-0d1a4a4c63f0", "comment": "Malware payload (Prometei)", "value": "93157e6d6093d96ac2bdfb2e8a683187cfed41e1", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956190, "uuid": "780c3e5e-683c-469f-a174-7aa5dd13c0b7", "comment": "Malware payload (Prometei)", "value": "875cb6e6d4f90227e8c570fb16a99aa334756489a6756f9d704bfa417c2d36663a3028325da9d0a683a084c84d79960a", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956190, "uuid": "b5e7312a-0bc6-4efb-a315-9c608cefacdb", "value": "T18E41BFCA7A93D971D7C7C4391FD6E101E35624430595A998B08EBC303F6D120FCB1E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956190, "uuid": "c51b0549-e24e-4981-aeaf-d3fbff6ef2b9", "value": "48:ZVdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:7dnIu2mQlGaL2nKI3QaTGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784956190, "uuid": "17940eaa-4c9e-4dac-89d9-39af29e23f34", "value": 1970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784956190, "uuid": "5d2cc666-e7e1-4429-b98c-2828b9d68441", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956190, "uuid": "49286419-88c7-406b-965c-9eb0b4ac3747", "value": "816cfc27b4b97cac7493d355ea0fb0f111d57db0fbf611b0aa8819e0ed9c0044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590bb9cd-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784939132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939132, "uuid": "c4b22777-8bc2-424d-abc6-0a065561be28", "comment": "Malware payload (WannaCry)", "value": "7ecd3b8fbf1d5242285e253d9910d1a8", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939132, "uuid": "8c5c8451-f6e8-4449-904c-dd117bd7e20c", "comment": "Malware payload (WannaCry)", "value": "8429bc3f819bae0b2aa65e741a533ea216b257a08c1741000185ef547f528531", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939132, "uuid": "cf8dc716-fd0a-4dcc-8dd8-6c132502ae70", "comment": "Malware payload (WannaCry)", "value": "1c7c0abca29c38db340f3912a342838c6f8d2049", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939132, "uuid": "5e0ef3e0-3033-4aeb-a4a0-5db627e7dd78", "comment": "Malware payload (WannaCry)", "value": "f74e7f42e0a50cae80269f9785358f6840822547b239e67f97e9b0d6d3fc39a617e19d909a8067837e7c37832bd47910", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939132, "uuid": "eb838b07-d172-4f93-8a59-6517d8e62b1a", "value": "T15C363358726CA1BCF0450EB444B38E1AF7B37C5967BA4B0F8780866B0D53B9BAF94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939132, "uuid": "51ba4f0d-5041-46cf-a8e2-35519be6bb1a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939132, "uuid": "decf78c4-317b-4e2f-addb-87cf5ebbee80", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DI8qPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939132, "uuid": "62a9d49f-bdbc-4c9e-9ef3-d62ef6d65505", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939132, "uuid": "3adc1ee8-6a65-4062-abc6-51d7a1cda792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939132, "uuid": "13205f71-33da-4bac-bdaa-28b9c67fabd5", "value": "8429bc3f819bae0b2aa65e741a533ea216b257a08c1741000185ef547f528531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57177738-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975207, "uuid": "0e901ae1-325e-420b-93b6-168497b74cdc", "comment": "Malware payload", "value": "688ca902e53d58cc1c58c22127e6e756", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975207, "uuid": "7bdc3f66-79de-44c0-9fe1-2578bf4eeb86", "comment": "Malware payload", "value": "8493a6018559de8ad89033fdf8fbe3cd2196184db50d15bffa5f7b717971d221", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975207, "uuid": "ec88f93e-ce52-43f9-aa91-4be1340e5375", "comment": "Malware payload", "value": "b35108df5021c545d317ae5ad4b776e62d17e142", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975207, "uuid": "e99b19f2-2159-4611-be86-574464c884b1", "comment": "Malware payload", "value": "2c063baa5a9aef166a55f4a6e816e0329d30ad89d98af024dc22f76688177e16326ff8661dfcf6839b70d8a9513d46b7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975207, "uuid": "f41048e1-0aa5-4b34-a92d-6a80fb785a38", "value": "T195915BB3BB4B8F6BDE9342FC83C368650B1C268B65952647F0BFB71A260B127025854D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975207, "uuid": "e31fdba0-d5d5-4b54-adff-68095b00d9ac", "value": "96:FIizsPzi34hniuBtugxNjFl1iEM+7dvDc/IlGn8Kce9HPIP:S96uBRZu0dbc/Ic4e9wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975207, "uuid": "84ef9d5d-f564-48e9-ac12-c65b15ae3141", "value": 4235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975207, "uuid": "a1a80589-0f60-4028-9908-4fe5c3414ff3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975207, "uuid": "2e62d1be-4371-46d6-b637-58302a38b8fb", "value": "images_20260725_061954.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51904d68-8834-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784989371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989371, "uuid": "01ee5f0a-213e-428e-957b-3a1a94a6a1bf", "comment": "Malware payload (Mirai)", "value": "7abf55cc3a96d09c0b459294d8fae5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989371, "uuid": "6a7a6dc8-ddd0-4d4a-a04e-358353d195b6", "comment": "Malware payload (Mirai)", "value": "84ef2bc2bd5bce94bb909d9fa21c7192acc199e9d8a07e1b9419584638b10354", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989371, "uuid": "6195c369-0358-4213-8c7e-4621a3ca88e6", "comment": "Malware payload (Mirai)", "value": "4d628e2bfd1324f760fbeac6b1653d594723c5f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989371, "uuid": "0aa6d641-d827-44fa-b6c9-fde086923af7", "comment": "Malware payload (Mirai)", "value": "0bd0310a39d2f2b7c03470420016471a6805f9949053c15e75a234a21a4266d0fef7b7ec76a570fac51d59153c175786", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989371, "uuid": "e5415ee5-172d-4da2-8cfe-61e975a2e3fa", "value": "T10623022352D4D64CCA3F74B8867F32CA5DB86C58E64C60599CADB14BC9E2F2C2609B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989371, "uuid": "bcab2354-059d-4ead-951a-4f462844156f", "value": "768:VsXZRefUEQQEVPsw/kx7u+4E48hamub/IrQXbP7b9QGLU6JZ6qYUnbcuyD7UHQRe:VsX/efUhVPsw/gu+4ENamK/kKbzb9QyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989371, "uuid": "037360a3-eb93-49f5-8a1c-5ea4208f7209", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989371, "uuid": "7b943e2b-9737-420b-a774-76e7e67658a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989371, "uuid": "1052d818-a923-434a-9baf-13549894f74a", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6042a8b6-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975652, "uuid": "020316e4-67db-443a-ad33-26e2c6f6a76b", "comment": "Malware payload", "value": "e86cfd96fc8c41767fb9661d3c76cb48", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975652, "uuid": "6bd30e35-b8ee-47ca-9376-1ae6ff725645", "comment": "Malware payload", "value": "85ea459233508ff640d2906fdba5b50fa539c0c2bab97268270cfce80e9ba213", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975652, "uuid": "50d2db07-2814-4549-81a8-6f52f18650e4", "comment": "Malware payload", "value": "b4fa891353e81fbd9c602dfed01c88a4ba542504", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975652, "uuid": "6eaec48a-1c25-4982-8539-b3ee22cd3d53", "comment": "Malware payload", "value": "a99673d5c897cc9484801a657e46bb6daf1536a5aabf6d0345da3dd3ae652744338a435a81f616a4bef72d2e7f59f40f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975652, "uuid": "5c9737c1-84fc-4dcb-a88b-e61492923c41", "value": "T13D62D098034052F7F7EDACFB97E689AD36E1DED998D400FA1A68878598A3710C4C7E14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975652, "uuid": "d66d506d-24a8-42fa-a2bd-41b5becf1a90", "value": "384:gycp6OmEyTXThcLjIs8k/ZbWAtjF5rWHGLmkzdZVsxkcz:g1mESTa7Z9jFhW+xsxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975652, "uuid": "e1d46eee-95bc-47dd-908f-405cabb2df8c", "value": 15270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975652, "uuid": "19a143ea-7c41-4cc4-9bec-84ad964eb5c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975652, "uuid": "f04b1fef-0b43-4ce7-9307-ab333f2b1bdd", "value": "images_20260724_160653.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac729c4b-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975350, "uuid": "a9604d5a-8e47-400d-98a3-8f1c9347bc8b", "comment": "Malware payload", "value": "f320ec3e431643241f7aceaa4467a6bc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975350, "uuid": "09ace17e-888b-4692-ad33-cd2a9bf5c0dc", "comment": "Malware payload", "value": "85ff7c9dbde01719d0d40980dad9d4f9f869e47f5dc48a9500f5d49a91d1aba7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975350, "uuid": "538769d2-c299-4150-a9e4-5b0da3fb524b", "comment": "Malware payload", "value": "4dc5d1669df004be0742479f3bb2e2f567d86033", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975350, "uuid": "c116e5c5-9237-491d-b053-d7adef5f7468", "comment": "Malware payload", "value": "778a67d5f8611e45ef87f923a720463618e14156fb4b71ed75cf3ba16b023f9f830d95fa9e8ec34f05fd3a9b8a8dd7ec", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975350, "uuid": "6018db3c-2f43-4254-abc3-74aa8b2bd14d", "value": "T18052B081933247CDF99676E90E2E3CA6C3A51F65C1CF16A98F94830871D86054A3389B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975350, "uuid": "1a84b4f9-10de-416e-a944-3656560d2410", "value": "384:pkzU/k1acgA8NfFK56o4M3xpEQHkKAbfiQrA93EqJFPQAwBW:pwU2aq8C56oJTERro93EqNGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975350, "uuid": "d2d5a9b9-a9e0-4ad7-9314-ad70eccc2bba", "value": 13293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975350, "uuid": "ee8474e1-02ca-42e2-985e-3ddf96377b78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975350, "uuid": "5fd096f7-d7b7-49b3-9443-8176f59f8b85", "value": "images_20260725_062458.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231fd5f4-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991440, "uuid": "c5c97306-6606-4fca-98b1-fa9e49acb130", "comment": "Malware payload (Mirai)", "value": "ea02ecf02d3b6317115cdc9d4995b61e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991440, "uuid": "4aedf865-87a8-4e45-88e2-4e6c559b2c13", "comment": "Malware payload (Mirai)", "value": "860f75c35b0ea164b459397e5f7705e6608ff7bddab7da64e3e64357c8b45753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991440, "uuid": "bdc1e81f-19a7-4d0b-9e5b-7ebd141b6c18", "comment": "Malware payload (Mirai)", "value": "c66bd4740291faf25c4aceeb5cb4bf37b5d4c003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991440, "uuid": "f71d1c03-e0b1-4580-ad54-1d4f39df025c", "comment": "Malware payload (Mirai)", "value": "16961d2baf31c0e5d69f6e584d5819088f4971239b7d8e60109b53f7d944267043f9bf2d6424d472d329fc350bab9930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991440, "uuid": "34f5a4ef-cfc9-4fb9-b0b7-9a6e7de01155", "value": "T1B2A349C1FA87C0F6E84704B11066B33FD730956A4036DA69EBD96F36D6A3A41D31B368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991440, "uuid": "90f40f17-ac96-4e36-9bfb-0edfff7e9adc", "value": "1536:R51Rh8FNlVX8ezAcWdR9LBVCSD/nfSDWs6uf3maPUpDtk1Ul:R5F8nl5BznWFLBoSDvdzuf3mad1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991440, "uuid": "aa9418e2-1764-4a2c-a271-3a5d4c644560", "value": 101668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991440, "uuid": "04c6bd42-0e97-4e0f-b42c-ad7c5fe38329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991440, "uuid": "342ff99a-fd06-4fb9-9b98-7d6c2c230a84", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9736244-8859-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785005490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005490, "uuid": "c6b2bc29-9750-4c4c-86a8-2c3feead8e01", "comment": "Malware payload", "value": "04a9708ff36968dabec9c9922b958071", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005490, "uuid": "cfc5cd6b-253e-4d9f-9301-df8ace1b610d", "comment": "Malware payload", "value": "864239d4d6d18ac41b16fec2b40f2fc647881dfdf66ac00db5e41d823ba8411c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005490, "uuid": "fb5c5b04-5973-4ad4-835d-88bb74cdd10c", "comment": "Malware payload", "value": "bce0d27bab5a8192d6b6308f30cd558969692f4a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005490, "uuid": "959b850e-01d6-499c-9f2d-2e7f2d8264ea", "comment": "Malware payload", "value": "7da1715199e9902a3207d40069c0af7718b97467433d24542e8d4df82061a71cc70d14c72ccf184ca66b8805d66ce74c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005490, "uuid": "b005af29-23eb-4058-9dcf-ccc390b89839", "value": "T153624C0BB8814036EAE14079477F4226447E6CB623C0F8DBF7F0698A59B46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005490, "uuid": "44167a4d-3f85-46e7-99c4-6f8cadc15feb", "value": "08e71dc3a4ed4919ed4f88f99fab3457", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005490, "uuid": "d3794132-667c-4af0-a9fc-4ef08411b017", "value": "192:u9BErjXgjo8P0UI+TemM2B1WFeI82IKUSfEzQyFJxTmv8U9cth99c+F:ju0IHWUoERav8U9cXzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785005490, "uuid": "aefc4ebe-cd01-4fa9-8ea9-ad4a4c2061d2", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785005490, "uuid": "a6600374-14a8-40a7-8462-0771f0bb68f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005490, "uuid": "862c0a08-cbfc-4fa1-b325-3d38b82f666b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348b7cdb-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784976867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976867, "uuid": "8e4b9e10-ca8e-4c16-b13c-4fa74c3ae88f", "comment": "Malware payload", "value": "ed6097861ef94311256b89cc58645be1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976867, "uuid": "d469227d-5fe0-4b8b-9a9a-07ba5252291a", "comment": "Malware payload", "value": "870621a246709c55b7dd5dcabaa1ad0aa34db0dfc02b4c8054b44fcdd96de03f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976867, "uuid": "cc1af76b-f72d-4f8d-9c89-0ea4473fae78", "comment": "Malware payload", "value": "87d6752e8f75cd7e2872489e6017fc17b820f3ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976867, "uuid": "2723b7bd-e8b7-44fb-98dd-3e67834d9d31", "comment": "Malware payload", "value": "dc8e2416cc88f0f76b6a19d11f59a405ad216310305e964b66c3b2835bf7ab07c9d0d321c50beca99ff285cf0403bf47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976867, "uuid": "75cfaf2f-c2b4-47b7-9988-debc32a5f196", "value": "T120943B8C36EEB094117FBEB7AB2B2198E915CD8553084058F6C8749FFF1437A94AAF14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976867, "uuid": "221d1157-2f80-4a0a-9b24-2f97e4b2245d", "value": "6144:j3osg0xAlBl4oYguLzmawPb9AGkeSZTNksNc6suJ2FotMA0k+EdMatfAEaeMer53:z1o3YtRTnsuJnv0GdMqYEaeMed3Ldh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976867, "uuid": "f59f1128-d957-4ee5-aa28-56ed1e3d6d7b", "value": 409363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976867, "uuid": "eafe4f82-f590-4153-8fc5-939bef2e68ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976867, "uuid": "f8dce011-3f51-442f-bcbb-dceed981cd38", "value": "870621a246709c55b7dd5dcabaa1ad0aa34db0dfc02b4c8054b44fcdd96de03f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef4d05b-87ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784943893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943893, "uuid": "0ef3b2e0-3ba3-46b3-b6f2-0424e6b22b48", "comment": "Malware payload (Mirai)", "value": "dd83b4968e2fe200cc29208ded70c1da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943893, "uuid": "416d3fce-1624-406f-aa67-f0c3a5a9e88c", "comment": "Malware payload (Mirai)", "value": "87cede66b57a0c53a15cadf18bb7865da00aca1158c95df08ee11159636aeec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943893, "uuid": "c81af356-84f0-4e5b-8709-6995d67a5afc", "comment": "Malware payload (Mirai)", "value": "7dfd06a272e29d7ef0c133600677ea15ab1a0b75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943893, "uuid": "6a40c978-1ce3-42d5-a174-49c139a645d2", "comment": "Malware payload (Mirai)", "value": "cc4cade0eca45d294846ca3183297bf00e0c3254328121564a201c34333202ea536567dd270ddd214ce125b0cb41c7af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784943893, "uuid": "632a35d4-ec85-489f-a087-c477264e5013", "value": "T17673020DD7A86EA1EDED8CBCF27502471FAA7AB148F494CD2B72101D2D145EA864CDD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784943893, "uuid": "1de2b45d-42c6-47c0-9ec6-c8cc2eb78371", "value": "1536:ymbAFgs/7j2wQKdLziYB+60quxweb5ZDGdWHpWd23cLml7kESuegyYQ:js3ZTdLXQJquuQZDGYpW0cLGoieWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784943893, "uuid": "0a44c74a-a60c-4e02-9f4b-9496983aa6ea", "value": 75544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784943893, "uuid": "cb905789-ed40-4e83-9465-c22fcf31e989", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784943893, "uuid": "1e8fd90a-3c4b-48cd-b142-e206b4eb78a3", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b32e94-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974822, "uuid": "cc8235ff-e815-4061-9c88-59ad7c278b8f", "comment": "Malware payload", "value": "587701b1047b53c2b0a8976e0dbaaba6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974822, "uuid": "97db71a9-2158-41a2-a9b0-4c66328d2b36", "comment": "Malware payload", "value": "87fa3911f7c6ba14faadefd5cc1a0ec29c176fc3858a1addd391bc4099860e6f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974822, "uuid": "36185493-7946-4aff-8c92-c21ab3ba0ee6", "comment": "Malware payload", "value": "f2fd127b76f49c88a4ac5a6a27434567f45002f0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974822, "uuid": "e5fb4e94-a783-42e0-8110-133c8b577476", "comment": "Malware payload", "value": "ed01bf87f5151226aa869b377545a1a27900ef67fe0999eab04d2ad0611351fc0ccd61a539844c60ca8b727cb7f0f06b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974822, "uuid": "7a46e6f7-892d-488e-822c-a42edf4dfc2e", "value": "T1D062CF2A42171ED2FFEBF8F594BB2D526182F550C15807A8EC6E2C494F11841B9633DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974822, "uuid": "6f5597ed-3856-4fb5-a6c7-14c2973d9820", "value": "384:+HmNqQDWqI3lydYBaFYRci4yKtq1t78OEcGLdreGNPmGXX:+HmNqb1ydYBaF5ifIzcGLdrPmGXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974822, "uuid": "57ff10b5-5238-40ba-a7fc-42739f7aa23a", "value": 15064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974822, "uuid": "f9be61e2-59b1-4fa7-9049-bc942c0e3506", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974822, "uuid": "b8c61a6f-0a4e-4ac4-bf86-f8b87730caa8", "value": "images_20260725_022922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a10e2c-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784977025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977025, "uuid": "a0d8f0cc-d3b0-4176-ac9c-7c61fa5f9a1d", "comment": "Malware payload", "value": "6f984300eaaac8f97c0841e7108fcefd", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977025, "uuid": "be26ddc4-6a26-468a-af96-4a49f3b31776", "comment": "Malware payload", "value": "8811eb486f58a0e878a8fb4d6b8d9cd62860436c60901eccf364889af1475817", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977025, "uuid": "6eca8372-1aa4-4b7c-8fff-0fef669b8dad", "comment": "Malware payload", "value": "51b15d8fffb01bdeda33a06db97f4682b70cbc30", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977025, "uuid": "632dedec-7760-46ce-8467-bbcde780a586", "comment": "Malware payload", "value": "107f5c46446b47a83e5362288873b4747e5f4da7283948c6884aa9b95f9198397bb0121bcf58e93d903a5368f5842978", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977025, "uuid": "e8462314-a96a-476f-8697-fac8a39e8a0c", "value": "T173B6333AE7CB4178E156A93944F38149DE073A381DF0F04A5E79F93E45B1A481A3A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977025, "uuid": "e02562bf-352f-4758-8fe8-52bbe2cd8d14", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977025, "uuid": "dc1e24e4-4fbf-47c4-b0d3-f21b47008e80", "value": "196608:x7q9w+RqSevhX9N1MXnUZapfILjvnDozQk/HegjzgmcK7gkmP2sZ9ZObwWa6zXUB:w9w9pj+UZapfIL7nMzQk/VzA6g52sgbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784977025, "uuid": "11b090ba-3551-4ef8-b18b-5801b95ada51", "value": 11252301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784977025, "uuid": "1cddfa9c-929e-457c-994b-f5e91bf737ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977025, "uuid": "074f3895-e8de-417a-a128-db09eafe4114", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f48a3b3-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975757, "uuid": "042956a4-42b7-41e8-a15c-9bb0c87fdfc7", "comment": "Malware payload", "value": "7faf0444e7b5522c97b466ea712c8dd5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975757, "uuid": "6f7719d3-533e-4ade-8545-5a0e0034c286", "comment": "Malware payload", "value": "88dd284b28636c02103858d594efe7daffacdd611129b9dad680cf071dbe46d4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975757, "uuid": "6d85e0fe-71dd-454b-be26-f567af8b753c", "comment": "Malware payload", "value": "51f925f82c09466b18fbe4c68036b39a496d3dbd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975757, "uuid": "30e76a8f-2ffb-455a-91d7-b6110ac7bc58", "comment": "Malware payload", "value": "a7197aeb101d05502a24924cd15e3527af17414569fb576be8e3137b22f30819e48795cb6c1db6ccce387982da0a61de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975757, "uuid": "132ce760-15be-4845-9e44-95bf36d59f64", "value": "T175D19F2AD2EB2152E41E707CB5B5ED69353D37F7A3B347A2391A9298C0504FE32DC940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975757, "uuid": "0869da33-23bc-4098-a30b-703089b35b21", "value": "96:zBVV80S6fm277ikNUtKJL8oAUiPu1DYY5brtuxh32DH0aj1im1taCa0J7F+ce:rV8zk7ikNUtLJUik/NGGDUCimzm0B4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975757, "uuid": "74d6968b-b126-4bae-b70d-cfd6e5ff47fa", "value": 6711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975757, "uuid": "30904aa0-bd8f-42b5-a595-81a0591dc54b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975757, "uuid": "45c32884-3749-412c-a895-eab7445b501e", "value": "images_20260724_183653.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5995959e-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974781, "uuid": "25e0ce7e-0dc5-43b0-9267-79ae7372b374", "comment": "Malware payload", "value": "48419bd039efdae4670483a33f4dc18c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974781, "uuid": "8cb7fa51-6c98-4aa3-8948-ccd6f987840a", "comment": "Malware payload", "value": "88f8069f7a94bc234cbed569e5321464ecc8874778c61c11ffc64733c4d04370", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974781, "uuid": "2158fe5e-a401-405e-9a83-5216d6f4a45b", "comment": "Malware payload", "value": "6298322cf733cc04f8c7ddbc55131ad3e7e6aff6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974781, "uuid": "f6bd84ba-521a-4474-bcd5-24154e0fce49", "comment": "Malware payload", "value": "a8c5aacf9bb1e92918d6ca81609d647e5baa1e407c281bb67ecc5386c12e304d09b4dc2ec235ab73342b23ca83dd033c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974781, "uuid": "959c4a06-c7d1-484b-bb99-8100429d7501", "value": "T1F522BF1CE86E714FCC52FEF436BBC355C0C88CE9406AA2E8EF5D0AD16062942D6F3086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974781, "uuid": "ffa88339-ee51-4f1f-a536-35805593728c", "value": "192:VMIkXRqJmEhfWLHWekbC8mvEF+ZCYsyaVbHqQgTAZOB4Wd5:VM9XdmMHWekbocBjngTAg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974781, "uuid": "158268fb-abea-4019-a7f5-6effb0462ede", "value": 10077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974781, "uuid": "6ce4ec60-ecf5-426d-b962-4aa1f17364f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974781, "uuid": "0702a0c7-3bf3-4f77-affa-f67816bc271d", "value": "images_20260724_232431.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802e8c08-87e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784954660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954660, "uuid": "289df074-7f85-4897-bb9b-660766a15beb", "comment": "Malware payload (njrat)", "value": "b89ab8277e1e5136f709f9bafa335a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954660, "uuid": "717bbaad-4b84-4f11-91c3-98e12e20db82", "comment": "Malware payload (njrat)", "value": "89de93e69e898d5da92c572f472fc8d0b3b1162eb8d98d4790d2fd6ff849de5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954660, "uuid": "cd27cfa1-6637-4061-aff5-2cc478f99df9", "comment": "Malware payload (njrat)", "value": "4573e72c90d7e6a5f30fb75f460c2573e66f8edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954660, "uuid": "a87ee3e6-3163-4469-b485-69a56f63c422", "comment": "Malware payload (njrat)", "value": "210ec889f62a2240306599ea62584bc09f40c82022687b2ea14c082e7034e61d0e1ac29dca496913eb15a6d41a2cfa14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954660, "uuid": "8a318e15-a2d8-4520-aedf-a91a1f4ba8ed", "value": "T17C45121DB3BA01E9E5A745338B9D0952E77FF85237147A2F7E9C8725AE12600BC0AF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954660, "uuid": "41b020b5-260a-4e14-9cad-0a71e8849395", "value": "7da77cce71b6ac76f77b8520f376f8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954660, "uuid": "8e005051-a40f-4691-a176-4cbbecf1b06e", "value": "24576:i2Ao6VM2vfFoW5AzACIVqXBbWnT0gRa41Q/xTeE09R8fH+0gQ1rty8d:v+M2Voxkt6Sn4pxTeE09Ub5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784954660, "uuid": "d0f1ed12-9524-477a-9128-359abb411c2d", "value": 1273856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784954660, "uuid": "43e4b239-88bf-4ec3-a5ef-ff218b5775ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954660, "uuid": "8caa4164-3e69-43da-aa7d-74563ea6b980", "value": "89de93e69e898d5da92c572f472fc8d0b3b1162eb8d98d4790d2fd6ff849de5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc33fab-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975295, "uuid": "468ac82b-8197-48bd-ae8c-e3269a7272a5", "comment": "Malware payload", "value": "ee652b04ce78904de52f0e39df52079c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975295, "uuid": "f1d6546c-b86a-41a5-823f-88f3690942ff", "comment": "Malware payload", "value": "8a9a2498b4a604c762b2d9332d11858c7d9780f538122b9f5036c1e3ce12d19f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975295, "uuid": "c1aaa626-9ac8-436d-80fc-2b8f8f059806", "comment": "Malware payload", "value": "b5950b65b3c36eed38dfa4852215f6db22d1d95f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975295, "uuid": "8d0c27af-fade-438a-9ddc-abf8f18bf735", "comment": "Malware payload", "value": "5ad19fb98da5ecc59c6c4f95d3fcff3ae82aa8685ac0e764fdcca06141af81e1577960d68b6c6694745349457c4edbe7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975295, "uuid": "e222d63f-2ab7-4f9e-92fc-e69554b70774", "value": "T12C42CEBB50585372E01304F44A0EAE87E14D2FFBC88925F3ABEA54A031D52C5277C7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975295, "uuid": "6204fa43-bd53-4672-894a-b8bbd3a77941", "value": "384:lREbCZuCFm+BeNdBrOLTHvWwC9hPDA89k:l6bUpm//oHdC9hbF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975295, "uuid": "5bb7f273-d937-4359-870e-ed8fff3170df", "value": 12309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975295, "uuid": "e27de9fe-45a2-4b3a-ad9b-dd33d05aac54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975295, "uuid": "36eee876-dcaf-47d9-849e-658e8a9351ab", "value": "images_20260724_145142.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f85efa-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973999, "uuid": "b21b3c55-0eb1-49ef-a745-bb7ebc554659", "comment": "Malware payload", "value": "5350635c98d7561284e148c7f9b0305f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973999, "uuid": "2ba8e884-36fd-4c3b-b921-bfa56f6f4fab", "comment": "Malware payload", "value": "8b6af3482082d536735832f86608391ecc5e084e9a1f7ad49f2d1a42a55670e5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973999, "uuid": "2103eb30-a19c-45dd-b759-217ec6e14b2a", "comment": "Malware payload", "value": "408e5aadcbfb9e211ef7e8141c0865e791b0e275", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973999, "uuid": "34df5a6a-50c2-47ee-8d4c-96e73204300c", "comment": "Malware payload", "value": "d4d27fd54aca8b811fb750f7da48d0b6b9d3399544db07deaf1e4076a7247c9da5e2485ed47441bd9b393f18b5e7f7f7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973999, "uuid": "c9f2f9b1-6bd0-4165-90d9-498e87684c2b", "value": "T18706CE4AFB489B6AC0F3523A4C355A61411B8CA68F83D7837D24773C48BB9D15F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973999, "uuid": "eb82b2bb-3042-43e2-aca8-0d10023c79dd", "value": "49152:57HM1ij3XVD2qWE7NKQhLbGFDTu/OT767DltOR7dNEic1ljsRGyS:K1ij3XVD2qWEhQlTnSDluU1hsQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973999, "uuid": "696d9a89-a85d-4deb-add7-601021a27932", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973999, "uuid": "2dafb55a-38cd-4b31-aba1-43ce14bea3a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973999, "uuid": "d8d2a453-f257-43df-b1cf-b370878607e2", "value": "variant_15.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169ffb69-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991419, "uuid": "9968559c-507b-41fc-abc8-4c63d954de6b", "comment": "Malware payload (Mirai)", "value": "03e2deb099e5b696436c74d5e66bdda4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991419, "uuid": "7142e8e9-6b5e-421a-bb93-83c5fc3dd5ea", "comment": "Malware payload (Mirai)", "value": "8b6fa842c8c792f744781542deda2b413cd7c9c8caa562cf44aa0242866e114c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991419, "uuid": "32be56cc-f15b-4a53-aa72-63134b8317e5", "comment": "Malware payload (Mirai)", "value": "91cfcbe5030f1229c95e8e35b498b38733e945a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991419, "uuid": "32600457-ab40-4299-9ed6-f54d64137844", "comment": "Malware payload (Mirai)", "value": "ef519f7f8da9f7a15acd6f54d4173ebe90eddcf4cc397272b39380d7212838ff51aa9b75d7ffc961d666fde10e6c7b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991419, "uuid": "57299508-593e-4ba6-97f6-e49ac2a81096", "value": "T10FC37D73C869AF98C618E0B4B0748FBA2753A515824B0FBE5667C3718087D8DF54E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991419, "uuid": "f2c699cc-8161-4bb2-9cb1-c39251e62119", "value": "1536:5asIsMZV8457qWn7Zr1YIyd/yxu12CRKBIyYywbJW1lSR6WWRwmQwqfI:5tc7q6Fr1stqA2FBHCW1E6WwwmsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991419, "uuid": "9f4cc1ff-3f83-4a8a-9dab-b421612e79ab", "value": 129664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991419, "uuid": "e439dc2f-0c89-4576-aff4-eaa14d04bdb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991419, "uuid": "fc825b97-4f1d-4374-881c-1e931b2285b4", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b1f758-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991356, "uuid": "85785e2a-e519-476b-b70c-0edfaac13591", "comment": "Malware payload (Mirai)", "value": "97b9bb976c22e71d686132ab7cdc1b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991356, "uuid": "713f29b5-8756-4f54-84da-c886264cf909", "comment": "Malware payload (Mirai)", "value": "8cb13cd4f40ca4ea5c057b5c2ff15fa480ad7eb778cc7bd25e02b1609188d7c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991356, "uuid": "33d1eb58-52af-4559-84a6-72f44b84583c", "comment": "Malware payload (Mirai)", "value": "d7e0191baf9073de7c4c0f7247959d8dbcf23bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991356, "uuid": "be1eae3b-b3fa-4806-bc0d-edb1e63c128b", "comment": "Malware payload (Mirai)", "value": "e926a759e279786e41ecaeea5982a8e180bf024783ea53504b8b70f9a7183c1095262b34175cc4207e1caed73485d5fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991356, "uuid": "ae7aa242-28b6-4da0-92bf-983a6a8e77fd", "value": "T1F3631272C521B891CEC06F70DC2C0B5B6AB746B26346623B72224F19D7C76D297E2723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991356, "uuid": "49df3e14-64f5-4c06-8e73-fda5d413063a", "value": "1536:BtgRJif0KLveX1xWcQ1etxGKI1vhsTizLyfTtrR6M6ijX8Ug8H:Bt5Trm1jQUGWTeLyhtHBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991356, "uuid": "6208f7a8-8313-4808-855c-74783991c434", "value": 71752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991356, "uuid": "d57fd085-c8d8-40dc-8939-f068a1d1cfe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991356, "uuid": "6319930c-eb0d-4ffa-bc35-183a2d33f417", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8eb8d9-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973931, "uuid": "65df96da-8cd9-47dd-adc3-9a31935ce88a", "comment": "Malware payload", "value": "24a70fa79d1b73dac24761c98d7e4c18", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973931, "uuid": "c32a2a21-68ef-408a-b6e5-9a2e77ca781a", "comment": "Malware payload", "value": "8d70d43722123ab377c20831205a144349a2b99ed17f020b46526894e4cb9ecf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973931, "uuid": "54f60cdc-3291-4fb6-a353-cc7d84ada268", "comment": "Malware payload", "value": "9e4bc557c8c6db0bb00a75e620666b3f48d55cf8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973931, "uuid": "a35053dc-d551-4146-8a37-f84283052d48", "comment": "Malware payload", "value": "e9340d93026aa5f4de134a866d92e165ec1b478cc86ad3f5422ec62479a223536959c0176fcbc5495dc5f6e8628b4d3f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973931, "uuid": "29accf08-e2fa-4dd7-81c2-2e09d792f3e3", "value": "T17906BE4AF7489B6AC0F3533A0D355A62415B8CA68F43D7837D68773C48BB9D01E5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973931, "uuid": "46d037b4-5d75-408a-aa9d-40861add444a", "value": "98304:h1ij3XVY6COEhwtTDBB9Edk5d/K1fpYkx5vn:hnhOdBQk5FK1fZxFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973931, "uuid": "2fe99a1b-5730-417e-b8e4-4b4fe9253afb", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973931, "uuid": "825a3ba3-0b52-4c63-bb39-89fbb1acc923", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973931, "uuid": "f4c71ecd-fb0a-4bff-a4c8-3dd8d1364664", "value": "variant_04.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be7d78d-8834-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784989254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989254, "uuid": "c64ba48e-e525-48b0-b4a4-fdda320f1747", "comment": "Malware payload (Mirai)", "value": "884762c19f77f0670d5ba65ac76e4982", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989254, "uuid": "c7bc51bd-6b5f-4c66-ade2-f392d44544db", "comment": "Malware payload (Mirai)", "value": "8f92b8cf6963841fc807c7bc8087e256f66939b7fc177ba784a3404a495ac23c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989254, "uuid": "7f663606-b339-4317-bf64-a61c0bd10d6a", "comment": "Malware payload (Mirai)", "value": "7f32ad0b685756ba696b579fc798bf28787b725a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989254, "uuid": "aa04e53d-a224-4dea-97a1-5a6f915cc5c6", "comment": "Malware payload (Mirai)", "value": "0058a2c233785551b380e253a9e9d10ca8881036029eda2512dda3661973e3c134301f19808f4b6953bebfcbc46b681d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989254, "uuid": "70160bb1-b56a-4f48-8a7d-d390a36c71b5", "value": "T157F31A56E9819B11C5C156BAFF0E528D73231B78E2DE72129E246B347B8A87B0E3B015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989254, "uuid": "46feffa3-3aa2-41be-bb49-39264287f167", "value": "3072:Oo0R0M1GwnMVqH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hUA:Oo0R0M1GwnMVO+MFwCOPtU3oaKCMl7uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989254, "uuid": "0360274c-dcf7-4186-8fcb-2d6bd4848beb", "value": 169012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989254, "uuid": "9bbf881a-ae5e-41b1-97bc-69d54b7e5feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989254, "uuid": "012d7b7a-8668-4e54-98d9-95e0ac0e9f3f", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bab4713-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974704, "uuid": "7da1e564-2d13-4205-9349-e355700c8a65", "comment": "Malware payload", "value": "1bb6bcd6a6ad0b514c3e735b9413e4a2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974704, "uuid": "8cf1183e-5691-4d61-9317-89763a54bae6", "comment": "Malware payload", "value": "9133070eb3fcf6508c99c854a77e69af7b1a794c3ab576f50d997775d4324953", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974704, "uuid": "e8547c1a-5b7b-48fb-a722-cf0d75448849", "comment": "Malware payload", "value": "f45f975c3913db57799cc17fdaaf0689fcacdd50", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974704, "uuid": "ad7b091d-87d0-4340-8042-6c70740ae5aa", "comment": "Malware payload", "value": "b42d3b761551eecdbeda1d131d405831874f8ba621042ff55323f297ec9cbd505a41d4111851f37523859cbfac114a73", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974704, "uuid": "50da2c38-39c7-4c2e-aecb-a5822686a96c", "value": "T165F1AE14CF4D7500EE7A326075BD3AA25F1D12C7C52F9900F9EA66FB086A7C82A57348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974704, "uuid": "c314a5e8-e392-4ca0-a7cf-f89918973a87", "value": "192:sF0eOIF3I7Ua8CT+WiHUskUNpWn74/04n:w0evF3Id8CT+x0skGpWc/Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974704, "uuid": "1d272a19-53cc-4c4f-8188-32113e978df9", "value": 7677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974704, "uuid": "cf17a576-2b4d-4fec-83c9-680843022074", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974704, "uuid": "904bf3f1-624d-4ac3-b159-112a502801f7", "value": "images_20260725_092735.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7563ff03-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975258, "uuid": "4a95446c-8243-4bf5-a1f1-c9e29a2d9fbf", "comment": "Malware payload", "value": "561d709466954ed922bd83ecaa4f455c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975258, "uuid": "f141c921-8370-4e2d-af2a-147e7b55bce3", "comment": "Malware payload", "value": "91d4c56f41699b9ee1775b2051567885c61c68380bc6e5550affd93ff2f44c5a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975258, "uuid": "d44228e7-909d-4023-ba75-e613236af686", "comment": "Malware payload", "value": "295a3471e8f3f9332f75d19fceb1862c3fa84b1e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975258, "uuid": "ab39be70-f8de-4303-ba4d-48d950023e97", "comment": "Malware payload", "value": "5ed8c4f47128c2d1514bbf3112e3611129b66c8103316a4d136fb055f7ef2c24c32c3b4193db332d543ee7bb7dc26200", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975258, "uuid": "fac3d6cd-ff29-452b-a2b0-5ae1e8c58420", "value": "T18A718D04AD2F8C42C0776EFB7AFF0AD11D11CE4404C15A8BA2A676505C378F237963B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975258, "uuid": "c095ab40-4983-4d9a-aff2-e244fc6dba7a", "value": "96:pUdW5NPK8D3n/4wg+80iFoD9fVnRrON5AoaCLnC:Xr/C90UI93jKLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975258, "uuid": "8b079ab7-6f09-4b7e-b501-09c3ae008c59", "value": 3761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975258, "uuid": "280e7e3f-3141-44b9-b8b7-21e00f76395b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975258, "uuid": "6cced8a6-4d5a-4eb1-8c5f-d09f4a8759bb", "value": "images_20260725_022303.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e7a3c4-887b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785019951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785019951, "uuid": "0dc94920-efdc-4015-ad0f-701ce3ca7125", "comment": "Malware payload", "value": "65039b94fe764e2d6f2d679c16fe0b64", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785019951, "uuid": "ff5317a6-f006-4409-bb38-f003784c184b", "comment": "Malware payload", "value": "925278940fe96bc04d406ebdffa8e3431b64e76ff0d22b23b53b47d5cd360200", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785019951, "uuid": "ba8e117d-39e7-41a0-b8ae-d32793d72628", "comment": "Malware payload", "value": "953cf0e5c83ba87b7a09e669b9eaacebce66ed2e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785019951, "uuid": "1623e06a-8b46-4d16-8c88-3bfe7d079ee1", "comment": "Malware payload", "value": "da06c01ca94f04bab3bf8d01d0f947a9b7f6997b82996909af5ddac5d3eb70c3f063dbea9710133f2b20029f5dd233f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785019951, "uuid": "da378a7b-1749-40b7-8db0-99e5d27560bc", "value": "T1D9E633986ED011DFF972D13DEDA155E0D579BCA28732CAAB8BA823D12E131A00C3D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785019951, "uuid": "3c9dc5a4-3f5b-4a20-914c-499ae55705bb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785019951, "uuid": "c2c82379-0995-40fc-a643-300225279956", "value": "393216:bmUvs0akwI/h4jRpntE71sqPBXMCHWUjXycuI3/PGTAI:bmUke4jRpn2PBXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785019951, "uuid": "83cbe757-7387-4f90-85ed-d5e42ada0e38", "value": 14301186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785019951, "uuid": "8192409a-dac3-4e03-a497-8f3cae54afc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785019951, "uuid": "1ec5a0d1-a057-4a08-b4be-ab47c5909fb1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69fb19c-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975823, "uuid": "2c08ff48-2eb6-4f9f-a45a-a99ffdc5eed3", "comment": "Malware payload", "value": "0d5d6f8df4ae57d92bf4dd4971620920", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975823, "uuid": "df7a5b92-02ba-41be-b8f6-0857a012a4d1", "comment": "Malware payload", "value": "9340d9c33d5a96602e2270e3892a3b03ffb908879acbdec69c50421990d11d93", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975823, "uuid": "49732097-3dc5-4ccf-a991-1ee52012122e", "comment": "Malware payload", "value": "2eb514bde1859e7543e8a1f02acf6a2f75f125aa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975823, "uuid": "98a82ed5-7cf4-48f8-bcc0-2d8548d15571", "comment": "Malware payload", "value": "62adeac38f4811568a774755e8c6394876faa42ce2cf778088a85b9318fbd5fca0781ec4ae22bd1f992dccbe47f560a3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975823, "uuid": "9415b4c5-5f41-4e4a-a9b8-8ff5362ebdf6", "value": "T15D512EB40C977462C7E387F7B1974E88563828531DD91505E35EA1485DD57A773033F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975823, "uuid": "780fd06d-14d9-40c6-a08f-59d1a230d867", "value": "48:97Y9DnuZ9EoG4hdem2/002W2vV1/AWsD9MwE5jX:YDuEb+E/M1/A0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975823, "uuid": "581c69f8-c96c-4700-9248-7302133d5c39", "value": 2734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975823, "uuid": "db947f38-9c82-4f37-972a-0f266ec7dc78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975823, "uuid": "9bd052d0-3691-422d-bcc2-786f4cb884a7", "value": "images_20260725_054251.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780b78d3-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975691, "uuid": "250b21c8-b97e-4482-a736-6af96d9c018a", "comment": "Malware payload", "value": "4b34329c0f2a7b13e9a5cefac333adc1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975691, "uuid": "e715251e-79c9-44ee-9641-ebd1018c73f0", "comment": "Malware payload", "value": "93a61e665d453d415a157627f2b493c8f650fd7b8da0a2afe20308acf5a01149", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975691, "uuid": "03c7ed9a-370a-49f6-8134-00041f9ce994", "comment": "Malware payload", "value": "2402c5322a3acbf058988253532ee208186b07bc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975691, "uuid": "b180b947-11c3-4c25-89c0-049223e4b160", "comment": "Malware payload", "value": "7584593c6db8d059c391e46510e4edf30cebd5d70841a54a4a2c7ce97ea8fad173dc1f9eb9626efbf7404775e4e2067e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975691, "uuid": "5a2f38f0-d49c-4ffd-b005-9354906da7c0", "value": "T16342DFB02258589D8FDBCB57047EDE459D2DA3AE289273B322A8144F110A33CDB2E0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975691, "uuid": "3d5a8b23-0777-4928-b3e7-78232939e0b2", "value": "384:QtbzG8HRAtmpkG0DFXZgyzVmV79GAYnNWqn:QtvGAAI+JZgyzVmKhNhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975691, "uuid": "f6621967-f5d8-4109-b1e0-ede80f2905ec", "value": 13134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975691, "uuid": "aa7f7438-19db-45e0-9e3a-ff1b58829356", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975691, "uuid": "f05d9c57-9485-447b-a7ee-afac7f76da93", "value": "images_20260724_232843.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fb4420-884e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785000713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000713, "uuid": "a12aa2f4-a961-4b6c-a66a-a46a95cdfb7a", "comment": "Malware payload (RemusStealer)", "value": "7ed591cb63556c9df3ccc1077c9a434d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000713, "uuid": "985ea715-8fcc-4c40-89df-b545f566da16", "comment": "Malware payload (RemusStealer)", "value": "93f44970a8af6f0f348f79843fb0e182d5057e4eb4e3a0623b1aebf27251fe5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000713, "uuid": "f9633720-1963-4bad-9f0f-4fa7a5b4329e", "comment": "Malware payload (RemusStealer)", "value": "e313d6933faa4dda9cc8667d3c4926f0186249a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000713, "uuid": "919e707b-0dd2-43dc-b2a6-45cc2be1cbcb", "comment": "Malware payload (RemusStealer)", "value": "1a1f7ee876483cafd2b9fcae067d843a8f4d2dc9ebf4986dee62e480a2b2c28fe13da7f640ef9ae152763be488492a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000713, "uuid": "74b6ba36-2cc8-4547-a4b5-b01e6fa8cd39", "value": "T153B74917BC9148EAC0A9A331C9B65246BB35BC081B3637EB2E90BB782F727D05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000713, "uuid": "5ef80ab4-3ff1-4317-ba6a-b3b230117454", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000713, "uuid": "38debc84-a4e3-4a5f-9334-71269dc775fd", "value": "49152:BixUPCYWAuvNx8GxHvGy5jqU751C1LK25an:BXKHAU751C1+KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000713, "uuid": "e8c19807-10bc-4bce-a2c5-8750a24f6add", "value": 48910680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000713, "uuid": "40d10796-7e3c-4297-a43d-94b3caa8c598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000713, "uuid": "21f979f5-24da-4764-8a13-599370cb8fec", "value": "NexusMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfc2708-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975727, "uuid": "82acbde4-35fe-4d3f-b8fd-aaef00650412", "comment": "Malware payload", "value": "e98e953beeee0355d680b24b6a00c358", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975727, "uuid": "772b0437-c68a-4f87-ac66-4405d4a734d9", "comment": "Malware payload", "value": "94127633750b4793e4cd68b198e42bfd73268ccd6e176c9370f25b22c8a007a3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975727, "uuid": "dc564911-3ffb-4c11-8feb-1a1a9f4ad1d5", "comment": "Malware payload", "value": "6793adb79f282f2116ec3f2f288e816fd46dcacb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975727, "uuid": "5bb5e7c7-341f-4f22-8cbf-f0a208d2168c", "comment": "Malware payload", "value": "57e6af6397708250cb266de0575b35a71d7d78b20355efd996e6756c94e188c17c2e5d4abf532e2e6593633b05b852c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975727, "uuid": "3f37513c-e8c4-409e-934c-38528bdd7fb3", "value": "T12952E1F1933A54EA8859E5BE084E6FB0350F9CB5E165533DEBAC103D37BA5043A0D9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975727, "uuid": "00f70827-43eb-4621-b57c-d5fc2a9db77a", "value": "384:Q5yvOIafB1RXFXDUr/AIuB9Wq4f4C0Z9y:Q5yvOIK1XgUI1QC0jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975727, "uuid": "0afd1627-192b-4428-81de-792dd59496a1", "value": 13927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975727, "uuid": "633f5eef-8490-45f8-9bbb-f36c4135f69b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975727, "uuid": "ca16e323-ccaf-48f5-a093-c73fbe60fce8", "value": "images_20260724_235928.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef39a305-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991353, "uuid": "a1d5b6d9-ab10-4893-9e11-ce89e66fe951", "comment": "Malware payload (Mirai)", "value": "d27ceecbb266f16ce5bb81e7bcfc73e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991353, "uuid": "b2fe8952-ebdd-4278-8add-fd6aea20f3b8", "comment": "Malware payload (Mirai)", "value": "9419443b71d6f4c504bf09454c51cd7b542a7bdafc439a0b76aff2b3d60a7abc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991353, "uuid": "2d5e64de-d621-497e-b39c-2229fe663459", "comment": "Malware payload (Mirai)", "value": "e01b0de4899ce2d07d64a1e937cfb124ea2cbff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991353, "uuid": "b1756dca-78e6-40dd-b974-f62649d838e3", "comment": "Malware payload (Mirai)", "value": "db9fc1b86e5badc73ac2cda549d9c46f4074f29fe42ca78931e1773e3f41e2793998e0c36f5552b6619ad99eb37224da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991353, "uuid": "6549b38f-a8cc-4ab5-945e-5892361a6bf5", "value": "T14F13F219F09953CCA5D6203B91FFBA5D2CAED7CF721880191A55A03A3C309B91D947ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991353, "uuid": "920c0fb6-19d9-469b-8d5a-373289b09428", "value": "768:Mph1Pr9M9RI6v4zZriqR9YsUywl0Yan4rxF6nqP89/mOvUZiWJzEnbcuyD7UHQRa:Mp7P96KZriqfYsgdwqPgATJzEnouy8HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991353, "uuid": "688a05be-1707-4f47-afb7-467ce4c7227d", "value": 44224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991353, "uuid": "0120c29f-21cd-462a-a7e2-a32c1c03bf52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991353, "uuid": "cd79c6f9-c911-43b5-8115-a557cf81d476", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabec7bd-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998647, "uuid": "8e253555-c996-4f05-8368-47a96f21256b", "comment": "Malware payload (Mirai)", "value": "28ddffa7dc1471802e1b20eea0e4abd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998647, "uuid": "bae12ce8-cddd-45cd-893d-5928af449e43", "comment": "Malware payload (Mirai)", "value": "94359c560a51affe2473af30ac83d559877975d2b8fd9c825c1c6e5b43002d5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998647, "uuid": "6e7777e7-025b-4328-b949-87f1f6cf8de9", "comment": "Malware payload (Mirai)", "value": "cbc5db370d2be0830f717ad4fdd996b82146d3a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998647, "uuid": "af5c484f-7065-4d37-8f72-80ddea743e3d", "comment": "Malware payload (Mirai)", "value": "a113be490f57f103f302df4ee6e777ebc647ad56eadb6d9b8c4a90c7eb914a7816d7278ff4af9abf04eb18bc31d79825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998647, "uuid": "df1e4d6c-3311-44d9-ac2b-2f015bf2cfd6", "value": "T132B3AE32D8295CD8C1944178E4A4BD361B23E18162772EFB1BE5C6F64487ED6F849BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998647, "uuid": "999842a2-0824-4a66-8e9c-b80b3a84493e", "value": "1536:C/aRpT3mojgnYduM+4idUdj6rxAZLKfVN275mp19C+Vaarx+H/gl:CCRpb5gncu7NEj6r2ZufqAp19PT1+Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998647, "uuid": "2cc6b394-3d21-40dd-9866-888974fdc74c", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998647, "uuid": "179c697e-cb0f-49f6-b821-5c2f90d36aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998647, "uuid": "83e5e2b2-ea63-4e96-a981-f34842e88def", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4238e50-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784981805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981805, "uuid": "5b75bf70-82a7-404b-8099-b1a2c7c16d30", "comment": "Malware payload (Mirai)", "value": "e68ede0bcbfdcccbadb07260a10a96eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981805, "uuid": "06b30596-7d82-42de-8527-876a87a9cac9", "comment": "Malware payload (Mirai)", "value": "94a215e9e42566c87dee27722105454a973ced213bb2e53463ef6b8d9ea85117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981805, "uuid": "48ea7ae5-a469-455d-bfcc-dca3f5bad2b0", "comment": "Malware payload (Mirai)", "value": "bc002de37835f6853fe140698e40418ef58e671a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981805, "uuid": "ca3c6b1d-6ffd-4589-9167-5996755d46f4", "comment": "Malware payload (Mirai)", "value": "be8156f92418b9876b1a1fbc1ad02080ed28d5ff7520d99e079a5f54ad51b694704bb1618dbd15c07f3098faf227dc7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981805, "uuid": "bedaa46b-5994-4f2d-b228-14eea3edb97b", "value": "T1AB33F2B3966D8B95C531893136CEB84F8DE0600DA1A89255EEC1583FCD456EB28753CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981805, "uuid": "9c717dd6-b568-434f-9af4-2c30a12b1dde", "value": "1536:COKjHiKlGyAOLqppkuzXL8p7RXnouy8kzkkof:C/dsyxIz6JoutVk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981805, "uuid": "08ff7a28-fb98-4022-a819-130f0ee707ec", "value": 50404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981805, "uuid": "63153c41-ff38-4c98-bf51-b7ccfeefda04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981805, "uuid": "957540c2-6eed-4307-9ce6-9a187c5572e2", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a647810e-8825-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784983071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983071, "uuid": "1e93dcec-5196-48fc-8af6-a2c3d7f1f7b1", "comment": "Malware payload (Mirai)", "value": "25d2670df6b75d46276d61077ba98855", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983071, "uuid": "fbda3275-3ab8-4a0e-a6fe-8b3363b07a7d", "comment": "Malware payload (Mirai)", "value": "9545fb055b5092eef0c3d9742157cd3feab189f9899b0df04ec5ded334c64027", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983071, "uuid": "6a9c691b-a94b-4109-a8ba-d4eaa4185f33", "comment": "Malware payload (Mirai)", "value": "8881cbad9a8907d24c45f5e72d08f6755e17b040", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983071, "uuid": "82c36a42-9876-46cb-a391-54788c7c6ce3", "comment": "Malware payload (Mirai)", "value": "ca96edd839315b2812dcbf4cd574a4c37e600d4bd47d8b9368f754c5e11084dc7385359a6dd42ddfcbf4497665afa1cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983071, "uuid": "785b375f-4bc9-4d37-8f03-b45722267538", "value": "T170213A9C609353D32FC9CD80E0AA41EB7209A3D6B172CF98EC06353A98EC544B734A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983071, "uuid": "3a1c127c-81aa-4122-ba38-3392966f7924", "value": "24:QvQhBh9M0oy/KpJKrKtWFurNZJKmKWtFuh:QvQhnoHpJKrEBZJKmsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784983071, "uuid": "69dfb12f-1bf1-44a5-aba5-2441c017e49f", "value": 1329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784983071, "uuid": "6dbdcf6d-8fb5-4ec1-a1de-9183c0e98d14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983071, "uuid": "5a85a416-45cd-42c4-8b1d-802b41203d84", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ed4703-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784991130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991130, "uuid": "d455f713-418c-4ce6-af34-16808c80b3d0", "comment": "Malware payload", "value": "c464a37a1316d6577de4daa687eac487", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991130, "uuid": "24a8a4de-53a9-4e08-8e09-96912918d89d", "comment": "Malware payload", "value": "955b90f9cd54b9eb38b2a2ddc950d372407ae398b69200a1a4afcbd901801be1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991130, "uuid": "64bcbdeb-f06a-46cb-a20d-fa08efce59b1", "comment": "Malware payload", "value": "43f6f8f9f5c76f920b13487e3b0d4703689648ea", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991130, "uuid": "bb650144-4608-4854-891a-d9f49fad2318", "comment": "Malware payload", "value": "78397a9a6df2f9cf633e5a62fd66d62722e90e60c757e0092a33832ed0a5b28f8a6992ea4176402abc98d143b97bb103", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991130, "uuid": "4e7f518e-b382-408e-851e-c06306440f2d", "value": "T165E63398AAE010AEE6738078BCF26359D588B0B51777D4DB13B8D3D62E936D18C39173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991130, "uuid": "a5a79211-4fa6-4351-a307-e0fba257bec0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991130, "uuid": "1292c388-b4b9-4e51-9ae0-a57d41cf6a38", "value": "393216:MMHcqNeN2K6CLggmToXMCHWUjXDcuI3/PGTAI:/8CI5UdEXMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991130, "uuid": "a3bd7cfc-fe24-4699-bc99-f2844a80f715", "value": 14309549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991130, "uuid": "b7f57773-a6fc-4886-8165-50fb9a3a8d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991130, "uuid": "cfdf0288-b2cb-422e-a7b9-e2094acb79f9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f133a97-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998789, "uuid": "b0f0c9f8-d04c-4737-9a25-c8ac556e5887", "comment": "Malware payload (Mirai)", "value": "10d8383e53195c3b2aa589c3e900cf3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998789, "uuid": "b231c83a-823a-46d9-b51a-4cbcdd5264fb", "comment": "Malware payload (Mirai)", "value": "97e22980e077925d8a249b948dcb9d7de5b20395386dcd86b9d42ef580fa3c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998789, "uuid": "5fa6215b-be01-4dd1-ac35-75e8a68ae6d9", "comment": "Malware payload (Mirai)", "value": "f88091ba4fa76aff047834e9c0f07944006fc372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998789, "uuid": "ef136793-eb5f-45c8-af23-b91b2cfaa208", "comment": "Malware payload (Mirai)", "value": "07821a12bc68ed9a36871952515ae547a2661c2744c676067014c05c2b796736241287a53d6c74af8204530c3a5c3d75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998789, "uuid": "47dc910b-161a-4557-982e-4b888024b6b0", "value": "T1F4B35BD5E243E0F5DD6645306172FB3BAD72E0BE132DDA82E3B58A32B8225C1D41675C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998789, "uuid": "bf9f90bf-eccb-4a8a-bc6a-0565de14c41e", "value": "3072:Md0DvGUN4spxfT+FcXRGMd5wuP5j/8lkz99/rFQHYCbBr:Y0DvGE3xfTscQMdu2/ZpQHYCbBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998789, "uuid": "f9b34280-8d34-4094-8084-f81a987bf6d9", "value": 116500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998789, "uuid": "dba5db70-7cb6-4304-abc8-23cfad9710bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998789, "uuid": "3e9abfb3-7ec9-4923-9fc9-89b88b93a7fb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeacbde2-8870-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785015404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015404, "uuid": "fc21cc55-e693-4b07-b9db-7e4fc02105b6", "comment": "Malware payload", "value": "0e0aa1397faa7da231133511d3b9f930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015404, "uuid": "fe06fdc9-ec73-4b9d-bd26-7f2507393d24", "comment": "Malware payload", "value": "983755ac9112bdf7487e53017fd2f14af59c0537bcad36ec302d92563636df70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015404, "uuid": "c1d6d70e-3594-4698-8b45-4df5a9e9c2e7", "comment": "Malware payload", "value": "f8ac99fb0ee95f82dbbeabc79793041b2abe77a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785015404, "uuid": "150c9e22-83e8-44d7-b4c7-8812c049ca9a", "comment": "Malware payload", "value": "0235ae4c46bdc17aca52b2542bf29f5bc1d7227651a212fa41bc7803563d860dcd2ae3aa364c4937bb1d062ab761ec49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785015404, "uuid": "5e8eac4f-d3ed-4559-8db3-fa3500baaebd", "value": "T1E447DF77814238E9E5B98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785015404, "uuid": "33303381-f338-4e71-8e9f-e85af1dde588", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ6:cqYUQuVDt0TZEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785015404, "uuid": "0f0d482c-3798-4a33-af87-e4de0c1890a8", "value": 25460736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785015404, "uuid": "c093bea4-4639-4767-912f-ad36ba9d207d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785015404, "uuid": "aa20ebf5-def2-40b4-9327-29c1b440f009", "value": "983755ac9112bdf7487e53017fd2f14af59c0537bcad36ec302d92563636df70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e53fbf3-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975192, "uuid": "9e528150-7c6d-4c22-b452-871f33274460", "comment": "Malware payload", "value": "a6034049495118c6dca9c41f5df4a9a9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975192, "uuid": "86d464d4-42df-4b40-812d-6b2d42dff853", "comment": "Malware payload", "value": "9840473dbee7c23965f4ee355af4eb0569a162e25a8c2a25b54864ddf1e4b42f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975192, "uuid": "e7393768-0591-47d3-aa87-c73da35b4c40", "comment": "Malware payload", "value": "12d0a028fbd01c592bf0817185652aaf43c4f814", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975192, "uuid": "92d579a4-64bf-4f40-813d-1ed01071ade8", "comment": "Malware payload", "value": "f1263cea0c01cc8b46ff95bc63a2b1654235bf2748a310b7e089d456d2be2053529e838c19d868d6695339a3695e732a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975192, "uuid": "a2000057-00dc-45ae-bafd-26052dffe227", "value": "T1B472C080ED58360DA80753E07C10DFBE67138A6913395BFBE51D37916236229E183B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975192, "uuid": "ee65a62f-ece7-4914-bf30-92f0c5b59691", "value": "384:YuBoLl+UWbGdtGEQgCc5h98tKVylB5eQfz9dNcK:gLsUWadRQMzkHluC+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975192, "uuid": "1432aff6-ced9-45a0-b570-e668f0430212", "value": 16016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975192, "uuid": "4f53332e-0299-42ef-8b9b-8a7e358af839", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975192, "uuid": "26194fc5-fbe1-4e46-863c-bbc707a92bdb", "value": "images_20260725_082416.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaa670e-8806-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784969529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784969529, "uuid": "58eefca4-5c2e-435d-af33-d294632bdb37", "comment": "Malware payload (Efimer)", "value": "6fe286907a6a28e94425df612efe40c7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784969529, "uuid": "abba15a5-c47a-4d9f-a6c3-6009eea09556", "comment": "Malware payload (Efimer)", "value": "99076f5c4404f5ead7b4489b055ea199d6e145ab7194e3e3fa4a8fe2634f6bb9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784969529, "uuid": "beb1bb1f-dd85-4a26-bcba-d524bd239965", "comment": "Malware payload (Efimer)", "value": "817e55643d4e3f3136f1b176be7fbe98f8360960", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784969529, "uuid": "e037913c-dc0d-4dd3-90d2-8e50d95aae3b", "comment": "Malware payload (Efimer)", "value": "a485ac3ca661622d3ffb3536b5a64f0266455c813e641bc5163523fcdb27140e8ab52b72496cd5278a351969450f479b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784969529, "uuid": "557181ce-1f57-4de3-b5df-a8ae1767bf24", "value": "T139E6335873E011F9ED73923C9EE2409AE1B5B4668F72C9CF0BA447917E132A09DB5723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784969529, "uuid": "7eea9a17-3e17-470a-86ee-b25b6a1c6039", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784969529, "uuid": "31fa8e4f-0d59-400a-acf9-5d61ed292a7e", "value": "393216:PTHrmpdLFv2oeFLTdrvOTbLT3XMCHWUjXAcuI3/PGTAI:PHadLwxdKfLbXMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784969529, "uuid": "2fd0289e-a826-40ae-bd1c-cd8b40cd685c", "value": 14284461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784969529, "uuid": "87c2e30f-e3cb-48a1-837d-1cfc96ead268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784969529, "uuid": "ac8932f8-8c44-42fd-861f-bef22ff8d097", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22478e6-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991358, "uuid": "440db667-f6f4-46d2-a9f7-b976f08aae31", "comment": "Malware payload (Mirai)", "value": "14f451158f405a93f44a4afba6fb456f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991358, "uuid": "117a80f9-e1d0-4081-bf52-f21b10373815", "comment": "Malware payload (Mirai)", "value": "99c3f02b2e8375dba5c7ad813d39d9846e0eb8586db185c34353185d447b36ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991358, "uuid": "9b87e6ee-cb42-4a2c-9784-2b37594b5f9a", "comment": "Malware payload (Mirai)", "value": "c86472893e1d0b92767ce98bb2921ead8e046d0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991358, "uuid": "ae7b0aa5-b417-4caf-84bf-d6488c6396ec", "comment": "Malware payload (Mirai)", "value": "bd00fafa8e84e932067b27b0a5f071f10692af6c438d687e173343f1684d69963f0701a4bdf5d78aab526c5ed3a68076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991358, "uuid": "45d9c1e5-1693-4074-9ae0-6ad4b215063e", "value": "T1C42301E7D397B37AC8B4CD3944E12305DCE238B77618236F85FB62AA6AD7C046914E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991358, "uuid": "3ec9b0ee-c87f-4edb-a434-7c8f3fb3c756", "value": "768:dX9LT9dWvL6YW68wj6IJh9L8Dg+SXgYRXn/21XWm7qiOIlZVUZSvh8i9sr6d4x0b:d9HW0wj6IJhaTAZh1iOIFUopzOD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991358, "uuid": "2238d6d4-b858-4cf9-badb-f4bcebb7265d", "value": 50112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991358, "uuid": "d4b02f46-f112-40e6-96eb-7559981e4cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991358, "uuid": "c5219f78-eae4-44ba-82ff-8a9d56ed6f5d", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f864e2d-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975731, "uuid": "befac799-3d33-4057-9851-d3607b599bdb", "comment": "Malware payload", "value": "412aacc9f186db7e8e4c2acfef4dbd06", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975731, "uuid": "cbff1e7a-5967-450e-9ca6-05b54bfaf9cd", "comment": "Malware payload", "value": "9a2ab45e138cd5903940a946ca3567651c97c13c8d82743112b94ce8d264f20f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975731, "uuid": "61bbc9cf-7fa2-4fa3-bc49-1a7cd30ef3d8", "comment": "Malware payload", "value": "80832a7f75341718e612e806c2c2e20ea2bfac76", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975731, "uuid": "f4bfb80c-5f19-4d61-884e-c27a82930f57", "comment": "Malware payload", "value": "af7ad55b306f32c4e13238b7b85fc8c2906d20cbd7cda5265db7c3cec4453ca2cea4c9be7d366bb89b14cd2594594111", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975731, "uuid": "b770dc14-1d59-46b6-82b7-1c4502994bca", "value": "T11942E0A323D770ABD04E9A7D26D70A468002DAC0CC3698A65B5DF8981CF398975634EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975731, "uuid": "da6cd14f-cc95-4ecb-820d-58399c5e66f2", "value": "384:pqWVm0Mz+Y8XHL6iQR4q5C7TRUsUvsKqvn:9s0MzMXS5CXzesTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975731, "uuid": "2be29bb9-9cee-499e-96b3-88a547732206", "value": 13153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975731, "uuid": "f4dd118f-79c8-40c7-9d71-c7c6af784574", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975731, "uuid": "52893500-ccf4-4280-91ca-6be078d48b0c", "value": "images_20260725_065414.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7a43ba-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975167, "uuid": "aff8e840-b3c7-436b-bb7e-c9ad1a3a82ba", "comment": "Malware payload", "value": "96f639ecb5153ed9cc22a8afafbb9a7d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975167, "uuid": "c0332bfd-6711-40cd-bad6-3f959c287eaf", "comment": "Malware payload", "value": "9a495dba2871ae48cc6f5166e3dfd3bf5deb67472492270404cc895cbe85ca8c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975167, "uuid": "6459429e-c09b-4fe9-b02a-65d5c487f04e", "comment": "Malware payload", "value": "5cb79dfb145ea75fa3c71eea14152df9e4b9f218", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975167, "uuid": "3193e0ad-979e-4040-a4ba-07c7b95e42cc", "comment": "Malware payload", "value": "b2b04fdd856997d79300850042507aad7e6be800dd747fbb142586416dc4ed0f910b277c0ec05210ea6b753c17113a9e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975167, "uuid": "1727004a-a9fc-4fb8-acc9-92f9de3c747b", "value": "T172E19D6641A747D4EA6983750EEC004E938DB4A0134D0DE028CBD90F1BCFCF9B29EA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975167, "uuid": "91ea2387-6490-41e8-a32e-423b38bbbd81", "value": "192:8wkj97FdvDAMSW84YbbwRS2WcHs7VzPSAggkArb/uf2:8HRIMSZnb+JW1lJKMGf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975167, "uuid": "452aa21b-dee2-47b9-9933-1625a9a61463", "value": 7149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975167, "uuid": "f1c4de25-0f8e-4492-990f-ff40252ab57c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975167, "uuid": "da58c390-9aaf-449a-a7e0-ce66f07e0fa0", "value": "images_20260724_121033.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f24947-8857-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785004600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004600, "uuid": "f69baeea-6546-49db-a884-685379264f2e", "comment": "Malware payload", "value": "c95ecf6510b6bfa5105c32f029c6ef2a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004600, "uuid": "0400e4f2-b1b9-462f-a1e7-a659d9e72c49", "comment": "Malware payload", "value": "9aa2c888e7d2a08a0172e9967ce715124ccceddecbaf47a319fa78c6629015b4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004600, "uuid": "26fce919-ddc8-47df-a5b0-85c9229833ee", "comment": "Malware payload", "value": "075c02b15f15af36b8cf119fb997664c173b145d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785004600, "uuid": "f1dfe3e1-eab5-413c-a5dd-19155de8b30d", "comment": "Malware payload", "value": "22816898db73448d67ea40f4251636f32b7f4efcec0d3b1802cb29bd164e5e538792c6f479e0e02e60297fda1b826f37", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004600, "uuid": "82fd3c90-1bc9-49fc-b688-2c71dca950f8", "value": "T136623C0BA8814036EAE14079537F422645BE7CB623C0F8DBF7F0698A59B56E1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004600, "uuid": "48ab52d4-6d8c-4cad-ab44-eb4a41c31e46", "value": "08e71dc3a4ed4919ed4f88f99fab3457", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004600, "uuid": "71210a11-7a23-4187-ab59-3d37d3b7951b", "value": "192:r9BErjXgjo8PEUI+jum8mlzfxmF5oIsGIKUSfEzQiFJxTmv8U9cthm9c+F:wuEItfxmroIEBav8U9cYzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785004600, "uuid": "d5d1f6ad-4645-4e41-8801-beaf76005e97", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785004600, "uuid": "9171fcf9-9aac-48b3-a6a2-0aa1606ccc38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785004600, "uuid": "2ce144d8-d3b8-451e-b5c6-c9ca38095b1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20ddaed-883d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784993425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993425, "uuid": "6a000b06-88a7-4de5-a9e2-b5b43b6b7994", "comment": "Malware payload (Formbook)", "value": "e251d99d24cfbe1e5f90f27a689ed254", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993425, "uuid": "db3d9a7c-741c-43a6-b9bc-afdcbd391ac7", "comment": "Malware payload (Formbook)", "value": "9af63b070d11312cd437d088862a8106f3b65cbe01dd2712d104096058e3482b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993425, "uuid": "1fdbee46-08e4-4679-bf3b-5343f6ae3816", "comment": "Malware payload (Formbook)", "value": "8f47add085b316c074f4d30d9e6d3a43e9024d48", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993425, "uuid": "76885e79-3f44-4650-a8be-cda4c27496b6", "comment": "Malware payload (Formbook)", "value": "6473dbf9584e1dfe959bce324a03b6c7c0f804f8b8a61ec0bec86575acb25085f8362888101d6c71070a281ff787607f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993425, "uuid": "348f461b-c7bb-4aec-aa3b-95ab9d51cdbd", "value": "T1850533A6F255BD0AFEAD001E281AD453057763495DE518013B9C7FEFFF1A294A2C23B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993425, "uuid": "bea0164f-cbc9-4caa-a594-2f412f49c7b0", "value": "24576:otgMSVOZaTvNmn7Py3cMFEUApHFMb4Ujm05po8LD+sMf:Ug1oZB7Py35EFOb1jm05q8/+7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784993425, "uuid": "814cf539-8213-4eb5-8eaa-b2cce7874f99", "value": 846166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784993425, "uuid": "3dd56ef1-b72b-4710-ad9e-2c53138775e6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993425, "uuid": "599d8e9a-d543-45e0-861f-15242d8989ac", "value": "RFQ FOR PURCHASE OF PRODUCTS.PDF.RAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a760dbc-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784990996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990996, "uuid": "ca7de1e2-1200-48f5-ace5-84336aa2311a", "comment": "Malware payload (SalatStealer)", "value": "8cbef6881dc0e6869634c1c719220912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990996, "uuid": "6c49cdce-4b70-4201-9dae-3198b878c99a", "comment": "Malware payload (SalatStealer)", "value": "9b09f24903d7f94aeeb26b25c495f256692322a99e650fca4e886fa90c94b2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990996, "uuid": "0bd27ecb-d7b8-44b6-a9a0-5a1b832acc25", "comment": "Malware payload (SalatStealer)", "value": "8edc94d8b08d8d8e9d4c9a76303260230ab518e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990996, "uuid": "71d3c0d3-1cab-4620-8d24-ba98cc0d2632", "comment": "Malware payload (SalatStealer)", "value": "5f73f5ec09c614d8b0bcab6c8346ce458db48f7514b3bd152d18034dedd4218dcd3e8cab5204e2758bf5adcd9a9f4210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990996, "uuid": "c56915f3-2900-470d-95e1-68493246feeb", "value": "T15CF533296193C26CDB300FF0C3D957A635EEA75612DEC951306D6B7253A08B69BB8C0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990996, "uuid": "5c83697b-2f6f-4e7a-96a4-b691ee877e50", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990996, "uuid": "dfdb086d-a821-403c-abdb-64f7c33533c0", "value": "49152:xEE3SJtSYiPg/YR8EmoVEUkwfSY3kI6C5e9dS7cpN9Mzi4FqDHOP2Q7/DGoqcdM:RSbx4WYO+E8fS4kIRe9dSEN4SH4nhD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784990996, "uuid": "5dfca8b2-42d0-49e6-8131-680911d07dde", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784990996, "uuid": "d16b1717-5d07-4a9a-90f6-b951fab84ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990996, "uuid": "c30dcea9-b01e-438c-aeb9-0c4ff222b013", "value": "Flex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec453cd-886c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785013713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013713, "uuid": "f023eb8a-6514-4971-9922-31057acf06cb", "comment": "Malware payload (Phorpiex)", "value": "e55393f22a1baefe9348c497f82270ff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013713, "uuid": "287a13d5-9fdb-4176-9b98-8f9ffe63d4bf", "comment": "Malware payload (Phorpiex)", "value": "9ca662bf15428a6d68ce134206cdaac5a4f5146ea6e8d3637a33627487106be3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013713, "uuid": "5dd7f11c-219f-4634-b350-9c9679bec9fd", "comment": "Malware payload (Phorpiex)", "value": "a1803603524108ad1a4752c5b991aef2bda7c602", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785013713, "uuid": "ce91586d-d644-4a5e-a7e8-3822229c4c5a", "comment": "Malware payload (Phorpiex)", "value": "4dc2efb1779a17480f4111ba4dfa989f5e9f8a6efc8d6c9648f3108ed3b26dfc35563740b739163b94fcbeb1cb761a99", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013713, "uuid": "7f8cd8f5-5dd0-46f5-ae2c-07183826cb56", "value": "T179623C0AB4808035EBE14474827F526645BDADB623C4F9CBF7E0648A5AB46E1F83116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013713, "uuid": "106fc8a7-335b-489b-811c-73df61d51d6b", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013713, "uuid": "e592dc8e-4864-42d0-b2d6-22d5290d67bd", "value": "192:AW9sGnjXgjk8LMRI+wBdzMRJFeIFFBKUSfEzQbd1gJxTmv8U9cthT9ik:AMSMygUlEOyav8U9c5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785013713, "uuid": "4600b87e-5c07-4564-8d1c-a0263c4ce87e", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785013713, "uuid": "09dd0ec3-f878-4957-8d78-563cfd370ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785013713, "uuid": "8df87be7-01a8-47fc-8e40-4decbee3e785", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fa738a-881f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784980329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980329, "uuid": "d2d50bf8-84af-4f6f-af21-e76a6c01184d", "comment": "Malware payload (Efimer)", "value": "445145d633ac80e6149cdb46374f2f45", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980329, "uuid": "a5f70390-b633-4c47-96e5-5f4d7d533e4a", "comment": "Malware payload (Efimer)", "value": "9d213d633161dd70b082f47ff0a55cacdd37e871af84e9da17f8ab51555d764d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980329, "uuid": "1bf497aa-a2ae-44d6-bd74-b4bc47c28057", "comment": "Malware payload (Efimer)", "value": "c636be48524f1512a991121fc94f12c98c615907", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784980329, "uuid": "bb9fb544-137c-4968-9fec-ac7e68be511b", "comment": "Malware payload (Efimer)", "value": "44dee8a83131de399bf4f6500900272e56c620842e6ad153be80a8ef67db45857e4790807569117a172220fe6debba2e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980329, "uuid": "d15c98fd-cde2-4642-b678-729387e5cc3c", "value": "T107E6331856D611EFEA63813CDAF294A5E2B6F4761B72C5DB46E482607C170E04E3EF23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980329, "uuid": "d1ab1879-8456-4346-b83a-08bf643e36ba", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980329, "uuid": "a001b678-93cf-46cd-bb0a-b21c40777fbf", "value": "393216:BQVNtMrlB93azLHD9Ka1wRwDoXMCHWUjXacuI3/PGTAI:BoMxB9KxKuoXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784980329, "uuid": "2514d6f7-70b7-4566-87ea-253e57d9a694", "value": 14272394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784980329, "uuid": "abfaf639-ca9d-4680-b8fa-ce52c76c9f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784980329, "uuid": "995c85a5-324c-4831-932a-cb6569cb573b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651a0aa4-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973942, "uuid": "97ba4c82-a513-439d-bf5a-caaf5f5138c1", "comment": "Malware payload", "value": "d0c5d1743fdf6c5e410ac1ad8e10a760", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973942, "uuid": "ad2ce597-3d50-41ab-aca7-99bd59577694", "comment": "Malware payload", "value": "9d21f632e535adaece073408e7c95c9b828e4b7c72d1564b1a86713eb934d063", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973942, "uuid": "49199179-396c-4dcc-a493-64bb0061f861", "comment": "Malware payload", "value": "ce60335e548a1cd9422bc7f3f1a1d8682ae93cce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973942, "uuid": "19f0caa5-72e7-40c5-ae57-bd888de7b728", "comment": "Malware payload", "value": "5432dd5aa24a6b1e5bcfe12baa323a92ca23df4e82accc67368326fca76f71b1ee192a4192d50e99f90f4dedb98890bc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973942, "uuid": "41e1d89b-3516-4b59-8168-a95a215a6580", "value": "T17006BE4AFB489A6AC0F3533A0C355A61411B8CA68F83D7837D64773C59BB9C41F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973942, "uuid": "626add9b-cc16-4202-9a32-a53b4a9e654f", "value": "49152:+7Hm1ij3XVIfdnE7NvPmSSvFMT9/OFz6GzZ+B9u5qgn75jhdk9Fq8Gawhvcm:J1ij3XVIfdnEZs+Tm6GNOYqyNAKVhUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973942, "uuid": "c3e8fd29-de0e-42ab-b08f-b1310ba56cb4", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973942, "uuid": "60fed961-2e55-431c-a063-09c5e91069aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973942, "uuid": "5b92d4b9-3a07-4807-a598-c52e41c30533", "value": "variant_06.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f48e50-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975748, "uuid": "22947524-4303-4db3-8ed3-62e104111a34", "comment": "Malware payload", "value": "0f3ab74140d67bcf4c4f45d8dcaf283b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975748, "uuid": "180e67ff-9c57-4a3b-b26f-b6db07cfec46", "comment": "Malware payload", "value": "9e2f96680c4c9a204d5ea9bf390f2fe4d4aa4e9ba23ce7641c1a8f19326168b1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975748, "uuid": "9b18cce2-dd5b-4fa5-9b19-922c5bd188ee", "comment": "Malware payload", "value": "3ff4b3f6b4d88acfa3f5e18d56a72286bc612cb3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975748, "uuid": "133de2cb-fab4-4007-be80-71e622c7e4c5", "comment": "Malware payload", "value": "17493cc318515d534b0089d8aecccf37bbf02ef85fd2ba558c13910f6954a14dc3fb85fcbd96218ce52e56c9e49dcede", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975748, "uuid": "23d5483a-ff48-4ce0-a1b0-14ace5aaba71", "value": "T108917D9EE00D08DFE40E92B49C93DB7AD7219BA21972C1E6050B9A6E013099EAD4354D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975748, "uuid": "3eba23f2-bb6c-45b6-87f0-451cce76caab", "value": "96:qcnkBJQJueVfzbMeUPbrWPe3zNYG/RU4mBd96hJd07jps:qcnkrQJueVuj/Rdm96hJcjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975748, "uuid": "b39c7967-08b0-446d-8908-2e36cbce7b7b", "value": 4479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975748, "uuid": "5189cd87-af44-4661-9f7e-54e13f2ecdaf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975748, "uuid": "d05c5839-87e7-4ac4-9fee-9b73b99da485", "value": "images_20260724_160644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0541b690-87f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960896, "uuid": "1dc85cc2-1e77-49ff-a891-ea70e8eae355", "comment": "Malware payload (WannaCry)", "value": "88789a1cc82d672509fc1ce33dff1fe8", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960896, "uuid": "a5966346-e797-4514-ade4-dc3c4f38d60e", "comment": "Malware payload (WannaCry)", "value": "9eacc45bc8c6a2e4954e116d9cd8add64f89e14d1c7d6c1c0027ba6d93c6086a", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960896, "uuid": "c3e55305-d3ea-494f-b5d1-cc07fe6bcb80", "comment": "Malware payload (WannaCry)", "value": "7a4a94471e49b12f6482b9f64fdd0cc4982dc431", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960896, "uuid": "7c82251e-97ba-4b1d-8fee-63ef4a01f6aa", "comment": "Malware payload (WannaCry)", "value": "cc456cc263f1bf3d5a6dbc67d53493dbdeae94c8f8c9d96ed5da3f825a53f37a11ccae729c08b3844b985902bfab0d14", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960896, "uuid": "179b362c-3063-49b8-ba32-75024df915d0", "value": "T1A2361259336C81BCC11B523494B34D26E7B3BC5A227D970F8B948B6A1E13390BB78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960896, "uuid": "090ea15a-e0ae-4122-8904-f13e60e4076c", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960896, "uuid": "ab05ca77-ecb1-405c-8275-bab0a006e186", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLgWbLgddQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960896, "uuid": "12deac63-1c37-4ab5-899b-b5809da4344c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960896, "uuid": "ab937b0f-a014-4169-909f-8012a28471ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960896, "uuid": "dbe7ca2f-6459-46b2-b608-0e58029b4ea8", "value": "9eacc45bc8c6a2e4954e116d9cd8add64f89e14d1c7d6c1c0027ba6d93c6086a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb5f0cb-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975219, "uuid": "c1b2ea9c-0286-4bb1-b6e9-ba994f88e976", "comment": "Malware payload", "value": "dd9e23954e0f237c9f1cd47884d1e765", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975219, "uuid": "3d2fe8e0-c0e1-4c9d-bb2c-e4472dade690", "comment": "Malware payload", "value": "9fb6ca99b79b069afdef165df97ae2055627f10c844d9e919cf3793fd08094aa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975219, "uuid": "8c9ed7a3-34bc-4d8d-badb-76450abb408a", "comment": "Malware payload", "value": "3ce5336e12c090886d3b7452909638a58e58b604", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975219, "uuid": "5b847669-2e9a-4775-a24d-031bdfbc92c4", "comment": "Malware payload", "value": "df08e0387a287d77f50053999e59e60b0f62bf6c6500b4987360a2700ec82750b487877ca0a4a4d24b7277284951275b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975219, "uuid": "3780bbbd-b21d-484d-8112-db72319247d0", "value": "T1D4613D1F15CF6D93CA32AFF06EF615655600B5D549E5EA572DC8C15F049C47407326C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975219, "uuid": "2efc90b8-327e-4d67-880a-294d5ee4129a", "value": "48:95WbyB5eFgXm4pQ0Njg6QDy9iur5URJaQg9R7LqFDBI/3yiAKdOH/1YoXtr6VKMH:bWY5JXNQ0W6cy9/aLAiF12iVOOiSVcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975219, "uuid": "6a1719cb-3457-4a2c-8c9e-2e54638f854e", "value": 3221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975219, "uuid": "42758b91-b48b-4adc-ab7f-6d100cb6d5b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975219, "uuid": "5c77bbc4-2fea-495c-8296-c51c7eee1568", "value": "images_20260725_043033.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4311931f-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975603, "uuid": "c1c47266-a3fb-42b2-b200-4408edbc6371", "comment": "Malware payload", "value": "68c5f565edd7d0d287ec139c06d54424", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975603, "uuid": "2be351da-0f38-4163-a2b8-1f7f02519391", "comment": "Malware payload", "value": "9fcfddfb4d184bf71f2499a6b06ee36caa480879aa463a5b95f2da64c077c123", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975603, "uuid": "876c4c40-4a80-4745-a84c-8c0544c0f4d7", "comment": "Malware payload", "value": "db08ce97a2d94ebad2a8da1a2e8e97f6d869a529", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975603, "uuid": "2875ecc3-8cf5-42c2-9ad5-89d5428ba912", "comment": "Malware payload", "value": "5ffa71d1c69fc776d3092195a990937a1c1a7a55685bfe32aca6034d5cd070fe7006a8f398a448ff94ded1d0ecd0c3ca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975603, "uuid": "f832e2b7-7da0-4215-b763-90a03bdc326a", "value": "T1AA32CF23DE008187C077A96A190F1BEBDAF0EBEB467A4051F6E44A9E41DF7CEC4C004A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975603, "uuid": "81798301-dfe0-4f52-ad64-ba3c0f60e211", "value": "192:/qxAUg/GbDcb5wArOGCIQ/CT8UukkaH24IRiUunmf2mCzYRKs/cHlSxM9geX:VKabrOGCIQ6NHknnunpXzYRKk8Mx/eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975603, "uuid": "f91174d7-e465-462d-89e9-d92181fb9c27", "value": 11499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975603, "uuid": "c7ac355e-1c43-477d-b7d2-50ecaf5ee7dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975603, "uuid": "446dfbb1-c168-4328-b4a0-252790c9db6c", "value": "images_20260724_235020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4254cc14-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974742, "uuid": "ed71f818-1da3-4279-8d20-ea4fb00b0ee3", "comment": "Malware payload", "value": "6ba9a110afb71d67315260bf2ebd1c5f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974742, "uuid": "0d106249-bb5a-4db7-8acd-0e2c16433189", "comment": "Malware payload", "value": "9fe8c16e233c25cb08d3c9b5237a750e9a6658f2692a23304ab82390a0a8670d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974742, "uuid": "57f5d6b6-4a7c-45bd-8b07-eea2b6a9f0af", "comment": "Malware payload", "value": "e16f8e539dcba6eba18a4385b4c85f29d952dcb2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974742, "uuid": "4426aa35-7e0b-402b-906d-0b5d665142ec", "comment": "Malware payload", "value": "456e8796fb0c12856371a5b1c47e2ca4b6345a34dd9112ec52cbd5d8c3fa1df68bf2bab11909b5292d8ef2b17522ff32", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974742, "uuid": "975d86d7-001f-4ea6-9e69-0e0e71686005", "value": "T1E402AEFA96ACAE80E9638376E5057A5D0714527A99B04BF9341ECD2E62CC04B884B948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974742, "uuid": "818646ea-c2a2-432c-a34a-e1685ee8715b", "value": "192:4gZLgaIzMDJRyA9IrSebGliVPNQZc8u9FNDnHjComcL/gmRE5HWLlwb:4SMaIzML3sS6eVaDHWkER6wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974742, "uuid": "1947f115-5c2a-4b78-9b8c-acdb915a8cbb", "value": 8738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974742, "uuid": "08d29b4f-fd93-4841-a2b2-78c38d73d476", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974742, "uuid": "da0976f9-6305-42ca-a845-b75aaa609014", "value": "images_20260724_183320.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7e1e84-8859-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785005552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005552, "uuid": "8a0d8f17-00a0-445e-b4bc-aa588f054468", "comment": "Malware payload", "value": "f64c86017ea3629c645c5695e4dd136b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005552, "uuid": "d83f57a4-ee44-478e-b9ed-e9ba7d78e3ba", "comment": "Malware payload", "value": "a007111bc2e22b8f34440012d21d7e265d0c349b9e2b2aa2568397238974ec08", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005552, "uuid": "eef29501-9622-466b-916e-27f138b584da", "comment": "Malware payload", "value": "c6eae2916af4e8603c51e6b27b6e6f8b068284b1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005552, "uuid": "3bb1be08-d656-4224-b6ff-bba2945a1977", "comment": "Malware payload", "value": "b5a343afd2437f40a0409f27a851f8b3756ee545f4fd84753d46d7e984abab6de88f21665d116e29873bef7ab59b5bf3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005552, "uuid": "537115f3-7d1a-4f1d-97eb-e2c6667760e5", "value": "T188E6335864D413F8EAF3417CAFE18692E558F8B42736C69F179403A17E232E14D3EA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005552, "uuid": "8059b60d-408f-4f6c-a8e0-e7e1f4910eb2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005552, "uuid": "956b6733-c24c-4975-b84e-356fbbb485ed", "value": "393216:d4EIFrol2nfRUTzdKWmLg+iXMCHWUjX4cuI3/PGTAI:dGvfRUTld+iXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785005552, "uuid": "505db407-44c9-46db-bdc1-06b88532c361", "value": 14337245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785005552, "uuid": "5cf38a3b-2dce-4f11-a62b-679579594b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005552, "uuid": "854f183e-9426-4714-8098-cd7ce1545abd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0250cc6-87c2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784940594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940594, "uuid": "2a7b8d22-ebe2-4fe9-a9ea-4cdea629529b", "comment": "Malware payload", "value": "f8ab10f5dcbfffc42956cc8be216c749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940594, "uuid": "670a3ad7-460c-4564-a3a0-17bad7d7b916", "comment": "Malware payload", "value": "a070c6eac116bf1bde6a6e7da41a55d446f4e87a9ed01dd6ca3ff3ac45ba7195", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940594, "uuid": "0d98a8bf-2736-4e0e-9c6c-909b963ba42d", "comment": "Malware payload", "value": "91b2e39dc1ea0d3f0612e159e1bed97883913c81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784940594, "uuid": "ca658db8-fabe-4f58-b834-10e13394a706", "comment": "Malware payload", "value": "d30c9bcc2e720a3f02e7438c1b1d1bed264a4ef84a5b74a1539f273efcf3f8a1522c4a0e2d8891acdbf9b2cc8018e610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940594, "uuid": "0c2113ad-6ded-4496-8352-e0fa63ef3a80", "value": "T150163393975E1B42EC5DA5BB9028F1F8127C2CE11D3E12AB26F6AD317957201B02C97F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940594, "uuid": "248b308e-062d-4ca3-98a4-966215c698d6", "value": "98304:DSdy1MOMaT7tOt2btAOFbF40CbRDLelyU4n68FRHI+Gl7Wzl:gyGS9Ot2bq+bG0CbRDiAUKlFel7Wzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784940594, "uuid": "89316f21-4db6-4c16-9477-2e4a6ca17b95", "value": 4181886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784940594, "uuid": "a7b40761-b03f-408a-98a6-bdd5a84a19a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784940594, "uuid": "9a6ef5d1-acaa-49ce-aedf-e91b61e08048", "value": "perc.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ebe7ec-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784977143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977143, "uuid": "149915a4-da7f-4990-8dc8-ac3e14b479c9", "comment": "Malware payload (SalatStealer)", "value": "b4a65477542b3799b10940edaca3067e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977143, "uuid": "b8fa5dfd-1a94-45a5-9f9e-8f6fbc2d29b0", "comment": "Malware payload (SalatStealer)", "value": "a0c5ebaa47f0cf3d8cd695d66b8c5e5561afd30da1b2f4d73f3736dca35efba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977143, "uuid": "f84cca86-186f-4935-9f5a-81d3f01cbf4c", "comment": "Malware payload (SalatStealer)", "value": "61c777c5071c8264412fe317f30e5c493ac7cc76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784977143, "uuid": "9ec5690b-8bdf-4e43-bc9e-63ee961bbf8d", "comment": "Malware payload (SalatStealer)", "value": "18df780795e023fc28b96f28c2146612e7f9d5c35eda71aaaa8196efe48c2efff948cfb64894ceac50df7813e81d7d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977143, "uuid": "0bf3f8e1-0ff1-44c9-958a-347f02a4b358", "value": "T14E06330BF7AC3A15D3654BB116824533D631B8F58BC183BF479EFDA89E531E1A13848A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977143, "uuid": "2c9ca07b-e7bb-4a9a-825f-4e90f815ca8c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977143, "uuid": "fe985b7a-b605-4b1a-b838-d3e853e2770b", "value": "98304:7lg6xQaszjML+D3srjGMgTGC1QV6hybf4oKb/2:5xyzjF3snHSb1W6h+f4Db/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784977143, "uuid": "7e706e07-ad69-4216-b5e9-ca440c6eae43", "value": 3755008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784977143, "uuid": "9fca27aa-0bb8-4098-88d0-89c35a26a3f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784977143, "uuid": "c9cd6b28-259a-46f1-857e-9dba051e8d00", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e350242-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975675, "uuid": "f17e6fda-0909-4bd7-a9a5-658ef47a01ca", "comment": "Malware payload", "value": "55b736682ee195ae107814e4a84ce550", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975675, "uuid": "4724e36b-c0f9-4139-b2dc-49c457c65a06", "comment": "Malware payload", "value": "a167dc1225e802b71ff901fb164457a948e69571cb6b358404bb3a3aec1be473", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975675, "uuid": "a05ef709-4e28-4f0b-9d52-1ec059a7f5bd", "comment": "Malware payload", "value": "a56b30912c914acf9ba24345d4742a90aba87697", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975675, "uuid": "1f8c9227-6537-457d-a0fb-9993c910658d", "comment": "Malware payload", "value": "3e6b63e17cb024089e5243c501f5e684195d77bb5d44f3c7544778bde5899133b76ae3ff4ab6d0c88a49fce51cebf338", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975675, "uuid": "0d205f72-1f24-40ea-b7c4-90e98e2cc857", "value": "T1CD42BE76C3C3464CE9514B78BE3EDD7BDA54BE888620015157DC0FEB7CA8250AED29C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975675, "uuid": "dcdaee46-7b98-410e-8759-0680480d7085", "value": "192:D3VApOD+iD+Kj6pvOO0KEx0oyq6hX4YUfaD5vMEN4jfLrRKdQS0t6q/q3h:D3yMDIKO9sKaZyqtiD5rN4jtrKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975675, "uuid": "ea0f14ac-6304-4a07-ad10-e720acac8a5d", "value": 13188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975675, "uuid": "b4d8c441-cd2d-48d9-9867-b8811202218b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975675, "uuid": "d1b9f79b-8c05-4eef-aae9-efe897bbb69f", "value": "images_20260724_125612.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6c1f3-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998800, "uuid": "98b48a99-7e89-491d-bc51-f97310d546e3", "comment": "Malware payload (Mirai)", "value": "15aa882b9093ec46b91c65318d1555d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998800, "uuid": "a8fe0de5-7b53-4182-b323-dcd76bad24f2", "comment": "Malware payload (Mirai)", "value": "a1c56f08572af0a55fd0756b613047cd3da1c78654a06952f7fd9621208a88e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998800, "uuid": "f6bb37b6-3d7b-459a-a7e8-a00bbccb17ce", "comment": "Malware payload (Mirai)", "value": "87065e63dce3958fea3b161b0fbae9b7b6954e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998800, "uuid": "cd2cb6de-36e3-47fe-bcdc-0b862dfb8953", "comment": "Malware payload (Mirai)", "value": "1a2ee73ab71b60d36ee5324b87d7439cd241c12f5f5d7e63e030d017422a739b2612455a5ae39d96d12d37563746cd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998800, "uuid": "feeb5397-9564-4e63-ab0d-0f1f0caf9a68", "value": "T1A9931881BC828A2AC6D4237AF66E328D3761B3E5D2CF3117DD214B12778518B1D67FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998800, "uuid": "d7df9e1b-2311-4997-bcc7-44b40089f3de", "value": "1536:/MVGhGaG08HQleJNHixp38aPwG9FJ633L5C41KrOOgHbn2n:/MVGhGa4I9ToZIzgHb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998800, "uuid": "649a157e-bbe3-4f01-9c96-a9d3065f08d7", "value": 92024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998800, "uuid": "fdd758dd-d574-4a03-b00c-5f103823c55d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998800, "uuid": "a16dbe16-1211-4198-84fe-4871fdbcb9b6", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725a744e-87cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784944329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944329, "uuid": "36914bfb-eae9-42c2-9c8b-d853b40eebaa", "comment": "Malware payload (Efimer)", "value": "9e41da0196e855e4158571a825fc6b9b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944329, "uuid": "3db096be-b9e7-40e0-b61c-85f145947aaa", "comment": "Malware payload (Efimer)", "value": "a1de5689c1841eb293764207f942b9dba58517e1cdf3cb82e219a98068571436", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944329, "uuid": "092457c7-cacc-41c2-8366-aa2eb1726093", "comment": "Malware payload (Efimer)", "value": "0ad012c96ac237e4b0031bbaeb2af048f4cd4d1a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944329, "uuid": "ba819f48-6786-4f50-a933-995c7cbdb40d", "comment": "Malware payload (Efimer)", "value": "6b708c98b8d466b0e88c64eb1fa004bad25fd489792538c41693940279588c2147a2120e74283627636cec83de4c19a4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944329, "uuid": "afad057a-85ba-43d2-a37e-1fdf00945808", "value": "T1DAE6330C6AD037EEDAA2613DBE928181F666B4660737C7DF979893673C531C0883E617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944329, "uuid": "85659ca2-4e28-44cc-8e63-920bc9477a34", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944329, "uuid": "ca7bcaae-e6c2-46c9-8ec1-1c4fff56755e", "value": "393216:nL7V1oQ+aTVCyNd3qI1ex7OnXMCHWUjXmcuI3/PGTAI:nToQ+aUyOUnXMb8XbH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784944329, "uuid": "eeb31f7c-e472-43f6-a06e-fe151395b46f", "value": 14302768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784944329, "uuid": "876bb723-612e-44e9-93c0-7fc24dae7267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944329, "uuid": "646dd2b8-fe19-43fe-b716-faf908d153bc", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf13bd23-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975811, "uuid": "5257110c-b54e-4bab-940e-6aa14382bbb8", "comment": "Malware payload", "value": "dfc125fcc0cdab591d14faab569f06a8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975811, "uuid": "7b238c3a-6b5d-4bfe-a893-d61fdab19740", "comment": "Malware payload", "value": "a21a1a3c4b3f2973fffc3c6d983de0ec0a81425286583bd32ff5d77330e6305c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975811, "uuid": "0c53d6e6-b0c9-4ab2-96f6-360c02ab7e98", "comment": "Malware payload", "value": "5a43e568eaab7972bc5b7075a632ec561a750e1f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975811, "uuid": "e8a11acc-d59e-4187-8c05-e37078b0daaf", "comment": "Malware payload", "value": "aa478226528fd3514da9ea860876ee12cdc1ed2fc2eb0066e7cb378fa4b41fb9a270bc0039fcef2d6450c3b44d19ce00", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975811, "uuid": "d06f3ef1-1368-4435-a9d9-0bf370a357ab", "value": "T14AF18C60CF8F4A57D4572675AB96CFF910A5D2D8DB8032428ABF350D7C56831A044B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975811, "uuid": "4ded1bcf-10c7-4777-93a7-22072e0cea9b", "value": "192:P646K9ClajnwC3sQtpmhqr3NTAVcNa05SwESaPK1:P6fUaajnwXQtpr3NT+csMSway1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975811, "uuid": "180c1c7d-5e89-4dcd-92f6-9523933a0ac0", "value": 7496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975811, "uuid": "afe5a21f-d31b-4928-9535-e796db923b3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975811, "uuid": "6b6a773b-1b77-416f-90a6-d700226229fa", "value": "images_20260725_060756.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2aebe8-87fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784964716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964716, "uuid": "ba640124-421b-4e58-adbe-3f8a581b09db", "comment": "Malware payload (Mirai)", "value": "b93f9d3c8a9f3511cd6ca8076d21a4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964716, "uuid": "e7e15a3e-c1ef-4b31-9767-29fb2eb4171a", "comment": "Malware payload (Mirai)", "value": "a3105c11503aafadb7f6dc45a811d6eecd7610e8f261ec7c475f5e0c2fd6659b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964716, "uuid": "983da926-16b5-46ff-bcf3-95c5904c44ee", "comment": "Malware payload (Mirai)", "value": "ca6a75a1c3c75b3d128a7a6b059acbbc788ede01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784964716, "uuid": "84adde37-8356-4c35-9ab0-4be5fdb92123", "comment": "Malware payload (Mirai)", "value": "31d136e1903b7e6af9fb81b5287c6a402e8e381600450e3ac6a44ea8e80b0b2a1329a239fafeddb64ff0f44a1319001c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964716, "uuid": "e7cf6a7e-01ac-452b-a986-5d4949c3fbb6", "value": "T162832A02B9C085ECC189E138077F763AC425F1BD627AB2D73BD5BF1A2C19E501B1EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964716, "uuid": "491172f2-3ce2-46fd-82f3-114fa4eb03d9", "value": "1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQEDdiqYRKROE5MgU:cHBePDNnlNub63gbyL/Y2hMs5DdiqdRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784964716, "uuid": "5e752f87-7da8-4ad1-af9a-0e2260a8e776", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784964716, "uuid": "29e1a9cf-9999-4928-8567-f758ecaeefb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784964716, "uuid": "eec5775a-0ef7-4b00-b16a-85bfe88ba8f6", "value": "a3105c11503aafadb7f6dc45a811d6eecd7610e8f261ec7c475f5e0c2fd6659b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500e04e3-87dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784952002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952002, "uuid": "1f70db1a-f7c0-4187-a078-68ec6a1b7f63", "comment": "Malware payload (Efimer)", "value": "502df189158520e1b9db733aa43c9237", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952002, "uuid": "8474a147-88de-49b8-b476-e7e40ffeccac", "comment": "Malware payload (Efimer)", "value": "a37c44ffce6a8064f8a0a46df19dd40f696b4e0ea749b8102fe125db65e383f8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952002, "uuid": "bafc7a81-4a4f-4228-8270-ac24c8ae2e41", "comment": "Malware payload (Efimer)", "value": "2a7f63abc4a9b290f933314b64bd5737b1d68abc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784952002, "uuid": "af6ff97c-5cd3-4b95-9519-f6532350415c", "comment": "Malware payload (Efimer)", "value": "502d7d349e7c7b173bd2e68816200dbae12bbdf4420db2cf8cc7c128f0c1eb2e85fcb144b66f2172d93c7be27c914cbb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952002, "uuid": "f1ab32c0-ffbf-4faa-a093-46835df4dfdb", "value": "T15FE63344A4D456EEEAB3413AD8F29255E468B4A70B72CBCF5A34D3956E530E0CC3DB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952002, "uuid": "3813954e-3218-484c-9bc4-2554e31e95dc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952002, "uuid": "12d74937-13b7-448d-a060-cdadddc1ca4a", "value": "393216:osiMq/aR04P1QF633kZXMCHWUjXkcuI3/PGTAI:ozLiOU1QgqXMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784952002, "uuid": "e9589982-33d9-41e8-8ca5-1730ba3c4f2d", "value": 14312858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784952002, "uuid": "00535e8e-337e-4cfc-aa40-4df4b4541cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784952002, "uuid": "d1c72d92-ed48-4dd4-a663-5ce71d74b183", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892ea53a-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975291, "uuid": "b79c2c6d-4a3b-4264-9730-d681c4188482", "comment": "Malware payload", "value": "0e56bf981da43ccc3ec1ff984282f937", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975291, "uuid": "6d782ec9-378a-4433-8e97-93eb82064adf", "comment": "Malware payload", "value": "a38aa47ef6eeb68614d110306492e90259f854e8b22e1fae16c680b961fc85e0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975291, "uuid": "0c06c45f-912d-49bf-973b-459633bb44a3", "comment": "Malware payload", "value": "0bfd328ff4b31af6e318c1aac7facfd3315c5a34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975291, "uuid": "dd51f6d7-43e5-443b-aa2d-6fc18d0c5953", "comment": "Malware payload", "value": "0e63abdf5bff6dedd25831532f64e0b21023a73c9f21f8cb0de007d27d9ddcaa23edac7c6a168043dad829451dca1e7a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975291, "uuid": "288039c4-1720-468b-b84f-33f4ebaeefe4", "value": "T10F72D07004669D47D2F78AE03FBA090EAB6B0E407C879668D452B5B50E97637D397B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975291, "uuid": "192e491f-f623-43c2-a6cb-4e7ca01027aa", "value": "384:a4p2q8YvqG3lvDAEWgbgfH0829A6WMa8v8+F5H3gWussq:jqGlvv2082+6fO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975291, "uuid": "fe127d1e-8a96-474d-9c9b-54e44bad7eac", "value": 17403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975291, "uuid": "f7b23cc9-177b-4c48-807e-f024c7dee01d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975291, "uuid": "846592ac-ec6b-4ca1-9aa4-67123963afd0", "value": "images_20260724_110049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723ed83c-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939175, "uuid": "36582273-698c-4ea5-be04-2b6ee21362a6", "comment": "Malware payload (Mirai)", "value": "adde27e08b3c94ef9a9416872ba4888c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939175, "uuid": "eaff1547-400f-4bcc-9f3d-a2da54d0204b", "comment": "Malware payload (Mirai)", "value": "a4f131af7ac03fead82f8a9f7049391b363dcabe6429b6ac6d5136965e192fed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939175, "uuid": "04f53aff-eb98-4ee4-b2ea-9f7e4720a376", "comment": "Malware payload (Mirai)", "value": "119fcae316b5eb72516a29ba066363e0b272c1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939175, "uuid": "2f961d2e-d595-4fce-8fb0-8b95c33dbece", "comment": "Malware payload (Mirai)", "value": "f75bde18a10889501868501846717b5c3f9ce0536cd5795ec3890cc9770b44e7cee0c3f5b954ac640ff7896f939e1772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939175, "uuid": "3ad45084-7ea8-4ed1-bce6-9d5f7401a999", "value": "T124C32A41F8829622C6D717BAF66E21CE332163E9E3DB7107CE255F21378658B0D67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939175, "uuid": "66442f8b-f2ec-4f02-b1f9-26937a68a02f", "value": "1536:OD4vAze7/gUOBeVhEN10hb3j6GuMRTOrvz52/PpBSZy8KSJ1/j3vEczvSHldl:OD4vAJUO7wE0PHSZlDBSHldl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939175, "uuid": "2bc840b1-bc79-4cfa-88fe-e343f73bfe33", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939175, "uuid": "03eaa6d1-23b1-477f-991b-dc6ef814f3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939175, "uuid": "00f3a9a5-69af-4f55-9c68-3f3609e11ec8", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed17402a-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998651, "uuid": "4c2c0322-ad49-41b0-b7ec-595824e63a78", "comment": "Malware payload (Mirai)", "value": "0517e4d80b51bd0611f4494b3ff6e6d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998651, "uuid": "a7e798b8-5b5c-42a3-a9a5-01276a3a5d23", "comment": "Malware payload (Mirai)", "value": "a66945cecdcbd17b30aff446095c7d661a97dfcacdc39b1a4a1de4aa9c19161a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998651, "uuid": "9aa41aa3-f322-4515-a653-092ae5b4401e", "comment": "Malware payload (Mirai)", "value": "0740de66cfbb19cbb7a561aeca722543bdb28b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998651, "uuid": "f4c655b9-a4cd-44e6-acaf-5092c8d634c4", "comment": "Malware payload (Mirai)", "value": "a1b2b3b143a004c9cd8d5be96630555618bea41f11fe60a11d758347d0d5703562f9e6c4e44c923da2c5f3689e1986a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998651, "uuid": "6a4c35f8-2710-4037-a473-ebc09f89e33c", "value": "T1E6C30802B9C18DFDC089C034577FB93AD825F0DE0239B2AB6BD4AF27694DE901A1DE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998651, "uuid": "f1e94933-13a4-4ca7-ab23-2683b06794d1", "value": "3072:9QUXFHNzBNaH/41XvHWCh690jCCqRTdJrTqytsXBmL:6UXFtzBNaf41/HWCsJrTWXBmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998651, "uuid": "57e95934-821e-4825-b2ea-291d511c58d5", "value": 119248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998651, "uuid": "bf8a5eec-dab7-4b5d-85f4-fe6c340013fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998651, "uuid": "ac88390c-f367-4abc-84b1-057b67d2f518", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4023df36-883c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784992778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992778, "uuid": "dae9b790-e47f-486e-98ee-00acbebdabd6", "comment": "Malware payload (SalatStealer)", "value": "ceb87ea810e8222d416234bed15f36bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992778, "uuid": "d2c4d93b-0d7c-4fd9-aec8-c7ad177b5035", "comment": "Malware payload (SalatStealer)", "value": "a7829a27c6c2f6d93cc7bcae6069a511a4c466ce3b99df09147a741477a4fcc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992778, "uuid": "a4e911a5-927d-45a6-b626-9c84a286cb31", "comment": "Malware payload (SalatStealer)", "value": "fdc8f0f3428d410052019cef3c4a2f8820ade7f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784992778, "uuid": "fcbf6bcb-d74e-43d3-9c48-75138d9207d3", "comment": "Malware payload (SalatStealer)", "value": "7d634951a754931575775c407224fbf2a8985cfea5547333855658e695d166a87f2d12e8a6615c7921ded182677c24de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992778, "uuid": "39adc538-9d6b-41b2-b5c7-6d95e4707716", "value": "T10337331A237884F1E5F340F6C8C1E66AA157BE755BB0C2C361CC5A237F632917E687A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992778, "uuid": "327f0044-e3a0-45ca-8afa-503cb1152fd5", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992778, "uuid": "4e4160bd-f5fb-40c2-8f6d-102040b56a09", "value": "393216:fJXcTKsPORmjdHCrobEkfzZr0iE99ns4XMCHWUjxOrPwJL0mC:BnsPForoIc9As4XMb8xxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784992778, "uuid": "9d038461-e460-4ba9-bc09-9142ff27114a", "value": 23457329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784992778, "uuid": "4cbf7dc9-5b30-4bf7-9032-cbbab49f8749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784992778, "uuid": "bcd2aa2c-7716-41b7-aa15-13e1bd2f5cfa", "value": "ZapretSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fda52b8-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973960, "uuid": "0b361577-4899-4411-a49b-56be3bb967c6", "comment": "Malware payload", "value": "bec3738288f108d4d9f983817c246838", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973960, "uuid": "0621f6d5-b583-469f-9e42-630ba6c6c068", "comment": "Malware payload", "value": "a79e64478d72b40b5b54c8ce58b216eab1c5d69d3d9b935961e81d8c7018bcfe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973960, "uuid": "60b6415e-4f2f-4bbd-a078-455dba9175af", "comment": "Malware payload", "value": "3eee1048e4bcc623dbe35f77a0e74795435b4189", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973960, "uuid": "25d6617b-979c-40ea-b667-f309fb8425db", "comment": "Malware payload", "value": "e4d31d73c955f4bf9b058ca8209d55a19cd1f0088c0699e378eb99fa5e1bada2ca31be5cb9abdf490d679a031d636384", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973960, "uuid": "48a0e1fc-24be-4475-8acd-700aaedba582", "value": "T13306BE4AFB48AB5AC0F3523A0C355A65411B8CA68F43DB837D64773C58BB9C01F5AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973960, "uuid": "933f1c33-cbad-4e98-910a-ddd1448dbe09", "value": "98304:L1ij3XVdIkYEZMrTnq/oFcmD7dXFnDsN1w:LOLafR+mDkN1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973960, "uuid": "81209c66-3d5a-437c-9a66-f985eacd47c0", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973960, "uuid": "a68d72b8-09e6-4259-b668-ab0936bc149d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973960, "uuid": "cf7ebb65-a4b5-4c6d-b1e4-31cab3cd2af2", "value": "variant_09.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2b533a-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974709, "uuid": "d0ab75d1-ad30-42ba-842e-f0e95f2cad73", "comment": "Malware payload", "value": "82de37c1caa86df521bcb588137985bc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974709, "uuid": "83076ebc-26bc-4d2e-8d17-b350efd2d375", "comment": "Malware payload", "value": "a8b1fe22429ed0bc451405f402cbada1cfa655dead3ec2853fb077c793105fb3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974709, "uuid": "e61a39d3-b174-4d67-bd96-b10331d81a96", "comment": "Malware payload", "value": "2d74c9d17c2d782a4e9418ec76eaae4480a6750d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974709, "uuid": "28a6dc3b-9ed0-43ac-9cc2-0bc44dd1294d", "comment": "Malware payload", "value": "eeb79dcc2b38bb3ef6d1bbd9245219acea7dd08b6f5e725f9000e227946905359efd42feeb27f20c8d2266e016b52b19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974709, "uuid": "457cc9d4-6077-43a9-aeb8-3d1c2efc2cc2", "value": "T125A18D4C298E5CCBD5BF5A65BA4D68724F0F00CD23E274D1F89F1296199BF102419378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974709, "uuid": "c2c35a3f-df99-48e6-ab11-36da3b1e60fa", "value": "96:02AHcoOjczByF5iTTWxsfMThbpKvdNTLW7QQep5ud9fLW:0BHc9Yz4F5WVolcvdsQu/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974709, "uuid": "f2069440-1283-4a3a-b66f-21f3fd13f3a8", "value": 5081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974709, "uuid": "495adc14-033a-45d7-b6a5-263a2e6ebe43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974709, "uuid": "87e15ebf-204e-4666-94ce-49eea02b3369", "value": "images_20260724_135757.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee6ec89-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784976804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976804, "uuid": "d75a03b7-67a7-4e84-8917-c96b6f30c305", "comment": "Malware payload", "value": "562942ca4268d4effb2e5e5083388f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976804, "uuid": "96f50fe1-3407-46a9-a4c4-4a90cf369a77", "comment": "Malware payload", "value": "a91efcf511d1b03a97b82d6ca1e847e85e5063951846fcd727740625dbb95189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976804, "uuid": "9f6f2966-720a-4574-906d-5e69a04f8f74", "comment": "Malware payload", "value": "6193464a6dfd9f31bcf7e74e0a86fe9696004644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976804, "uuid": "aa7ced2a-9be7-4586-a59a-48c8baa0e105", "comment": "Malware payload", "value": "3752495bb6424ffa9201583001fc7297086ecc254f2952f0a502cc3d48d818bc0141bfff80e22653c67b46550f9e7f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976804, "uuid": "a34b7b34-4c69-41ca-bd9b-90b9a637b297", "value": "T1F136E18DA3BA0098C9BB8074C247A617E6B2740817955BDF56A4C7B93F73BE1227F710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976804, "uuid": "cc9bd6bf-b2d4-488d-a746-e973afcd62ed", "value": "989c8cd3a0664eec504541ba04ddbaf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976804, "uuid": "ab4da493-daec-467b-91d1-7da8d29dfd48", "value": "98304:+QSVVuh0TYIVgRR+gCGdebCfjjGr0O//a79ZW52PD4AAtQdgcq/K2:+JVuh0TYIVgRR+ZG8mGB3a7ZPsbOn2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976804, "uuid": "bc4ee81f-272f-4dba-9cbd-254602be79ff", "value": 5227008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976804, "uuid": "726f00fb-0042-4551-ba5d-e998a42c59dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976804, "uuid": "2509abaa-0002-48b6-b4da-72895335b5ff", "value": "SDL3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fef8eef-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984751, "uuid": "958579f9-3d68-41e2-b7c3-0a1b2364bc78", "comment": "Malware payload (Mirai)", "value": "f784829b26da535460dd640dc102c0cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984751, "uuid": "1489bdde-7eea-4ae7-9cff-461194ecc611", "comment": "Malware payload (Mirai)", "value": "aa830216b7d13576349489cd2f13bf038330028d73200c10beb20be93bc986ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984751, "uuid": "29f45eb3-6556-4d2f-bf26-b24b85668402", "comment": "Malware payload (Mirai)", "value": "4bc6a440fe17b94c51522107048e809445a79ead", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984751, "uuid": "47f7bb0a-f30c-4cdf-b93e-078e55dbdf99", "comment": "Malware payload (Mirai)", "value": "44e90fbb3ab6db54e3defd54cc7d1366deb30ffa687eeba3f204b7f167fc69711cb87e573d7b278847bbac4f65a96f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984751, "uuid": "0659b4f3-d0b1-4db9-ae7b-eb66925b0257", "value": "T158F3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984751, "uuid": "8dc02196-4ba1-4d09-bda7-1547fb2e719d", "value": "3072:Xxv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5Wuq:XpEfUhfW3oMJLi7L+B3a9FCBrY43uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984751, "uuid": "591fa980-85ba-4020-a945-eabbd68ecb42", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984751, "uuid": "4b251ea5-9f2e-47ae-a485-7d1b148c83ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984751, "uuid": "5510a164-2251-4d40-8614-977497c0dfec", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b387a0-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975179, "uuid": "43f78bbe-31c4-4be9-a820-c8ad04048578", "comment": "Malware payload", "value": "951abc12a47984de0d62b6b7b880410e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975179, "uuid": "4d6bc8c3-c2c3-441f-828b-75616395936e", "comment": "Malware payload", "value": "aace6b19173ee9c383c2b4c8f08e440bf16c68ee0c3465c9bbf6410e729ede2d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975179, "uuid": "b3ba7d5c-8386-4847-b7f7-d6075f92c98e", "comment": "Malware payload", "value": "127b65d460fe774e30a5898d30119ec3fd4a3df2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975179, "uuid": "712eaf90-c1a9-406f-bd98-1cb8c1839902", "comment": "Malware payload", "value": "45da9d49e0134a38fe4940a30512ff4c0531adcf2b903bc05046e0d6c231a3626eeec6f16836899dffbbccf3c7349664", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975179, "uuid": "49ce6de0-5183-4002-afc7-1682a58e3fac", "value": "T11922C00758E876F6D70A2FFED5C02D64196CCAF18D58F31A5408F218B1F96129E06CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975179, "uuid": "4088ed34-b1d3-4ea2-ab36-904158b09fdc", "value": "192:vMrdWibaddJNtieI9iaj7icb4fQZJ3sBv8L9Lcz9vbboW6PCiHWt/AoAV3u/:Ep3uddJDYAaD4fY3gvicIPCi2NrAg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975179, "uuid": "26ec08ee-1acb-47b7-b843-5eb2cfe27cdd", "value": 10395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975179, "uuid": "928c115a-34f0-42e1-9fab-f687d61da027", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975179, "uuid": "5ad47678-e106-4000-8adb-a69503697358", "value": "images_20260724_165348.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82011910-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975279, "uuid": "05e5622d-affc-4307-a87d-3d152b570d8a", "comment": "Malware payload", "value": "d1c2a5f70c2114497dc77e0a06953cfc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975279, "uuid": "86b2ed1e-083c-43cb-896d-fd64c4eab9ec", "comment": "Malware payload", "value": "ab5b439ab554d50eb5b1e70d530a4a88eca72b111b078a5a636168a5eb6b259e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975279, "uuid": "60b49412-3131-4415-9e5c-1b6f5b0e8c34", "comment": "Malware payload", "value": "801c9605d1c214a095d705f704534342f025dfaa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975279, "uuid": "e6d889c6-b6c8-415f-bd9d-1694218f2c0e", "comment": "Malware payload", "value": "d1841d4a508d96c464b03fe5f69bbcf82ec4e489e7b5d827283a3740b9bd9bbf074c4b3dd55093ca51a590567ac8e970", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975279, "uuid": "335bd7ac-232d-42f2-85cc-a8a1389b5045", "value": "T1F6717D96260B1CC7DC21A37CF7E41A0DB18E5D091135A991B6FDC8380BB7E105C1AF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975279, "uuid": "31c5afdc-f010-4eb1-b34b-d740677ce301", "value": "96:dc4Bp/WciftnrgRTiVe6ktqUCMAc83UTsyM1O+hvmB:vvBilncRTiVuhCMJTFIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975279, "uuid": "560908d8-8688-49e0-b4bf-56828f089758", "value": 3733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975279, "uuid": "50d2f6af-1382-4886-b3cb-f31ba85fec96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975279, "uuid": "5faa3904-1164-4fe1-92cd-82bba664a728", "value": "images_20260724_164313.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ef75b4-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984629, "uuid": "4800cdb0-92be-4c0e-8823-98eed004d97f", "comment": "Malware payload (Mirai)", "value": "bc801c6ed51e7eac85d5a49686fdc740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984629, "uuid": "662e58c9-b5d5-42b6-b963-76521ee56466", "comment": "Malware payload (Mirai)", "value": "ac0c66ae69666045b1be74e366cf6c9e2e975b0f808854583fa5e954b27f8b59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984629, "uuid": "bae514a5-61f9-47bd-9879-803011833a7e", "comment": "Malware payload (Mirai)", "value": "5eb146fedf2ab83031ddb86854ebd9e7fc1890d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984629, "uuid": "5c497c8f-a48e-4ec3-b6c5-e85f5fe93285", "comment": "Malware payload (Mirai)", "value": "42c443caa7964087a6192b60717282e50d35a7edcb0511d2c91994c93c3ffe3970209ec39d300ed3e1dfe96163bb0f29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984629, "uuid": "ff821c92-3eb2-4efc-9245-7937020c6326", "value": "T16524955E6A328F7DF368873447B74A34975D22D627E1DA84E2ACC1041F2434E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984629, "uuid": "4ccd8af0-46c6-4d90-9e28-90578f9f5c45", "value": "3072:sPvQqinW06qBVrDuQ5SPkCekMcJXs9op/rziARom:swqinW06I1DA81qJQ2/rHRom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984629, "uuid": "99169456-6cb8-4d01-9a4d-231b91ac9cba", "value": 209376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984629, "uuid": "70204394-1082-4ae8-af5b-1f10d85bd247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984629, "uuid": "e5ccbd63-6f8f-4334-9adc-893c5db5b691", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c5750f-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975679, "uuid": "36d3ff79-a455-4ab0-8d95-c32881f658fd", "comment": "Malware payload", "value": "8f9b72ae7701b281ce9ef5d033e606e4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975679, "uuid": "4d518e73-1265-40ab-9727-118c54ea9823", "comment": "Malware payload", "value": "acc781e84ec472c335eb32f569b7fb900067e6ef040780ee806f97d3b06b3006", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975679, "uuid": "d91fc5f8-7a87-4c0e-b8f6-5697ce257593", "comment": "Malware payload", "value": "77ab0499ddbd3918e0576e32c05ca3632e82f666", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975679, "uuid": "fcaba25b-d2c4-47e6-8650-b03e158c3a96", "comment": "Malware payload", "value": "301a2bf5b581981ca9d1995d17e14674e5a6cb614d8eed48e8346ffcea52dbb451d7e48eb188d8ad5a61494955b12b78", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975679, "uuid": "6e216d92-6885-4c63-b6f5-3e81607fb763", "value": "T1DF62D119FA85212CFA29B6E091121503CF0012FF41BA5ED6B584B5FE3D1FB88361EE2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975679, "uuid": "820408a6-8d1e-4303-88a9-ff1cf608b557", "value": "384:ByvObsk3XmofvckJOoBBhJMgi2I6GY+cEa9eIg09Pkukr5:BITeCkJr/M9HJmvglJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975679, "uuid": "b1f9e330-0cdd-408c-af31-2b3b7ec4d959", "value": 15018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975679, "uuid": "d5039d50-33bb-4657-b67d-a052141253f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975679, "uuid": "f084bc75-ca3e-4ddd-b394-28f8ba617ed6", "value": "images_20260724_151732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dccae2-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974768, "uuid": "4a8a2bc6-57d9-4893-af55-cf28d18e0e16", "comment": "Malware payload", "value": "743a6ac8cbd26216bc0e9a43fe676cbc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974768, "uuid": "1bd41c12-3c16-4398-9c33-7287deb5a1d1", "comment": "Malware payload", "value": "ad0adbd6e5029fad2e941caebef8b6a1b0986dfb30b04de764f8fad071905f78", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974768, "uuid": "89d05b0c-8712-43b1-8a94-594a8135feb2", "comment": "Malware payload", "value": "2fc5e9710377e106d98a31796a24825192413b6b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974768, "uuid": "84534c18-7577-4d1c-a1c8-8ec6c3d31fda", "comment": "Malware payload", "value": "ee15649618ce23a322eac091ca16c2bfe1ccf7f19dcf65cb800e3cbcb4cad3f33bf6890ecf0bf1f6a2e33bfcd451326b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974768, "uuid": "ebb2ddb6-23d6-49a7-9407-a3f1536e0fc2", "value": "T16152B026960F4E279B8EA5B3B5140D28B3780757579C7AF6C2AF5D518412AF026FE308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974768, "uuid": "eeecbcc9-9f3b-47ee-8b3d-006db62b2743", "value": "384:gssJgI621T7E//HsSMxfThh4ynQW/3S4P1Wa6+VwvhMJdU:n+8223HsFpTbz5PPYaPwvSdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974768, "uuid": "1c4c8311-90d4-4c7a-8f07-0a0beae8bb85", "value": 14227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974768, "uuid": "f9e8fe54-842f-4c5b-bf9f-8f255bf1eac9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974768, "uuid": "f02f7341-9cc4-43ed-9d35-deea4e8eb755", "value": "images_20260724_174317.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9c685f-87f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784962329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962329, "uuid": "d9282f7b-376e-4f42-82d0-c7c50c9b2e0e", "comment": "Malware payload (Efimer)", "value": "0c2577473d74812f1236f9b799657b49", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962329, "uuid": "db675104-0424-4627-8725-f1a15b879f9f", "comment": "Malware payload (Efimer)", "value": "ad5b27155e1f34fad298c6889dbc845692f5861ad7ea835c42e991640470909f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962329, "uuid": "a30f81d1-c692-4872-a933-5e8a198ebc10", "comment": "Malware payload (Efimer)", "value": "d96a9e4df85b326920258c21efe8b30205aee037", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962329, "uuid": "a7d47613-4b5b-40ea-9044-3cadb4d10f3c", "comment": "Malware payload (Efimer)", "value": "ffa492501d673af5598b3e70fb226763d90d2e07d5000458ffa88b92f29c92af86dc9a341cc682debdf5af154aa1fc1f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962329, "uuid": "8774221b-bd71-4297-9d55-5ce5eba3823f", "value": "T17EE6331452E001EBEEB3813DEAE25195E061B8310776C6EF67FC9AB26D531F0CC78666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962329, "uuid": "3cb2651a-5c5e-4093-b627-01c0aeec708c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962329, "uuid": "3eb05f8a-a569-4c0a-acef-9f9cf7be4c25", "value": "393216:w89xsMIlFLUqqYo5a32PwRgn82IOJbaXMCHWUjXicuI3/PGTAI:wsFIfrvos32Pw6n8hEaXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784962329, "uuid": "51dd627b-749d-42de-aa0d-e0807daff1e1", "value": 14241006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784962329, "uuid": "990df378-8bce-47f1-9fe9-550a3c19a172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962329, "uuid": "7d647655-82ae-44d5-adbd-79c623f0152a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db25e4b-887f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785021603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785021603, "uuid": "b568b549-2244-432c-a2a2-1d691773f62b", "comment": "Malware payload", "value": "29733b8c7e51d9832bb50e9d491fb1db", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785021603, "uuid": "1e5388df-fa2b-49d9-8d22-946a1844374b", "comment": "Malware payload", "value": "ad61a41009aaf87bc4c2a33f5d5ae7ed2491ef00d82bc024882b041af9334b90", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785021603, "uuid": "6b908722-0d31-47ab-bbd8-2761db60c09d", "comment": "Malware payload", "value": "a3d90b6dac95a2f960321336aa4320e1da6e2dcf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785021603, "uuid": "1c25b292-9b4d-4e4d-809c-c75f3a378917", "comment": "Malware payload", "value": "d78ba04c55102be6b6a384eb67d2d5833a5d5e446652d5b85090db8313d666a24120c9e4d5d4e8436ff3b5e050528879", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785021603, "uuid": "8c521cfa-e13d-40e4-b98e-6b55937c3ba6", "value": "T14601AFDAE2509920402A941D62D751A1B421C3C709CB1BA87F9C946DAB98E00B126F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785021603, "uuid": "8ea06661-2c3c-45a1-84bf-4d59175e3a61", "value": "24:kXCKysE2hi0ziQvZohanYR28aTv+eeE/Y7:e9Qp+Msn0aTv+BEQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785021603, "uuid": "ee84e7ee-42d7-4e84-af11-7a8c98e0e3c4", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785021603, "uuid": "a7d98764-22ba-4b6f-b9ba-ea63811fd037", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785021603, "uuid": "02e10073-623a-48f4-9fc8-edee9c473d49", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2100a8f-87f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784963414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963414, "uuid": "4193dfce-4336-45e4-b464-a467fd56a251", "comment": "Malware payload", "value": "01166828ef7b933340d1e69afae244c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963414, "uuid": "90e0a45f-13d9-4e57-8b6b-d65fb69da877", "comment": "Malware payload", "value": "adf370df9f5939044918dd0d10170a1ec11a380f0060dfccac00bea36521bbdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963414, "uuid": "e51d1b2a-7ec6-44d5-a247-d47cd3f0247e", "comment": "Malware payload", "value": "364ac840d054f850fb3d5e18c31937566c9edac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963414, "uuid": "70b10177-97d5-4a37-80ed-46393f983636", "comment": "Malware payload", "value": "a5629d11d6721d518af16405df2ae09119b46c0b59b43f4d7c74ca5fd7827575d16d1fe4da40f9dd975cdd82f81d9785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963414, "uuid": "67d79155-9852-4696-9b7d-dc124ac7ce35", "value": "T170A44C94B745FDFAEC894B7408D223096369F0C1971AEF2F2524FE380D5AB98DD6350A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963414, "uuid": "ab7df799-380d-4e32-9d06-673abb0062ca", "value": "6776e234cd16d20238cfde04fff9f25e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963414, "uuid": "44882f62-1a38-4048-a73f-1a7657e6f314", "value": "6144:Qy+7CmAiS+NMKnkD2RuX2vKVu7iEEHyvivpz29J6/ST33+uImogOK7RjRi3cP:QvtOU7kaImyt0KxR+3OsB/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784963414, "uuid": "c56a16f8-4c11-45b9-b941-d9b29944706a", "value": 480963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784963414, "uuid": "df6ff76e-6ce0-4710-858c-252de47d41ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963414, "uuid": "38abf3a3-1fe8-441f-af67-9fedee6395f1", "value": "adf370df9f5939044918dd0d10170a1ec11a380f0060dfccac00bea36521bbdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f2bd34-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974671, "uuid": "c85bc5b4-20bd-4bdf-a7f3-965569d62520", "comment": "Malware payload", "value": "493d8dcaf4be604df3d892499f35d416", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974671, "uuid": "0f045cc7-2a49-41c9-9d45-db949015f64b", "comment": "Malware payload", "value": "ae5a6404587524b526721fe88059ab183c897be9e55b85a42961636eba85a7eb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974671, "uuid": "83ed50ec-4a96-42cf-a596-a8e1acb2ef60", "comment": "Malware payload", "value": "3aaacdff8be768b3c6bb5132d65877a2844be82d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974671, "uuid": "b3ca2868-78fb-4bd8-8155-2a3c4abb9d77", "comment": "Malware payload", "value": "b2f05720ea3b58d358e7fc4611a9d12206367cf41f20ad9efd731d2009149207a439f5c01b0f19b036fa9e6c6f87927a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974671, "uuid": "c6415d79-14b0-48e4-91fd-3f5a438421fd", "value": "T177A18D26A41ADA9BE4D0B9F699230AFC8C0DF85102400917996C891E3CC86EF8B6B9D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974671, "uuid": "179a206f-784d-4a62-b937-ad68b25b48bf", "value": "96:U2EKLjI8cOmVgbwBZHrdThTl3w3jvCcx4N4uijT0Ue5vBPwjtn1bg:HEKIIbk5X1kzOOui30UQ5PAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974671, "uuid": "b65f3b04-845b-448a-b538-3c07e2866755", "value": 4927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974671, "uuid": "8e7e8cc7-3e8f-4be8-bf04-e05366b251bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974671, "uuid": "6fbb9bc9-0851-45c6-a895-2ba539eb0c2b", "value": "images_20260724_235630.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db626710-8863-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785009788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009788, "uuid": "9d44b107-a28c-41c1-9182-e178859581cc", "comment": "Malware payload", "value": "1cbfee3655a0e56275db5a501e560459", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009788, "uuid": "0203459a-0298-46d3-b7a8-331744e48fe8", "comment": "Malware payload", "value": "afc5fa1343a544b6a918ed331efc7ba9ee88c045bc6fd8fb9ac662107c552295", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009788, "uuid": "6adda0c5-4b0e-49bf-8e56-80d2288b375f", "comment": "Malware payload", "value": "93932d02a11f7a1214fcded019abd64163f9fd9f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009788, "uuid": "dd761436-5ed8-46be-8107-ad668cbc0d5c", "comment": "Malware payload", "value": "9ae27454012156cb1ba7c927dce6540701cf2e14be46f0fd04334cbcd92544fb92509010ae568c2c79987dc61db1dd17", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009788, "uuid": "6855cb79-73c2-43ff-bee5-7681a3e56363", "value": "T15DC633A44C61A812F9E0DC36CD735DF6DAEB4DD23654FE6E40ABE3AA431206F0199C17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009788, "uuid": "fc6d0e22-4f52-4cde-ad53-96635cc5aec8", "value": "196608:wOP3lnHuzyrYyonpZJk6fTuHjTWet1hOy7U/X4c1lkj3oYft81bqLP6qIvmjlbGn:xlnHuzpnWRHnZjt7mXZ1l+Ft81bqLP6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785009788, "uuid": "c3016c67-4d8b-4f0d-a97e-c8e2b9bd9a14", "value": 12478573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785009788, "uuid": "e1e3cb5a-06d6-47f3-b5ad-74b10a8c6944", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009788, "uuid": "bdc376a7-c943-4af3-9d61-3a3c1ff977cc", "value": "Sheldon.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157fbc32-8825-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784982828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982828, "uuid": "3f8d90f8-a7bc-4e0f-8728-aac805d17077", "comment": "Malware payload", "value": "254db95fd5e53bc6d54a9b0791b18714", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982828, "uuid": "ed6884e1-4032-4b27-a0c4-f24880dfa157", "comment": "Malware payload", "value": "b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982828, "uuid": "f50f39e1-95b7-483e-ba8e-17581337bdb1", "comment": "Malware payload", "value": "876cb7dc315f655ca8d4edcb4efce984e726692b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982828, "uuid": "f2929541-676f-4c4b-a155-da5d7a1e1dbf", "comment": "Malware payload", "value": "28c1eefc9153a6a54c94473ef1d5f2da6a468389de2237367ca8ea4e1c649261b8f1022846d542386ecafa8346329f77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982828, "uuid": "fd05f750-cde7-4749-b18e-d600f91241dc", "value": "T1B4C27C966A867C44BEC94A3E4CBE2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982828, "uuid": "9d2f5c13-0a31-40e7-91e8-9051b5747cf7", "value": "768:BI8vCB+25j6es8R99FYpMSUpi+20qUpi+20YQX:BI8l25Jrd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784982828, "uuid": "dceb2b4f-abdf-47f1-b8e9-cebe01b1a7f3", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784982828, "uuid": "fcb54629-50ca-4d9f-ba0a-3e9496297f04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982828, "uuid": "893718c8-8dd0-4b44-88ff-e5fc0731380f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d81088-87f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784963741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963741, "uuid": "77d8be6a-af18-4b34-bd2c-61081bc1354d", "comment": "Malware payload (WannaCry)", "value": "9ef42799d880c522be09618a03a7b9e6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963741, "uuid": "c7c6b58d-737d-49da-b0ef-412b6db37659", "comment": "Malware payload (WannaCry)", "value": "b08f921c92a29a0a8449ee27d6860597d7a34baf8d609ca7dbcb06c32d5b2f80", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963741, "uuid": "34840531-e50b-49a9-a037-29494aa77384", "comment": "Malware payload (WannaCry)", "value": "d7b54e708ddbbf0954a1cccf95d4e8b80dda3150", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784963741, "uuid": "b49d90db-3ca6-494f-b893-95e61d1624a4", "comment": "Malware payload (WannaCry)", "value": "7b94432979b003dbff31959a81483178fe0c733d7534e86a035e2943f71590e64e58aabb4774cd1ff29d24a843f45fb0", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963741, "uuid": "706cbf8f-8444-41d7-9fd0-de07c1df024a", "value": "T1D13617A3F21A5FCFC1FA50368821E830D7AA58F8CBBB31C53D84596B7695180AB35F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963741, "uuid": "17c038f2-1006-4980-ab62-42cb4d8c50b9", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963741, "uuid": "a71c6416-a800-4172-a1da-89af642848c5", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9HZZCZLZ:DXDqPe1Cxcxk3ZAEUaVj09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784963741, "uuid": "a3aa7f91-b8fb-4f54-9e2d-5afbad19cae5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784963741, "uuid": "cdf4afeb-8cb5-4e3b-84ac-f6d0f1fda7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784963741, "uuid": "87fa4e8d-bb19-4dbb-a7b5-3ff976469615", "value": "b08f921c92a29a0a8449ee27d6860597d7a34baf8d609ca7dbcb06c32d5b2f80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ceca5ad-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784998329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998329, "uuid": "068c8edd-2010-4980-9a08-c5f124ee8d18", "comment": "Malware payload", "value": "d7dc517b9fa4e1a542e000bd6fd04905", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998329, "uuid": "40ccb846-7d43-4eb3-9709-2dca70729025", "comment": "Malware payload", "value": "b0f1cc283ec0885b5769dd8d26a3a4dbb54fb5b3882b919e88e4058fca5e7d77", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998329, "uuid": "7513debf-1808-462d-8ec7-95b026795e18", "comment": "Malware payload", "value": "6a9df4467b980f48f3616bc033a2336dddfd25d4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998329, "uuid": "84d7801c-c6c7-415e-be69-ddef1952ab5e", "comment": "Malware payload", "value": "31a487370b1e8c4269fa7be288987a9e901add739560528b47d40aa24a3b6acf140590ab20f070fbb29c41e2b9629162", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998329, "uuid": "2bc36978-8ed0-442d-b596-b4c937a013bb", "value": "T1B9E63388A7E402EAFB73413DDEA265D6F96978660372C8DB4BD883945F132815E3C713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998329, "uuid": "22a6e369-8d23-4c35-a436-084773e2553b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998329, "uuid": "77cf14f6-6e46-4f8e-a269-943328ca3927", "value": "393216:yDXMqEfbdNMF8BCx9zneV9XMCHWUjXRcuI3/PGTAI:yExNH89zneV9XMb8XGH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998329, "uuid": "c7b20a1f-d28f-4f59-9910-85a9a68f3085", "value": 14311732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998329, "uuid": "119d117a-d6a7-4607-8216-6c7762338934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998329, "uuid": "d063c147-0120-4961-9bed-2bd342bd57e1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f389f4-8834-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784989429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989429, "uuid": "23cc2c14-5dbb-446f-ad8b-44add0a7f756", "comment": "Malware payload (Mirai)", "value": "690adb748b65c26e52b39967facc9f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989429, "uuid": "efd3a800-706c-4eaf-a02a-145f45aaaeed", "comment": "Malware payload (Mirai)", "value": "b1a223f1123d6de378c0014342b2d9d9475db68218242a70268288dea080a1ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989429, "uuid": "2314959a-558f-464b-b5b0-e3466b93da50", "comment": "Malware payload (Mirai)", "value": "5c01698536c84fe6333ec218fe28f928c755377b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989429, "uuid": "a456d275-f495-4549-a117-f6143d28d0a1", "comment": "Malware payload (Mirai)", "value": "0c79ebd8c7de63afe32bfe62676cf6409234ad8060449149fe82d38e32f4374c0ba49e291b4a77a7b2d3e74392a12d4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989429, "uuid": "a06f7a30-8d31-4469-927c-c570ab45e534", "value": "T13CB35CC4E643D1F9EC6705302136FB3B9E72E4BA112DDA43D7F89A26BC52681C80679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989429, "uuid": "fed93ef6-6fe2-42ff-a4b5-3d9486264d14", "value": "3072:90U2ysTT8NIsq7VMQLO5R1ATB+S2NUsDEHHRn1nk:90U2ysTsIsq7On5RdfEHHR1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989429, "uuid": "2a3f58f4-43e8-4bf2-98b6-ccedf07879cc", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989429, "uuid": "013e654a-0d30-4b04-a70c-a413ce90108d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989429, "uuid": "35afce01-ce3a-4c2c-80d7-5fa961e9c863", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6d709c-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975753, "uuid": "20eb58ab-0c09-40c2-8b03-23bea89c04f2", "comment": "Malware payload", "value": "14ebb14525b1761dfc8baf3e3ce273be", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975753, "uuid": "6b81af5a-c896-4194-9e0f-f5483bb566de", "comment": "Malware payload", "value": "b2286b7a6f14289280d6fea163995b1537311f7ad36d10252d6a800da3619614", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975753, "uuid": "494318c6-9c2a-4bed-9dc4-c001e43fad18", "comment": "Malware payload", "value": "ecaa308e81f5b09f45f98f3b7a32179f610008a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975753, "uuid": "8455f485-818f-4c98-a382-3a34be462658", "comment": "Malware payload", "value": "9cdf87871e4036d55494ee65fe37b56a1f5113bc2eb8cfa6561ffa90a2fe0da5d04f2fb03fcde1371a7ae57fc12e19cd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975753, "uuid": "24ccedb5-cec7-438d-8eda-a923ce12203a", "value": "T1F372D0BE6ED75268B02897D417CF7AFF826EF30567D4C26FA3458475D0CD9A80C46092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975753, "uuid": "659f0776-e640-4df3-a61d-d47d778b7a52", "value": "384:9UKSgxBdtFXt/uyECQoTESzHHuKZ7TYrwlAPRMMB+2:9UbwfZupCjzuJwl2Lo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975753, "uuid": "ece6c7bd-2451-4d07-8b99-bc75298d7311", "value": 16963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975753, "uuid": "2b0c8848-dee9-4250-b9b5-c94dc0aaf6ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975753, "uuid": "b2469c82-4a79-471d-82b1-e6eefd0f1587", "value": "images_20260725_005750.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80628825-880e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784973129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973129, "uuid": "5d9de845-49bc-4e7d-9bb5-6d9746575b4d", "comment": "Malware payload (Efimer)", "value": "a96181ed94ae70267b7f64383b29246c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973129, "uuid": "b719fcdd-d48b-4be4-8850-d8db8c4b27f2", "comment": "Malware payload (Efimer)", "value": "b234d7021ec9c148ad3f4cd0d45368f7694fd78ed9728e66c13f00a87994dcce", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973129, "uuid": "1e73b6a2-dbed-414e-9fce-e52d6db099c5", "comment": "Malware payload (Efimer)", "value": "bb45b53d9bc9c52c943c7fbe2603d9f45be2a02c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973129, "uuid": "407762d3-227b-427e-8ad9-02a03b16afee", "comment": "Malware payload (Efimer)", "value": "033a356ce92c33929da06bc129e03ab8e6a0af7a98a89b844c3a9144304ce70d04ae57ff96c45da8efcb73ce77010aa4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973129, "uuid": "3c0784b4-38fb-489e-859a-bc9ad6db886f", "value": "T1F6E633985BE412FEE6B39039EEF2A69AD2A870714B72C5CF578883502E570D14C3DE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973129, "uuid": "0803e8da-3bc2-45cb-b5ec-518e3be2e822", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973129, "uuid": "38c68967-61fa-4ad6-9d0c-91c50d106fa3", "value": "393216:nokN/Tm3xghpvYnRvVoxuUXMCHWUjXncuI3/PGTAI:njCxghpvYtNUXMb8XcH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973129, "uuid": "18443b4c-a5dc-4e92-ab02-81b8603c66a4", "value": 14319043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973129, "uuid": "a9d0e6c4-c147-4c1b-a834-78962bdec119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973129, "uuid": "722de058-cdbf-4421-8af3-da09ae39f40c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626e2552-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784939148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939148, "uuid": "1ee81e44-3653-4f05-9c0c-6a907aa937e1", "comment": "Malware payload (WannaCry)", "value": "4899d8bdf11977ab078fab1bfff0a2d8", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939148, "uuid": "9c826ab2-19c8-4259-ad6d-edb66767c7ed", "comment": "Malware payload (WannaCry)", "value": "b416cf0930c167ceaec2b5c66d3cb35c0bfe37e5d94395460d69864733cf99ad", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939148, "uuid": "f5e0ebc7-c7b8-455e-95ff-2cb6d1c7be31", "comment": "Malware payload (WannaCry)", "value": "a496a13878bd70348a3074d98b54f8e8ab96b74a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939148, "uuid": "ae362193-13ef-4a8f-b114-634f00713233", "comment": "Malware payload (WannaCry)", "value": "5b8759df31ae2233501e025d9fe53f5d812d1accd62500e8313d205b4abb54f03bff6e3733a7c1921279a0486cc98847", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939148, "uuid": "81701246-6785-4f84-9798-f9af45ad0fe8", "value": "T102361231294890F5DD1706B0B436C9675E773F97A63F860A0691BADA0CF3E70B62BE11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939148, "uuid": "560b177b-315f-40b5-8a32-ca1c59c21265", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939148, "uuid": "b38aa785-3832-4f8c-87fb-e0647df69037", "value": "49152:jnXnAQqMSPbcBVQej/3z0Czt5LO2vxJM0H9Pw3R8yAH1plAH:DXDqPoBhzICzDpxWa9Pw3R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939148, "uuid": "c372d453-47f0-4dc8-9d2a-ec58380dfc09", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939148, "uuid": "9256baa4-8aad-4e42-bb90-e115060d2b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939148, "uuid": "c25618dd-a323-4c09-81e3-4ba7ebf2ee2a", "value": "b416cf0930c167ceaec2b5c66d3cb35c0bfe37e5d94395460d69864733cf99ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebd5f80-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991433, "uuid": "72231183-3986-4c39-8ba4-8ee0ad03fed9", "comment": "Malware payload (Mirai)", "value": "dd3f74fa83eeb61d8ec26b42668f1168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991433, "uuid": "d41a0ff9-4f20-43c0-ac80-5b700a570270", "comment": "Malware payload (Mirai)", "value": "b4d161ad1c17178ea5371dd7c4e06c8b22c4ab261b70f48f9dec633be0f3e347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991433, "uuid": "f92c5c4f-3ba7-4ccd-8338-51d510355dff", "comment": "Malware payload (Mirai)", "value": "4707a10b60025e054a77f82af0c3f178d2b5307c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991433, "uuid": "eed236fb-88f1-4400-aafc-d81d5c004caf", "comment": "Malware payload (Mirai)", "value": "26983b44f465c230ae0a04e75ad84cadc538d35c836b90515bdcc14e7334b28bfda0b3a6331f213ee24ec89e5366d4eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991433, "uuid": "00bf2806-7f9b-47e6-9d08-c11011173901", "value": "T1BA04B75E6E229F7EF6BC873447F34E24975923D627E1D684D2ACC1141E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991433, "uuid": "100ae7ab-bce8-4393-9967-97470ada6d6c", "value": "3072:XKZgHmK+dnGmWcs2bA2H2sW59fN/8g588p0XS:6PPdnGmWcsYWVNP58I0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991433, "uuid": "c93a7553-c85b-43dd-9eca-d1e493ae549b", "value": 185852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991433, "uuid": "5efb04d6-082a-47af-9db1-efa15c626c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991433, "uuid": "c4dd2ccd-99e8-406d-a18c-00facf6ce1ed", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c158428-87fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784966249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966249, "uuid": "a429d878-3df0-46f5-a316-a99658709613", "comment": "Malware payload (RemcosRAT)", "value": "8d105b8ff0fdae268d3a0d71e37cf59a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966249, "uuid": "18ed8570-163e-4097-b27d-fad57f11f7f0", "comment": "Malware payload (RemcosRAT)", "value": "b56a0ca93b258720b3b368fb2281497eca3796e09eeddf254a4b63132c8bc8e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966249, "uuid": "d861604c-7a31-4f94-9b6d-795913e8fcac", "comment": "Malware payload (RemcosRAT)", "value": "707c3c34d8df185bd7f88d8aa3526ff8f1111123", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966249, "uuid": "16694afb-d766-4f0f-92fb-78ad7db8ea08", "comment": "Malware payload (RemcosRAT)", "value": "055cfcff18f784e6fa626cdc03e01b8cb9a1d2674402b2877df0fa746b77f815083dff82fe949223bbcc42a7f4f62b65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "papilawdns-duckdns-org", "colour": "#78BBF9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966249, "uuid": "9aac0303-9a2d-4b10-8b7f-91781f39f3a5", "value": "T1D765B00931B9D97A8979034BF5B6A4158CFB7E030EB59E5D219EC1A00F793486CDB38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966249, "uuid": "f5983ede-ed32-42ce-b951-56a5feda744e", "value": "24576:/XNUkh9OkDMofL5q5BDsTiH2rAjwL2wuTFRzHYAJON49/tTAcAs1hYoYQSWJz1jN:fNUkh9OkDMofL5q5BDsTiH2rAjwL2wuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966249, "uuid": "210eabaa-3ab8-47ed-8265-612ce298fde7", "value": 1528872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966249, "uuid": "d75d7e37-36d5-4386-bcc9-8c59859a6fc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966249, "uuid": "9ba2f424-3d27-4d5b-9b85-c93a6c1330e9", "value": "FINAL SHIPPING DOC# INVOICE#PACKING LIST# BILLING OF LADING.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a31929-87cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784945334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784945334, "uuid": "4e61b3e8-61ea-40dc-ae96-9bcc1e46ed97", "comment": "Malware payload (Mirai)", "value": "c150ee208feb8856cbd1b41aeed68c21", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784945334, "uuid": "209e2d8d-6e98-4840-a216-18b2bf352175", "comment": "Malware payload (Mirai)", "value": "b5cbe6aee544051356e59abcde8d5e24fb74c8dde2852bd6599c3c7dec8beeaa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784945334, "uuid": "69e9730a-de84-445f-b14c-ea41e3ad1698", "comment": "Malware payload (Mirai)", "value": "f61eaaf301d5d2b0a05a8b544ff6dfc559dd36da", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784945334, "uuid": "9707e846-92fd-4636-8bd4-0bf9ae8ac69a", "comment": "Malware payload (Mirai)", "value": "e43421a88136103767b33aeea3a54ba3587209fa95d674ab4ac5eaead950dc90302e92fa75092c652618c77ce5fe85a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784945334, "uuid": "02f16ad8-6931-4f52-ab1f-99fac0a30bd5", "value": "T1E4014CAFC05140D22F94F528B9520A3471045ACB39E78A8C9C4E3DBA15ED988F938E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784945334, "uuid": "5147dc5f-f1c6-4708-b5c4-9648cb37a243", "value": "12:RRJZDxRAHWRWYBRIWOxRIWNHWRWYBRwxRbHWRWYBRA5IjDxRA5IMHWRWYBRfDxRP:3JZbiWZInIOWZgjWZA52A5hWZfbqWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784945334, "uuid": "7bc67ac1-4574-4e23-8cea-57a1af9bf9f5", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784945334, "uuid": "4e758d1b-8a04-46c5-92cd-f9b5b4a1a7e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784945334, "uuid": "3628f549-71fa-4d46-8df9-0ba818ab7c83", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f7d128-885c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785006503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785006503, "uuid": "6e22f14a-95cd-421d-8867-003917af5eef", "comment": "Malware payload", "value": "44af521011206ecad327046ad626ff19", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785006503, "uuid": "ac5679c5-2797-4fc8-9e67-6f69d8cee617", "comment": "Malware payload", "value": "b75a1f635e976190bbe1155b244f655937693fb868d27f9010813ce64f210d45", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785006503, "uuid": "40c1bd81-10dd-40a8-8026-a2eb2cc45782", "comment": "Malware payload", "value": "0a8f31649223164c4839a2e7f560e8d61e133286", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785006503, "uuid": "6583b690-55f6-43ab-a70a-a9d58af6d057", "comment": "Malware payload", "value": "85fd6b428088733609b5fe54cf3fc59fef49b2debbfb66eb365b33937a386764eae5ec63b522ed9f39f1175af968271f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785006503, "uuid": "e2ed00c4-34d0-4c0d-b0ab-90903cf5613a", "value": "T13E136C6516953C28AE99883B5C7F2F0CBDA983E2304491DDBF8B3CF18C55A9CE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785006503, "uuid": "db004990-e871-4aaf-98f1-cdcdea2e8b71", "value": "768:a9NyXsZztCD9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:aHusZ1co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785006503, "uuid": "17a1ea31-d44f-48d2-b277-24d753b1a95b", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785006503, "uuid": "63f29796-fb0b-4c7d-ae27-ecc9f81777a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785006503, "uuid": "14353886-5232-402e-ab82-2d5ea8db67bc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b079d5e-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973979, "uuid": "80f1c7dd-103a-4a30-b95e-9e75b8c85f01", "comment": "Malware payload", "value": "def2c69057753b5ec82a91386b0534e4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973979, "uuid": "cf04147a-5ec3-4d04-abdc-300b67087c98", "comment": "Malware payload", "value": "b86efabb6340e399c02ed246902d10ef58bc116630e2c1ee4783e515d5b224a0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973979, "uuid": "d1b7017b-ec15-4041-906e-16b7d09a249a", "comment": "Malware payload", "value": "0aa1d35ec169d49493e6cd2620f4e697dec68d14", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973979, "uuid": "5a109a68-1b88-4553-b148-19b71ba6e2c2", "comment": "Malware payload", "value": "beca7cb75ea3fb5f74452a3b64350e6defc79a26b8d36163876447a6a13cf22992388b33a627ac8a5c55df9469bbaf6c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973979, "uuid": "1add3aa1-71c6-4a40-8cc2-7cc3e54d3096", "value": "T17506BE4AFB489B6AC0F3923A4C755A61410B8CE68F43D7837D64773C48BB9C11E5AADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973979, "uuid": "c16ad17e-5e9b-4118-8e62-eab8d6838f05", "value": "49152:J7H01ij3XVmVbFE7NVBUkgxFqTH/OLDL3vplTvO+5C+bQ0E4pDjxg9Z:C1ij3XVmVbFERAITKHxlyh492n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973979, "uuid": "7a8abe2f-3f58-4640-be7e-ee07f95d742a", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973979, "uuid": "42353c2d-111e-4cf3-8a72-1c41aecfcdd8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973979, "uuid": "21c1eb4d-e177-4fc9-a88b-d50e3e60d17d", "value": "variant_12.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9619776-87c6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784942274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784942274, "uuid": "a33a3ca6-9db2-4eb8-80de-19e015d526cb", "comment": "Malware payload", "value": "498c0eaa777cecbfcd1c457c019ac99d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784942274, "uuid": "6edc4ad5-9320-4069-a67d-9784fa443efa", "comment": "Malware payload", "value": "b99b54219da920dc9a7898dd16a54ac08ab4d6e4f286a89d33ec19eef2fc8f02", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784942274, "uuid": "5a12bbf4-17af-41bf-be79-5ff007ea6c19", "comment": "Malware payload", "value": "a2a940e7622660b4abccde8c773b10b524b9b72f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784942274, "uuid": "76b38a7d-beb6-474f-a31e-e7f6f498bdc1", "comment": "Malware payload", "value": "fa1b15f6f7531c73ede1f6c75a62d192d2d3956468787bb4b1dfeb283b69a3ad4ced17718142600389073b6a04f4196b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784942274, "uuid": "7392a902-1cee-40e4-8256-8d83f079be4b", "value": "T127C27D956A867C44BDC98A3E4CBE2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784942274, "uuid": "fffd6504-8b07-4112-a89a-42c04cfb39a5", "value": "768:c8vCB+25j6es8RtOn9FYpMSUpi+20qUpi+20YQX:c8l25JsBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784942274, "uuid": "142a934e-2404-4292-8d45-563551983041", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784942274, "uuid": "0f96caed-e58e-42e4-b393-98fba109e8b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784942274, "uuid": "3dfbf0fb-c4a9-4534-bdcb-2541a956ba4d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0835c3-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975697, "uuid": "bcde08d7-b2e3-4714-9e6f-d9aab67a89c0", "comment": "Malware payload", "value": "9f2beef418976bac3b07c7bcfaec6750", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975697, "uuid": "8f81fcce-6945-4745-94e9-a212565d5401", "comment": "Malware payload", "value": "ba299e94793e7ee8e82237e3e00f693d2dce0a47feae484a1201367ca3f41807", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975697, "uuid": "c559cd63-8eaf-4051-a5b4-565a142aeb2b", "comment": "Malware payload", "value": "7ddb9b735118633dd93519be7a33d5636b025d96", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975697, "uuid": "98759324-bf64-4336-8b30-38e16f3f1f80", "comment": "Malware payload", "value": "14540154ebb596429ec00560978f1ed05130eba7a62ac3f2b5d251e5f8dcf3c66ade2cf8ab96990a72d3bf062e538f50", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975697, "uuid": "37371587-9693-4ffd-9e57-8cf6b05e4688", "value": "T19272D140E23E03C18A66017FDCDFBBDAE64465A869142FD78CF953CE6FB1D6A012A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975697, "uuid": "75e2046f-93dd-4c3b-9503-9ed92d2f5f1d", "value": "384:gVCywhbDQgKjHnj/02pmmE+ozdrpfY3J/Izd6L9jQzi:cwhbc5HjsamF+CxYFIIJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975697, "uuid": "b3b272c5-5985-4f22-993a-a328d9581c38", "value": 16961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975697, "uuid": "3b8e4aa6-dcc6-4b52-86f5-ce3026690735", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975697, "uuid": "dedbc425-648a-45f5-b7ff-3fb82ba55321", "value": "images_20260725_015858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a782af48-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975771, "uuid": "f150095f-68f2-4ac0-b9a9-9261506d9410", "comment": "Malware payload", "value": "dcf289a28462cf499cd626b2581624cd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975771, "uuid": "20da7bb7-0f44-4aab-96b9-8caedff84f9d", "comment": "Malware payload", "value": "ba80c377216f5d9c4792febed1f0b240f6c9fda5ca0a60b949459476d7bcce76", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975771, "uuid": "f2f411a5-2cb6-4ed1-a9b5-a44e4587356f", "comment": "Malware payload", "value": "7f4d85de20b1fe6d9eef5cdabcdab0aa1d9b0818", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975771, "uuid": "a2db6c34-506c-46d3-a7a0-6210afd0ca49", "comment": "Malware payload", "value": "67d518acd8a2a3bfbe0f82027518b7f4acf0af8a83eefc27813906c835da4982794c7bb2f4ae331c88aef06ed52c7c4e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975771, "uuid": "4bcdf86e-140a-472e-b9aa-251d25488d0a", "value": "T11F41F9E8265D0AF9C922457D70CBD538271D4E22992AD54F371C92630E5036DAE1B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975771, "uuid": "c284865d-9f20-4afa-9bf5-cacb88d3e6b7", "value": "48:9xHOJ3zR+NU/skd6xUGOA+EUpxzlKCAHtT:uJ4AF6lrhwzlKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975771, "uuid": "b2d87bc2-278e-4c27-ae78-e8e1d2c77d04", "value": 1921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975771, "uuid": "5eb05c9f-6228-4900-a99a-b0bbce6bec78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975771, "uuid": "007ade2e-be1b-4ad8-9f02-ed017a88db67", "value": "images_20260725_015828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94d0a33-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998645, "uuid": "05b828e8-9e72-45a0-ada0-4b5844049721", "comment": "Malware payload (Mirai)", "value": "dfa10ab48ebd41387f700b6d77212d91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998645, "uuid": "792471db-28f8-4707-aa8f-54c591f49bc7", "comment": "Malware payload (Mirai)", "value": "ba845c6ea134c75f34e31845f8be26c348958a1f115862bc7459e1a1d2ddd0b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998645, "uuid": "03b34bf7-90ea-41d5-a989-c0627512151d", "comment": "Malware payload (Mirai)", "value": "4288c5bcc71188216cd74e8e88181c6900662855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998645, "uuid": "0de73c43-14a3-44aa-bc80-d95925ce35d2", "comment": "Malware payload (Mirai)", "value": "099acc5b32b5d549bb8989e1f3c9a8745066deacdb8e731fbe225c860077d9879a26a9d3d377116e222a9ce60805f3b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998645, "uuid": "54d7de4c-e631-4093-8fd5-cbcae53f78d5", "value": "T1C733F1BFF8876D8AD4FECD7EDAE60351396895E5639CD35442049CC9FE9820AF218834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998645, "uuid": "90054608-2830-46ba-8951-17fb92fa0e5a", "value": "768:DUu3t/oSNWMurbxoVgDzU/WoF5mU3zkhFAybkgPZ7DW/0l6DtC9GhNEsI2Wt4:DR3tgSWMYbfk/hF5mKIhFF/W/MONTIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998645, "uuid": "be3ba893-343e-416b-b0ae-9500e514e165", "value": 53328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998645, "uuid": "16977321-74a8-4d37-90a8-8345894a0eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998645, "uuid": "7aaa4b7a-e703-4081-8497-8fa3e68c6a0a", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85773c65-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975714, "uuid": "a7d48a07-cf78-4ccc-92d4-2e919b9d99bd", "comment": "Malware payload", "value": "48f6921e6c3d6b945d4c3d7211d895a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975714, "uuid": "c9ac85a0-aece-401a-861a-a2bb6ef22ee2", "comment": "Malware payload", "value": "ba9b91cb20b504f2275368f9748c0f35275e8dd8646c495bbf2231c032911e7a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975714, "uuid": "c2a55a8f-f929-42b8-a1cf-601d131af37b", "comment": "Malware payload", "value": "df47e6cdee19c2cbf81df85c63669f731aa58a04", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975714, "uuid": "76eb889e-a6a9-444e-a900-e004776bff83", "comment": "Malware payload", "value": "0c85c3cea9851b6607caa9dac9eddd1f47fb7c6d771b2bd52ceeed62b01333dccc8152c9b85e6487a0888778fbca5437", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975714, "uuid": "5b6de2ac-cd2a-4803-9909-53c6e739a09c", "value": "T1D202BF084B20359BF0677F267BE546F9D946BE2F5ACC95E32613D61E0AD6ED2B012C0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975714, "uuid": "a6d07588-ef78-4550-b62f-104c3222c151", "value": "192:S3T1Vgamdo/TkX3tenqTcDaHznTy5nwOgPCSmBCvnSN7:WGdo/A3yqTcDaHny5nI7mgql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975714, "uuid": "e15575dc-49b0-4bda-8bfc-78046c790f4a", "value": 8788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975714, "uuid": "1457eeb8-11fe-4255-8415-872fadb062b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975714, "uuid": "377ec826-6f99-4287-b64f-a139570b9909", "value": "images_20260724_204308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097a5474-8801-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784967346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784967346, "uuid": "8c3cafda-f388-4090-b3a3-0013f03430d1", "comment": "Malware payload (WannaCry)", "value": "a71ebf9fd2b7e1969f15e73c9c6eda6e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784967346, "uuid": "ec6770c6-749c-41bb-945d-8c770b8c461f", "comment": "Malware payload (WannaCry)", "value": "bae3dd2745c3822b1bc6b869f10bf56167195452dd65104d76f5089537ab6fc2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784967346, "uuid": "c9c96a33-ee27-48cc-845a-668600c2471d", "comment": "Malware payload (WannaCry)", "value": "b78cac8f8e3b4df820e23868f7bba7c969368307", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784967346, "uuid": "b5f0a7e5-c74a-4902-bb0e-83d1e09aca73", "comment": "Malware payload (WannaCry)", "value": "6b4a85f8b56572ca3c265825fac3a7db6052edd8f2dc9857ee972b4a4963d1ffb75386ad4c4ee0817c2c5ef50646b105", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784967346, "uuid": "82181a9f-d726-4d52-9682-d44072f2994a", "value": "T19F3612DCA1BC5168E7E25E7059E344EE563378572839990F0674FB3A2D0FE11ABD0B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784967346, "uuid": "3db80acb-9249-4dac-89aa-8b2479a29231", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784967346, "uuid": "d85971dc-f741-4f93-83cd-e60bc692209c", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P5z:DXDqPe1Cxcxk3ZAEUad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784967346, "uuid": "99db668c-5da5-4173-b687-02710c057be2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784967346, "uuid": "aba3fa1c-0a77-4a1e-807c-cdc23a91c1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784967346, "uuid": "34821d1c-9f7f-4f5c-b015-964a073536bb", "value": "bae3dd2745c3822b1bc6b869f10bf56167195452dd65104d76f5089537ab6fc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f251626-87f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784960913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960913, "uuid": "556c511b-7abd-4165-a548-c8fc96e7ae2e", "comment": "Malware payload (WannaCry)", "value": "5323cf5c653ed0d88b92e934d1c7aff6", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960913, "uuid": "2e0c35a6-3ba7-486c-b628-76fdb0ccdd44", "comment": "Malware payload (WannaCry)", "value": "bb313ea63402edd0fac30bad39a56e2405bee5b4f07013b09af72ef6c382a731", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960913, "uuid": "055a1624-0af1-4f7c-838c-caa8e7ae5f47", "comment": "Malware payload (WannaCry)", "value": "660a2ebad18d856bdf89830628f46a1a5a3c0fcf", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784960913, "uuid": "1bec13d3-4cd4-46ba-92c4-584376156229", "comment": "Malware payload (WannaCry)", "value": "636b5afc3d8fbb30ca621f74f0209078924ab6197a5756958c9407f855ae27ddb4ba87142debb8986840ecabbd3a1432", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960913, "uuid": "e25d13e2-3ea7-4d67-9aee-223748bfc5a0", "value": "T1EC363360B265D0B8D0122A70447BA936E2B7BC2A1A7E560F4B40C67B1F537B7EF54F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960913, "uuid": "f1db4a40-5849-4dab-ab76-97a9dd164c8d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960913, "uuid": "4df3f7f7-a57d-47ad-8969-4e6f4c1a5a83", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2gC:DXDqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784960913, "uuid": "893f0f3f-0b0e-4ee7-be83-8151808592e1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784960913, "uuid": "6b4bdf79-e58c-425d-bc2d-a0fed0be3441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784960913, "uuid": "48266087-c9d6-4841-909c-9dbf430c5e7a", "value": "bb313ea63402edd0fac30bad39a56e2405bee5b4f07013b09af72ef6c382a731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179d834d-8862-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785009030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009030, "uuid": "9c2ace90-1841-4d43-a4bc-232b36e6477f", "comment": "Malware payload", "value": "331dc3004c365938ff7c66177e36a25f", "object_relation": "md5", "Tag": [ { "name": "aethernetworking-cc", "colour": "#F17A30", "exportable": true, "hide_tag": false }, { "name": "cehamilton-com", "colour": "#05352C", "exportable": true, "hide_tag": false }, { "name": "microlsireqjn-com", "colour": "#6068B1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pop-aethernetworking-cc", "colour": "#55D5A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009030, "uuid": "20e17a49-b67d-4e7e-9614-43332542a5e1", "comment": "Malware payload", "value": "bcee095afc805eb5f164059598f97b5b01d1015afb496b19c640a4d01766765c", "object_relation": "sha256", "Tag": [ { "name": "aethernetworking-cc", "colour": "#F17A30", "exportable": true, "hide_tag": false }, { "name": "cehamilton-com", "colour": "#05352C", "exportable": true, "hide_tag": false }, { "name": "microlsireqjn-com", "colour": "#6068B1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pop-aethernetworking-cc", "colour": "#55D5A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009030, "uuid": "28b82448-408c-4653-8cc0-0255b691e92c", "comment": "Malware payload", "value": "569a5b25daa810e7b8f8586ca2401a3f98a7e4c0", "object_relation": "sha1", "Tag": [ { "name": "aethernetworking-cc", "colour": "#F17A30", "exportable": true, "hide_tag": false }, { "name": "cehamilton-com", "colour": "#05352C", "exportable": true, "hide_tag": false }, { "name": "microlsireqjn-com", "colour": "#6068B1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pop-aethernetworking-cc", "colour": "#55D5A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009030, "uuid": "6cd6ded3-b62c-4c92-8d3a-06cd27667075", "comment": "Malware payload", "value": "ff4e850810cedf5dad8e37642ad98c4212d2e037f3807894cf662fee123a113270ae6c9ce65f94421db39c2b48b0baf2", "object_relation": "sha3-384", "Tag": [ { "name": "aethernetworking-cc", "colour": "#F17A30", "exportable": true, "hide_tag": false }, { "name": "cehamilton-com", "colour": "#05352C", "exportable": true, "hide_tag": false }, { "name": "microlsireqjn-com", "colour": "#6068B1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pop-aethernetworking-cc", "colour": "#55D5A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009030, "uuid": "058b3568-8091-4110-acaf-8da4be52bb59", "value": "T1205651626C4F138ED0DF0536FB13E0B2967F98B3D78A52DA848B543E35990EE540EA74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009030, "uuid": "99d5a17a-99c4-48ca-a1bc-132f49a97c14", "value": "49152:2pMOxyuQz5DYGZMte29mqkdFPRo0V6Yz2mbm1XIoj1W9bPjvhPlYt47Vhl5j5cQI:2pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785009030, "uuid": "715cdd93-9240-41ef-8a92-ffcbff1f2a32", "value": 6406144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785009030, "uuid": "a646ab30-2192-46fb-9cc2-a0db2a99d726", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009030, "uuid": "bf89005e-14d1-4f32-9a65-1f4006b213d0", "value": "0e649edddaf-12.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0820eea-8859-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785005448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005448, "uuid": "f8a5d262-02de-49c7-995b-babc9529d393", "comment": "Malware payload (Phorpiex)", "value": "1b27f8fc61f3c0d5798c71e88678c68a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005448, "uuid": "2d015548-053a-47cf-ab74-eed3e95ddd88", "comment": "Malware payload (Phorpiex)", "value": "bdabc7198cc94abbf0446bda43a21128c548f8fa3e039562502e308de3a890b6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005448, "uuid": "2d99064c-5d85-408b-a772-a7a7226d4d51", "comment": "Malware payload (Phorpiex)", "value": "783c6ce7d746798196c687e507a4be2f99b58618", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785005448, "uuid": "8a50d19a-5b6b-4f19-9160-901da2f10482", "comment": "Malware payload (Phorpiex)", "value": "8512f7cf89c753c6d870ee27ddc4346ad9cdbb5175c311d12c34c7f95f51c2c2f3570209d1032c01449ab6ac5e48e692", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005448, "uuid": "487cca3a-184f-479a-8341-eca05bcc6dfa", "value": "T12F623C0BA8818036EAE14079537F422645BE7CB623C0F8DBF7F0698A59B56E1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005448, "uuid": "31b0ac1f-43fb-4cd1-8c35-2e13774fd58d", "value": "08e71dc3a4ed4919ed4f88f99fab3457", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005448, "uuid": "79eaae6b-f87f-4135-90cf-2a1d9eada109", "value": "192:a9BErjXgjo8PEUI+jum8mdzfxmF5oIsGIKUSfEzQiFJxTmv8U9cthL9c+F:vuEIlfxmroIEBav8U9chzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785005448, "uuid": "5e813f2d-5ce5-4b54-a981-9f156cdb99c4", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785005448, "uuid": "f58a64fa-5a48-43e7-80e4-2ee0d89ece7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785005448, "uuid": "9ffc758c-b112-4921-acce-337dd374dd57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d862bdd9-8823-11f1-bd95-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1784982296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982296, "uuid": "0d647fab-7158-4713-a01f-6216d3c41305", "comment": "Malware payload (MaskGramStealer)", "value": "9d15fd606542c103035ec3a3b9ec8da8", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982296, "uuid": "4fa7f573-9008-461b-8936-015dbb9e6125", "comment": "Malware payload (MaskGramStealer)", "value": "be14447b6480a1e999401100061a9c999992d96ec12eaaa86d796cf486d3db99", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982296, "uuid": "a6195d30-ed0a-4ec7-943c-629ba3e4d230", "comment": "Malware payload (MaskGramStealer)", "value": "f35652e55ae95e3052466f77f40f50d79e06c1ef", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784982296, "uuid": "e3a5be23-e02c-479e-8fd2-5df0079aa311", "comment": "Malware payload (MaskGramStealer)", "value": "25b912681d8a1a5c7f80c85667e205f87efa74b9e9c6d9dd95587749da2ef259934371eec139468bb3701d822836aeea", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982296, "uuid": "bc606e29-b500-4bed-9a0a-a23d796f1a40", "value": "T137147D2175E2C473D4B2153044F89B76697D79700B628EFB67D80B3E8E302D29A31EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982296, "uuid": "5f6ca6df-e903-4b01-b94d-c42f1a90f39b", "value": "b0a5bd61b8309dfd9e64ac8f29a4456b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982296, "uuid": "94a090aa-842c-44bb-ac72-aa3a88446ac0", "value": "3072:OFB8hPJAOQw5vauiSp5fpTWTLA7OUaxpwTItIWxN4tOMLV687pKAWuAg0FuD0n2I:OFB8hPaxAhiKObuE3xNbMLhAO22EjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784982296, "uuid": "f5ee9f56-9b7f-4c0d-bd60-bb24eb4da105", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784982296, "uuid": "b660115e-a6cb-4420-a983-29cd6ad8f1ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784982296, "uuid": "e0b2c77a-22ef-49c3-a7bf-cc98bd3efbfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871344f3-8861-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785008788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008788, "uuid": "5bd48c9b-b063-4a58-9001-a8a5bda6f9af", "comment": "Malware payload", "value": "d7bd06aa7a2d38ea34c14eccbb4509ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008788, "uuid": "3c4a849a-3d05-4ab0-aaa6-6221aaccad4c", "comment": "Malware payload", "value": "be24e3ff143568fc82e42ed4aeee92e3f6f58c5fe3c5bb442cf4b998c90463d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008788, "uuid": "60dc9a72-933c-49f1-913c-01f094a1d486", "comment": "Malware payload", "value": "b6fbcceda95dbb54494fa579e8e6ce6b614d4e70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785008788, "uuid": "3291bc8b-e9f1-4995-bc3d-ac56d32b64fd", "comment": "Malware payload", "value": "b165a1acfadb817470ff8d77ff660b5c7d245649844125fb510ccd9209cff8fd28b283fdeb8fb80e3217b2952e434649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008788, "uuid": "8c38fdb2-58b7-4e1f-ac80-1d6891a55b34", "value": "T1E37533814CEF74B5F17C95B71435D09E2A4C9A146C6B3B42AE1B608C83BDA7075ECFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008788, "uuid": "c355d4ff-e018-4e12-9c35-f9924ba043c2", "value": "49152:GMdGK1dku/5jm/DmE43BruAM7kjZwl2axtg6cYTOQw:GYjdkuxKDmN3BruhmC2Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785008788, "uuid": "753de946-1c35-4a8f-bede-7ce371951d4a", "value": 1696360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785008788, "uuid": "1c50f755-41bb-498c-beea-0655bfb1b831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785008788, "uuid": "c36c4e2b-8e6c-405f-87d4-837eb2f5a8a8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420f13f2-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998794, "uuid": "5e3d3be2-f690-4c25-8be3-bde1a911ae0c", "comment": "Malware payload (Mirai)", "value": "70b3e71df56e7699d1a59e655ce2f918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998794, "uuid": "d633b853-232a-43ee-9501-f4f963c4da20", "comment": "Malware payload (Mirai)", "value": "beaec3c0d393c4627f951eb7f96a9ff38fed82982705dbe1b66e85b2efc21c92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998794, "uuid": "e5f4a143-58db-4cee-9e38-505e2d927649", "comment": "Malware payload (Mirai)", "value": "ffebe9f80cfba1f8aa8d3c99e47fefb501b5e548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998794, "uuid": "e05c7b80-ec00-4fc5-8814-41f19ef8dce2", "comment": "Malware payload (Mirai)", "value": "3523749f702b1464a51d0a6222ff64797422ba9eb9fa6e25063285fc72f542355b41d5dfe4dc4aff4282268b2e43c3bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998794, "uuid": "eea2a4e6-042b-42d4-8046-4b7a796217de", "value": "T124C32A41F8825622CAD727BAF66E21CD332163E9E3DF7103CE255F21378658B0D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998794, "uuid": "223bfa03-73d1-47e6-92b5-5efb4a3ece3c", "value": "1536:yBEpm3SV4j3WqCz6eMKVhEag5+2AV3j6K639tp10DyPY4fPdHA32+wWgPUpidDpX:yBEMiV4z3eK1xo+lfPlA3xxgSHt2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998794, "uuid": "e39f53a2-7053-41bf-a0ab-7fec05d6498c", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998794, "uuid": "3e67132b-5100-4ec3-98bb-ba4e08d1774e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998794, "uuid": "d5af1353-6172-4457-827a-eb1ed5539cb3", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce90a82-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974680, "uuid": "e9527e3a-b13b-4f09-a35b-309eb8131fa4", "comment": "Malware payload", "value": "5a219835b70f65aabfa6701558c9215a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974680, "uuid": "d2a89151-91f8-4971-a2e5-690876b96088", "comment": "Malware payload", "value": "bebf74bf2f4242e6b69ee20ae30b76eb5e119bda35f5b03217de550069e23cf7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974680, "uuid": "cebda28a-aba4-4941-a911-13625b2ccc32", "comment": "Malware payload", "value": "57286484a489e0b4324a075c34ab1db5ef4aea11", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974680, "uuid": "87d03e86-469b-4160-8252-3e4f4adda710", "comment": "Malware payload", "value": "98f81a8955951e3b3d40be7cd918b50e9fc4cece49df7fad2c3972f548c5f52e2c171d7efa8b8f06c10bc4857513c4a9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974680, "uuid": "74a86869-139b-4bb4-80d7-70023de830a9", "value": "T11B52C06652B10AA8E430AEF734B2591411FD68B8883D70662834FBB16FFA612F776518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974680, "uuid": "7712cee0-52a1-4a90-b565-f2270e76f6ff", "value": "384:yo6LBZl/m8CguL7gtZWsfpy8hf7lk+6aRt3Va:6Lb48Cgi7MHfkQDlVv3Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974680, "uuid": "f2152aad-bb41-4a39-96fb-3265fe919050", "value": 14086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974680, "uuid": "2d6fe1a3-701f-4854-990f-a49e9b93f81e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974680, "uuid": "5901d28c-1695-4796-af29-dc1f719df7e7", "value": "images_20260725_074859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1c386a-8855-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785003750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003750, "uuid": "5296874b-e227-4d04-98db-1d5c02dff2cf", "comment": "Malware payload", "value": "bc74f44f207e7ea443ff9ee494450ac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003750, "uuid": "c848b703-c291-4afb-8797-57dc81b39be7", "comment": "Malware payload", "value": "bf8b6b4846ad542696304b6d7e339d2c1425cd27aa61ac48df08c1de2dc4fabb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003750, "uuid": "6004650a-db2f-462f-9087-c247cbcd0207", "comment": "Malware payload", "value": "7b2c02a774056b8e7c01b7323795fe45c7e39fca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003750, "uuid": "ead26867-8c6e-42b3-b651-c79fda635093", "comment": "Malware payload", "value": "3044733489510a38f6e934786fb33a101f7d874e1d60efbc2087d5f37e350c3eb68bf4bb73c7a7d3db18f2c5ac965376", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003750, "uuid": "51c71b54-fe29-4691-8e74-0a0d6625f3d9", "value": "T1A295330274A0F537BC35F2F1BD1BE653960CB12E9A1099FF1BE5604466ABE187CC6239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003750, "uuid": "abbc7fe7-941b-46ca-a6eb-cc31410fe9b3", "value": "49152:MRpdjtrx7OG3LpamJh5xSP0W9wY1qQ2093y0Npv:M3djtFOG3/Jh5xWz9wYMU939x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003750, "uuid": "5a12db14-dbe2-47a9-b442-67f831221cc7", "value": 1989368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003750, "uuid": "5f47269a-3cd6-435f-a4db-9187e0994d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003750, "uuid": "8d41251f-78d2-4a59-9a8a-68fe60cc47a0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6e89a8-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784998648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998648, "uuid": "9fca1279-303a-4ec2-907b-5950f1529980", "comment": "Malware payload", "value": "94fe567e721a7fb49b1a5fc0c7711e68", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998648, "uuid": "e9f338c8-4622-4d74-b22e-b7656c6c77d6", "comment": "Malware payload", "value": "c0a3d78c3b6fd101bced1d133cbef5e1e7f731b161cff64a651ce537d246370f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998648, "uuid": "67a823a3-9091-49e4-96b8-35cf5be4f3f2", "comment": "Malware payload", "value": "cd06b04bb364590056fd539a7279b2f1f0ea405e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998648, "uuid": "dc6d3561-1095-4c66-bd31-f0b2766536d4", "comment": "Malware payload", "value": "4a2a6adc6ad9759a1342c43697474c039cba0e361fa1f4d2647ed237627f0dd5c6bd961c54056471cdf2b82cfd6d106b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998648, "uuid": "e3005a19-44b1-475f-b9f8-5f621e29b335", "value": "T1C221A7D6100543302DA2DD23FABA4C2D70B5A1DA54D39FDD64D8B8F681CDE2D394968F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998648, "uuid": "acf86d13-edb9-464f-9de4-b36ac0656ee6", "value": "24:ItGDZsGp6pIhOEGxs3GcLAGO3PsGaoGfTRfTGFC:i/5Ep3SYQyTFTGFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998648, "uuid": "5fe0ca2d-754f-4a2a-8053-b45474fc846f", "value": 1295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998648, "uuid": "97cbfa5f-9a2f-46e5-ba97-7264ecde40bc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998648, "uuid": "409475e9-b3b4-4606-bc6f-f13b62e4f285", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54434ed2-884f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785000972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000972, "uuid": "b303aed8-ff07-4744-8906-7110f00751cb", "comment": "Malware payload", "value": "f99072e2f99208d8b03135b11f70dc49", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000972, "uuid": "d4d5c490-27e8-47ed-ba10-10b42468edb9", "comment": "Malware payload", "value": "c1a2cfb94aca34a4088d036c4833c08d113ee4618bdbc25b3a937da5eb225e1e", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000972, "uuid": "d4c3f4fd-1610-43fd-8cd0-70d333a16160", "comment": "Malware payload", "value": "6983c82ab97d3509e9d8428c42f213420343f063", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000972, "uuid": "d4553a9e-1ef0-425c-a0aa-f87afa149dbd", "comment": "Malware payload", "value": "e79b0e662032578dd4273a1f5062b153aa19ba4d18d2878dc6047f086592866b824555070d829c31626827f572fd731c", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000972, "uuid": "4465a457-18a1-47a6-8239-de3272fa0001", "value": "T11908334D1C68C887C27F8AFAB962347AE34499372DB4B82E1B190BDC79E1D5114BC53B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000972, "uuid": "cf6afda5-817e-4246-9821-3020ad4ecf9b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000972, "uuid": "2f56c8e3-a0a4-4131-9f88-5c5cb016fc56", "value": "1572864:Mt9IKP7ULJKc3tORWYKJImKljUoEkB9dNDsMLXgiMZrIuEtTZSm7:MUKix3tORWjImKljUvOhLXMxIuNm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000972, "uuid": "0299b6c8-09e4-48c0-8e01-00299ac84d9b", "value": 81470728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000972, "uuid": "2ea9bdb6-fdb1-435d-a8a9-84b1e412fe85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000972, "uuid": "a08ad9e9-8c43-4909-8722-7a609e298d12", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcf588f-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991351, "uuid": "42b97046-331f-45a9-a643-85dc5fe62c92", "comment": "Malware payload (Mirai)", "value": "714b579b1591dda5f2a6b74984bac089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991351, "uuid": "abe335e6-6507-44dd-b322-0944577a9579", "comment": "Malware payload (Mirai)", "value": "c2256f79ca04fb890ecde3d4fc9ab2816da161fe70077b1b6a615850ca708233", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991351, "uuid": "8bd07bc8-630b-4161-890d-6221a377d76b", "comment": "Malware payload (Mirai)", "value": "ac72fe40bb4a665bc182dad51bebf16af7a991aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991351, "uuid": "b3c5189d-768f-4f09-9b96-3025a467403b", "comment": "Malware payload (Mirai)", "value": "4b569bc2ef43aa414991bcd94937d1d2eca490a960701c9d0ffb46bcd056f250b92dbf999f1407d449d988b3f825cd5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991351, "uuid": "87105ffc-4c19-46c5-8384-4da8a5c6dc65", "value": "T1353302EEC5919AC9CD3ED8E0A9E7D7D03BE11BD137B48D71A120D4062A2E4EB1B4D6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991351, "uuid": "82d8bed7-2e82-41f3-a078-9650c086fcbd", "value": "1536:AADhZJ9KLOOQ3/zm6QyYs7qdqMtKOAnXaTkBt44u+qgw09J:AAFz9KLOJ3ScZgqMtPQXmL4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991351, "uuid": "a72287e2-47a0-4856-9c37-976e0920efc3", "value": 53628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991351, "uuid": "853d77ac-ca79-4f11-97ab-33cf95517183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991351, "uuid": "7c981b32-6990-4438-afa1-ccc95b5814e5", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a2bd09-882a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784985168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985168, "uuid": "c4cc5cf2-c5e5-4523-8e21-e857b418d951", "comment": "Malware payload (Mirai)", "value": "36654eaed7c62ae13dbb5eea13fc22d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985168, "uuid": "08fdd910-0967-42a3-af8c-b17e9e7fb597", "comment": "Malware payload (Mirai)", "value": "c2488a2268d58d31b5cfb30fb2249fadd5c7ffb56c9a3ddcef6507742fb7701b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985168, "uuid": "d1277aa7-fc60-4c04-b871-ab02ec31cc5e", "comment": "Malware payload (Mirai)", "value": "64f1f38b0e78fe75d1bdf0e87d4b9ce2ab099a93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985168, "uuid": "59bf323c-d388-4920-9262-c71a74532de4", "comment": "Malware payload (Mirai)", "value": "d404380d2aaea0963914f8b2c42f8b0249cd961966563d3d6f53fb6c279d245fbfdf275b0aa010f32d775d11fa41b468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985168, "uuid": "d25ec5cc-f071-4a90-9ca6-540f0f6d4aba", "value": "T1AD237C4BE743C0B9F85716B1013B67129B72E97640B9D756CB767832ED23600A72B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985168, "uuid": "6a747954-63c4-47ae-b1f5-79902d7d0191", "value": "768:0OOQqv0HnyxaDpDjGvkymA1KLGcFM8oJ6zUP0h+edROvIb:0OTqMSxaFVA1GGcFEethROv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784985168, "uuid": "995c6680-c8b0-4f37-9fe2-5e46fe95e673", "value": 50064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784985168, "uuid": "c340cf18-a6eb-4f7f-93cd-524d0045cbe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985168, "uuid": "f54de1b6-8f0b-4fe6-9cfa-f26f0c6f214e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2940d971-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974700, "uuid": "2ff22d25-19d7-4be7-989a-0c242bdf8a2b", "comment": "Malware payload", "value": "6fde7ee6218c6759a63043ad966d1fe3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974700, "uuid": "fc759360-5304-4e56-bc52-561461d7e561", "comment": "Malware payload", "value": "c31918ec152e97ce4144655c6de8b5aab61a599997cd7f64059893118d807bb9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974700, "uuid": "23e6738e-d73c-427c-9c81-cb3cdbff87dd", "comment": "Malware payload", "value": "737433578fe84f38d751c5b424b76f635fa71a8f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974700, "uuid": "3b9b1ee5-1f19-4350-9995-742579d3a43e", "comment": "Malware payload", "value": "8d0a7196591b5832b3eb893a169e307cb93dcbf2d3ee6e28f355188185005ab56d289ca82cba2846cc7319b548df740a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974700, "uuid": "c0c998c6-6fda-42da-84dc-5ca1af079163", "value": "T145A18F6B9E21F0B3E9236EB0F0961F81605C48F25599B14BF3783808BE3DD317613966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974700, "uuid": "d80c2754-9185-4149-9842-b7dc47bfe8bd", "value": "96:oEIU33aKU44yGXCfaWewCbpZPZwrIsZtjSB+89ELrP24Xw:oU3Ucd7ebbpZhWIUjSBA24Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974700, "uuid": "3bad46ee-e19e-4380-9d03-50df4d136b90", "value": 5002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974700, "uuid": "1b6f2453-4241-49b6-b280-1baa87299866", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974700, "uuid": "686d870f-61d7-472d-8885-1dafd5a5e303", "value": "images_20260724_110140.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4e4102-8855-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785003780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003780, "uuid": "71fadb02-9ae9-4066-a033-9428e645d6fc", "comment": "Malware payload", "value": "d6d4b591a37ee2fb74339e1938e9dc85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003780, "uuid": "9639de40-e005-4d1e-a5f8-d6963346cc6d", "comment": "Malware payload", "value": "c43396e514f92076c9a0c7e22248af8d60714a83eeab866d52dab13808a8bc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003780, "uuid": "2d3693a3-97cf-42df-b455-a17e0998205e", "comment": "Malware payload", "value": "0907eb14d4092ecf9ca3c0c5957f985b7e3bb4ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003780, "uuid": "25ead081-4761-4892-b2ce-a931f8c12226", "comment": "Malware payload", "value": "62e2f0fa264c1bc329111e029b2dfc82e0409fa337c9ffb5280a12fdf9a9275c12368e2eacf2ca4e1dda513a804a508b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003780, "uuid": "402d32ad-9cbd-4182-ab2e-f42c9ae84fa7", "value": "T1EA365D4BF5A320FCC19BC434875B99A2B935786901207EBB66D4DA302B33F605B59F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003780, "uuid": "d8fc3543-a297-4193-b4b5-629b32e095fb", "value": "98304:mriPpW09jtrs9zPMfPTipUYLBRKVbv59uKLKL8PWhzZPs+3go:X8MjfipUQBws6WEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003780, "uuid": "be80a0ea-c692-4978-93f2-29f6a9f8d396", "value": 5199952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003780, "uuid": "c51fba51-66b8-4a1d-b119-237ffd1fa85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003780, "uuid": "7b2d5139-4485-4c07-ad56-e102913e95d3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e48830b-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784991110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991110, "uuid": "603476a5-ffbd-40ba-90ce-0132125683f9", "comment": "Malware payload (SalatStealer)", "value": "075ec71d3218db4742c584452a9dcdbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991110, "uuid": "5c67674f-a2f6-4d11-8d0a-eb14176d3657", "comment": "Malware payload (SalatStealer)", "value": "c45401463f0b09ee869597da52050a3beb89194c12c7f7a08b7bc7e44f425415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991110, "uuid": "7920af65-e9fc-4763-98f5-6694be944a35", "comment": "Malware payload (SalatStealer)", "value": "f1eafc4a285f140f19786d791c624526ae8b348e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991110, "uuid": "c2ddc1f6-00c1-4930-8093-bf110d150fad", "comment": "Malware payload (SalatStealer)", "value": "722fc2b86eccf658d7319fd7d40d8b47e2715c18a8655af568edbcd5570a11d811014d7b801ac1fc4e7d288755afab9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991110, "uuid": "31edab94-984e-46da-a63a-6127aa272be7", "value": "T119C66B11FADB95F1E9035831406BB27F23345D048B28CBDBEB547B2AF87B6A11C6A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991110, "uuid": "977508e4-505d-4ac5-807d-e810628f9aa5", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991110, "uuid": "6a842b41-d802-47b3-b154-789123398cb4", "value": "49152:0uWMRhC0cFIGimnwPoc4rW6lDzmO6BLz0Rdwngo7PdRCPt257+2LuChQQr9jzunL:eMnCvnwwPrx3MV7UChJ4ZuOEgd2E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991110, "uuid": "162eed2d-e370-4aac-8375-a43547bf41cd", "value": 12576768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991110, "uuid": "1f64eaa1-ae32-445e-9763-30b378bca07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991110, "uuid": "7dad4596-6d4e-439b-904f-2a9c577aabda", "value": "Flex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c52095d-8809-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784970947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970947, "uuid": "88d04786-caf0-4028-94cf-e50632df502e", "comment": "Malware payload (WannaCry)", "value": "ebcf21be8b00200b2ffba93aa86ab6d4", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970947, "uuid": "ae34359c-53f8-4825-a043-a900873606ab", "comment": "Malware payload (WannaCry)", "value": "c48e3a289464eec1e638c36ec12996e1c3e71d4b0c098baf94f89086c2ac69d7", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970947, "uuid": "e82333fb-9426-467b-b2ec-8998623b2bd4", "comment": "Malware payload (WannaCry)", "value": "e2c42eb4661a0c6c9ff46d7138bf20419a128854", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970947, "uuid": "950d1c0b-9b6b-4da0-8fdd-46238b1ecd4c", "comment": "Malware payload (WannaCry)", "value": "c428e007137e94eab4af1f6e47094e0e591b030aef8e38181cd5abd9667be418e2638dbbbb78e9f4ed3597c1f0972761", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970947, "uuid": "8388fa5e-c30f-4d34-bded-f0b779fdf3db", "value": "T135363358726CA1FCE0450AB484B38D1AF7B37C5567BA4B0F87C0866B0E53B9BAF90751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970947, "uuid": "aa80609f-b5a2-4c4a-969e-6d67d3686be3", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970947, "uuid": "c74ebce2-5130-45c1-b1d2-0ecb41e15a8c", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:DXDqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784970947, "uuid": "f5cd99d9-c3e2-43d7-aa32-c81b80489f7e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784970947, "uuid": "d3c17d7e-24ee-4bfb-9cc3-5cce6e91c369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970947, "uuid": "cd8fce3f-182b-43bd-9157-90e1836d2dce", "value": "c48e3a289464eec1e638c36ec12996e1c3e71d4b0c098baf94f89086c2ac69d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dd5466-8845-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784996891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784996891, "uuid": "63582571-69a9-45a7-8203-5f4e2d5edd82", "comment": "Malware payload", "value": "c58715d9037e9b5f93fde78b8ef4daf0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784996891, "uuid": "fe822169-1c34-4e11-8f35-e52c41a637c0", "comment": "Malware payload", "value": "c4948d623d115082e9998a76e3e774c3397303e407c028c7f42a502cf117bfd5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784996891, "uuid": "6b16eea0-d6e3-4bf8-b52d-44527c94392a", "comment": "Malware payload", "value": "31d4ab79d8d8a34a6bdec4611ce316d9f799a99e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784996891, "uuid": "99265ae9-5aa6-4292-a4f5-6679ed76780d", "comment": "Malware payload", "value": "3ae10562a9af0f7fc803c3e5fe78dce28bef3bf52ebbbf1c8381606b666dbee1cbfc1710035a0360113503aaf3e4b097", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784996891, "uuid": "ebb98aa2-9cac-4ec1-a3be-051f16dd1d4b", "value": "T168C27C956A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC15F9CC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784996891, "uuid": "a6cbab15-804e-48d6-9f74-437cba46c369", "value": "768:i8vCB+25j6es8RI9FYpMSUpi+20qUpi+20YQX:i8l25Jed2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784996891, "uuid": "c1c2c780-6017-439e-97c4-2bb2b2d0c6fa", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784996891, "uuid": "2a07c34b-5791-4f18-bba9-835f0ebefa31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784996891, "uuid": "86c18717-5af8-473f-8e3c-e9141d7028de", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd84996c-8811-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784974546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974546, "uuid": "1cf1303b-aee7-453c-8779-05c1318c4d56", "comment": "Malware payload (WannaCry)", "value": "e6a5add76044236710a699d28da24437", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974546, "uuid": "86a75092-e75e-4662-ac8b-a9f426c2e75c", "comment": "Malware payload (WannaCry)", "value": "c674994e24fe2c51bc8c4c0dc76ae844f0b16e54870602302b75497a417a2557", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974546, "uuid": "3aa3aeb6-2fe9-467b-be68-63cf06220bc8", "comment": "Malware payload (WannaCry)", "value": "c2b01d8a9346db93666bbe24e313a229afd229f2", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974546, "uuid": "cb257147-732a-4c96-8b8a-8624fdea8f9d", "comment": "Malware payload (WannaCry)", "value": "cc80bb853ec0f9f646015484f355486ae8a82fae1c70ece66e31933d6510809bcc8de1db5c6f6ae293bb4c0ed3b16e99", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974546, "uuid": "aa4bbc05-9612-46dd-ba46-4f5369ddfd39", "value": "T16736238932AC90FCD11662B4D8B74E12E3737CA921BE970F9B54876A1D03751BB34B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974546, "uuid": "8e3a6ce7-016c-4f1b-bc1a-b537d4f76e1a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974546, "uuid": "d31a4157-33ee-4179-bf4d-768187c2886c", "value": "24576:jbLgBbLgurgDdmMSirYbcMNgef0QeQjGZ6M+vbOSSqTPVXmiH:jnsnsEMSPbcBVQejl+TSqTdX1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974546, "uuid": "39ec7498-3066-49c5-bc84-3a6ed64888ca", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974546, "uuid": "409e6547-98fc-4b0e-a962-7b547b1a4578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974546, "uuid": "46942fba-252c-4f91-bbc9-bb00dfd51f2c", "value": "c674994e24fe2c51bc8c4c0dc76ae844f0b16e54870602302b75497a417a2557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b2623e-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991446, "uuid": "9b4207a1-dfd9-472b-b6fa-82f1356276a6", "comment": "Malware payload (Mirai)", "value": "f0b473371f46ef818078d4101dcd3f77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991446, "uuid": "eb4debb6-8f1c-43c8-9978-b4fc6649f8e7", "comment": "Malware payload (Mirai)", "value": "c6cb5e619ef488004aa8d40cda7a5444fa8d8237894a4eb6e092202e97176ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991446, "uuid": "ba3e00e3-7193-4bfb-8286-bc254b78090a", "comment": "Malware payload (Mirai)", "value": "becdd390dca36345cf570d1f4531677dcf345802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991446, "uuid": "a293a552-26a1-4b94-bc06-2655dd7f97cf", "comment": "Malware payload (Mirai)", "value": "977e9893d3e56336c53bf4392e1fc5dadea783499822493b6498d772f81359c4249179280f2ea8f20266b352dec9ef25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991446, "uuid": "df747534-5775-4e14-a014-7e6827f8141b", "value": "T14204C60AAFA10EBBD8ABDD3702E9064534CC941722A53F767674D528F54EA0F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991446, "uuid": "fe897541-be49-4b5e-b2a9-ea7706abcb41", "value": "1536:e8EwMoRunG6jV3vOW0L5T0D9uxGXpugj/kAWT8D/GhK6VWdyMZgJuCMeD2W2mOOD:eLoRh6+LR0d57M+yM+XD2FOexPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991446, "uuid": "5b950583-eca3-464e-947a-75589c4e17fd", "value": 189788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991446, "uuid": "143e63ff-899b-47df-8b7b-44feab532457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991446, "uuid": "2d91c5f5-b9f8-4a61-b62a-49dcfd885350", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a7c8ac-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975333, "uuid": "d6add197-9909-448a-bcbe-27cee71eebdd", "comment": "Malware payload", "value": "1b2da206f8a65590fa2c375cbd1273b3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975333, "uuid": "04f03fe6-efb2-4dd7-a522-f48e94fe87dd", "comment": "Malware payload", "value": "c79491ff70b8c838809be8271c277fa28f63dbbb68752099814e1d48a208dff6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975333, "uuid": "e0536d95-d2f7-4214-966b-4465ffbc282c", "comment": "Malware payload", "value": "b2dc6fa86d0ebaa3d9d65286c73d4324099b48a6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975333, "uuid": "230b002d-0af1-4478-9bac-b7224a1ebf9e", "comment": "Malware payload", "value": "380bfaf169452570688414acfeda5b806cc34cf9f0ad313c98dce2c6d25ae82018e66c622d690e9444ea2c47f527b543", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975333, "uuid": "2822ec09-cb1a-4e1d-a694-8a5e0fc85549", "value": "T18C715C56DC31C052EE5BDA389EEC1E1E14D1A3CF21490C0BD259097B22A5AED72311AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975333, "uuid": "4036d1ea-d30c-4b98-a50b-c145e6802256", "value": "96:DUb8P5W0jhIGXmy6SB7T7CQqxf2lOjEM6/hHtBejKI:4bi8yI9Mx7KmSEMmHHejKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975333, "uuid": "62bb1f3a-4d53-4e80-864a-0817af255b3b", "value": 3628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975333, "uuid": "c1a79e6e-8efe-4819-9f03-3f56d70f19c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975333, "uuid": "8d2266bb-8128-413d-9221-7a3756282801", "value": "images_20260724_132758.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549dc796-87d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784947285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947285, "uuid": "57786f3b-5771-4fd1-b881-d094f6216e7d", "comment": "Malware payload", "value": "c1d64004b81bf0b691b586088308d9d0", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947285, "uuid": "c4382584-e6c7-4e0e-8c2f-431f77d64171", "comment": "Malware payload", "value": "c7bc72316c35399d1e48a5a2e6978f9ee1016e37243971ae0390def7fd836f79", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947285, "uuid": "2f100938-b86f-4d47-b262-11bde8d03c7b", "comment": "Malware payload", "value": "d735280cda5c12ae4ae35fd0f465722f62aeca0a", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947285, "uuid": "4c947cca-8e80-435d-954f-c162a913cba4", "comment": "Malware payload", "value": "c1240e741c54fa9af0fdf309dc38534e88501f88436567f7397e38915a6c51fe8580384aeaf0beb2a48862302a2ffa40", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947285, "uuid": "2e1c6837-da07-439c-baa1-3253e1f8e5ad", "value": "T122E522D9FCD231B1E037C3BB82A324AEB529774896658C0F7BC81B605E16519BC3B359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947285, "uuid": "f5853f54-0c12-451a-aa8c-d806b5105b9d", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947285, "uuid": "f6a54647-c871-41a0-916b-1b96636dbb07", "value": "49152:Po3oJ4I5s3ATSgYkzNQ23HDZ2Xt00ZBwUcmcRucca4ksIGP/Oj5OouQzur70o:KG4I5s3AGgYA/H89LXT8Ca2Iw/ZouQe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784947285, "uuid": "af57e230-aa0e-4d0d-8070-cff7df4344ca", "value": 3025408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784947285, "uuid": "be173c3e-8587-43ab-a36b-de579f9833f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947285, "uuid": "4d980c88-a9e0-410d-8c94-98c12dbe1825", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e45f53-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975287, "uuid": "019d8a77-7342-4d2a-947f-09ebb55c8adb", "comment": "Malware payload", "value": "cbc04dd13e0d456e5a575e7e5ba5b7c7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975287, "uuid": "82490317-02e5-4624-83be-66570ceda61e", "comment": "Malware payload", "value": "c8aaa90724cc98dd62cca670cba0eca63816df076749e0954d8323e16ba4160d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975287, "uuid": "c415143c-f5ae-40e4-a2d3-e94d312f1dd6", "comment": "Malware payload", "value": "6d911beefb166f52884249f9090420294c03576a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975287, "uuid": "8e5ba4e3-4edd-42b5-a028-16caa3dcf7f5", "comment": "Malware payload", "value": "1bde384ab0184ff3b3211d33613c29ba3e4a1f171086d9bfcd180476979998d42838c00629a3b82a310c0a15b7b90aa6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975287, "uuid": "f42eb50c-3a31-468d-95fa-4f9276d6cbbc", "value": "T15C22BF53882BEFDB9FA5D37487E3D0EA5CD2699718C10995B4CA4203160F6F6934F4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975287, "uuid": "f1c4daf6-0807-4a3c-aecd-c51c098b6e2e", "value": "192:sWXwu36f/QKPJgAbIB7dSVe5hTbMUBadPmXhCOVWADUaEmyulqE3dzu:swcgCJ5b27dEe5hPMVWC3zydS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975287, "uuid": "f169ed24-b653-4313-8c0f-027cc854b0e2", "value": 10147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975287, "uuid": "81906248-0243-40a0-87c8-c3ec4740fd77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975287, "uuid": "22fe37f6-1fd0-44df-8e3c-59ca91029449", "value": "images_20260724_203625.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a4e651-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998796, "uuid": "772e6a01-8952-47ad-b1fe-f168837fee66", "comment": "Malware payload (Mirai)", "value": "489a7d8d98d1cc478e4f96f148277c2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998796, "uuid": "1dc15f79-be65-43f0-80e7-cf217ebe81c5", "comment": "Malware payload (Mirai)", "value": "c8be56f0838af7ed2133b264c5159ae079a74796a761bbf0764eaec8987cc5b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998796, "uuid": "cced624e-f5fc-4b91-b927-9c5602ad5a1b", "comment": "Malware payload (Mirai)", "value": "60aa2522499bc3614b3bbb8b854579019c672895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998796, "uuid": "a8d840f3-4fe2-48e7-95d0-783707436fd3", "comment": "Malware payload (Mirai)", "value": "19efc326f7ceb191dc261ac60840143eed1f67c019645b2466ec0a53beaf75cee840d8d88c02361c4a897bdfe486779c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998796, "uuid": "5276e8c4-c03c-4a07-968e-ac513588c99b", "value": "T191C35C0673180F47C5930AB01E3E3BE987BEE5E421E0BA8A650F9B564675DB7144AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998796, "uuid": "a61f4ef5-9cfb-4bae-955f-0958aa8fbec2", "value": "1536:Womlj+GZ9yPwTlm55Tjoei9NyR4IEsFZ+FmY5tNVYvQHe3jt:Wo4w5BjoPqLFkmEXHe3jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998796, "uuid": "b5c451c7-6945-48fd-acfe-bf1e015960be", "value": 121348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998796, "uuid": "38ca94a5-7ee5-4f95-a032-5fa0ab3d822f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998796, "uuid": "28d91450-24bc-433a-b7d5-b67f9eb3dc2c", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9026171f-8836-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784990335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990335, "uuid": "dbca4af4-4691-473a-a564-bd98e55160ec", "comment": "Malware payload (SalatStealer)", "value": "de24ce9481c388e292b095b0f8e09a81", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Malcode", "colour": "#F706EA", "exportable": true, "hide_tag": false }, { "name": "Maloader", "colour": "#741CC3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990335, "uuid": "d0ea3f3f-983d-45fe-8706-3d47a61de9c9", "comment": "Malware payload (SalatStealer)", "value": "c8cf9551339499b259b39fc5fea9570c27fc46bb3c9958daf22b859cf268428a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Malcode", "colour": "#F706EA", "exportable": true, "hide_tag": false }, { "name": "Maloader", "colour": "#741CC3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990335, "uuid": "c7563f4d-82ff-47cd-a9ab-a168871417c0", "comment": "Malware payload (SalatStealer)", "value": "cb6d0ca81ead6072d41a225cd14447cf9d5d5600", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Malcode", "colour": "#F706EA", "exportable": true, "hide_tag": false }, { "name": "Maloader", "colour": "#741CC3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784990335, "uuid": "2e282c71-4b52-4923-ba4a-0ee2c12a279c", "comment": "Malware payload (SalatStealer)", "value": "f17ace7502f9b04d7687d4821afff98e2e292c868ed81a4647a5260aa47a21c53fa7a6b32287ab746ac1803b5636079f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Malcode", "colour": "#F706EA", "exportable": true, "hide_tag": false }, { "name": "Maloader", "colour": "#741CC3", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990335, "uuid": "da8af3f3-cb92-42ea-acd7-37bb4053c944", "value": "T158F6BF720A53BCBD3FAD3D45A0052D486C5D7A1B1268835AFB8934BA63ED4A4CE3CD35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990335, "uuid": "748f4b6b-3fbe-44c6-aa0f-eff45867e83a", "value": "49152:pvXLDrgTm+TSXsaGnvFKfeYdzmgJGOPTpfj3ttNNTOl7FFb975J46co15KwkGp5Z:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784990335, "uuid": "ab2457ad-6aa8-43f7-ad7a-8db44c6b1230", "value": 15854556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784990335, "uuid": "acbf4fb7-2529-4acf-b6c2-50045a1542cc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784990335, "uuid": "d82cfd9c-66b7-42cf-b698-26dcdfd3aa50", "value": "service.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a2e023-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975709, "uuid": "19d19002-49ca-488e-89b6-1e8477410c40", "comment": "Malware payload", "value": "4423e4bc41296be430189b8480eb211b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975709, "uuid": "73983e52-58e4-4a3b-90c6-11928cf84382", "comment": "Malware payload", "value": "c91e148c225842770c00dcf8c088837e91c81e0bc76d7c641e1ef3ab7830db11", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975709, "uuid": "557e7358-c97a-4a94-9a33-1071ed55d3db", "comment": "Malware payload", "value": "c80adf801e84801efbe7e69f2a193f3efc270608", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975709, "uuid": "835ce017-733b-4cd6-8398-c4fded5eb400", "comment": "Malware payload", "value": "133e7a9a3e4627206735ea6855706d7e6ee304622a0f0b2a3e70fe6f0839e4e0876e537d682915b472b090693cf31184", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975709, "uuid": "f637cb06-afe7-4246-9e24-79532303ec35", "value": "T1BC22BE002A8FB5238C0FE235B2C9748EA636041FEB7C9533227BA4884759CA24CC378C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975709, "uuid": "464c0cee-0465-43bd-acb3-2c48cbf3dfdb", "value": "192:SQtPtQKvXnhcsc/v0rCAJK/zMmRn8/moejzdVRLzHfewVUWOVtsQ0L8:1lQKvav0rtirnjljRX/G8UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975709, "uuid": "a7585517-e3af-4694-bee2-0d7d44bdeded", "value": 9925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975709, "uuid": "4c7ad80e-3f32-4da4-a580-d5f1c946c2ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975709, "uuid": "653a144c-74ce-497b-be5f-555161d4f01d", "value": "images_20260724_195403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f1980e-883f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Hajime)", "timestamp": 1784994239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994239, "uuid": "282f2168-609c-45ea-b854-6db67fd61138", "comment": "Malware payload (Hajime)", "value": "c66bc488ceec9cad682b4fe02f809bae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994239, "uuid": "81a91fc0-70f3-41ba-9f5a-253d929876bf", "comment": "Malware payload (Hajime)", "value": "c936c3a46e8cff1694461add790bd0cb7a7adbd4b05e855c9873e778d6eb81f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994239, "uuid": "77c39c6f-f55a-4f3e-9644-573620ba1731", "comment": "Malware payload (Hajime)", "value": "ff70b489415a94d3dcfc057868d66e2bd1722017", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994239, "uuid": "b59fdee9-2b6d-41c8-b780-f25d3dab6cc8", "comment": "Malware payload (Hajime)", "value": "a9806a5125a954b665267f742fdb189a7ec1d1370ddaef83d64d8a70c9752f927adb9751b14a5eebcc56dfa56cef16c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994239, "uuid": "a55ac2bf-0936-4d9f-8147-6bd57de883df", "value": "T1A833024623A62FB6C5315DF1E3FCEF89A04A7D949FE61C0A7C213659A47236C28C4C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994239, "uuid": "3439b168-b064-4028-959b-2f94ffc72ebb", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0Wgswnr:yYI0ARqw1qAEv7UIFM8oJorFqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994239, "uuid": "3e376476-6d0a-413e-bf78-9385faa2b063", "value": 51520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994239, "uuid": "b49e71b5-5ee4-4555-b9a7-25e47852524a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994239, "uuid": "368e3234-c18f-4848-90b3-c4714901a4d1", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e776fafa-8883-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785023553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785023553, "uuid": "e6768f66-f8cd-4305-8452-c7fcf43e185d", "comment": "Malware payload", "value": "5486e84151a82e8cc42624e85ff9fc6f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785023553, "uuid": "40a6d739-0d6e-493b-9a62-9f0596c018f5", "comment": "Malware payload", "value": "c97311cbfd923b181a76dbc92ff029e2dd33870458bc24c73be9d5074f388e66", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785023553, "uuid": "0fbd611a-7f10-4dba-a4b6-f4ac370151ca", "comment": "Malware payload", "value": "de632e92a37155fce6f841d2b1a6afbeab46be3a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785023553, "uuid": "cd95a877-6907-4d95-aa16-e05d99543df9", "comment": "Malware payload", "value": "5d828523db9ffaf10ed6e133009dc7b13fa8ecfd5463354f3f41d924a1d8dc09446d0e1cc440b8f46d240d0371a49cd4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785023553, "uuid": "9991a830-eaea-473b-a2aa-c76346edbded", "value": "T19FE63308E6E402EFEAE2813DBDD26167E9A434624B71C55F1B8443B6BE573E04A3D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785023553, "uuid": "1ab09296-e075-4be2-8b13-cda3d5dc28e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785023553, "uuid": "9b85357c-bbb5-4033-8b6a-fe65e2104975", "value": "393216:i1E9jZcMwYemsvaPIcSF4XMCHWUjXKcuI3/PGTAI:iuJ5bemLSF4XMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785023553, "uuid": "9aadc345-87c3-4b16-a2a8-427b37d322f8", "value": 14302690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785023553, "uuid": "b4c78500-b716-4982-a384-df5f9a5d29da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785023553, "uuid": "4091663e-bdb8-40bc-b309-262363345d6f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e294518-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974655, "uuid": "e4a91d14-ddc2-4fe6-8d07-e45cd350410e", "comment": "Malware payload", "value": "78acf797ba7129c141c6483da1582446", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974655, "uuid": "d4adc79a-f1c5-42c2-808d-76c2ac5f22ce", "comment": "Malware payload", "value": "c9df993a89e9db68f1f99bccfffb70eb1f183c66fb92e903294773c40ca5413e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974655, "uuid": "22d5081f-822f-4fbd-bc89-5245e95bd6f0", "comment": "Malware payload", "value": "769435048d85838e192714ff687d833ceac27281", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974655, "uuid": "c7b61df4-1fec-4926-b7af-748eef7d71b0", "comment": "Malware payload", "value": "68b88f40aeb016a85c9f88877f72e5560548a8857478ecbff0cb5c8f34386d182a564851e5cfe4879635941602a7aeb4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974655, "uuid": "e1883cf8-60d2-4aed-bd0b-ee1038552e1c", "value": "T17F52D0E44F4A210284EFCD347EEE8819A46C72C9199792F69971B073B4BBF6442D4337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974655, "uuid": "8919e8f3-a6d2-4550-9842-12855192f6ba", "value": "384:d5lr6k2WrYeoiiCzeTzdev1cYQgFl9wZ5terp:d5lOk2WrtovCaVevGYQ+wZ5tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974655, "uuid": "9ed659e5-ac62-4457-9eac-1c7280599c66", "value": 13863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974655, "uuid": "dec2e563-adfa-4fb6-b402-018643418f5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974655, "uuid": "6d03ef59-6ff5-4fb4-98a8-05572d0e62d7", "value": "images_20260725_092004.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112b7511-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998712, "uuid": "16677095-e0ae-4bc7-8385-95321026194e", "comment": "Malware payload (Mirai)", "value": "bd90463bdef0a76a0f0a3211d4ae13a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998712, "uuid": "0f803934-8d32-46ff-a8c6-3882d883b936", "comment": "Malware payload (Mirai)", "value": "ca51b527012988ed642adf53be6123f74fb2bd0017871a07d935f69fd321518c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998712, "uuid": "74e1b8a4-c69e-4735-8fd4-d6ccc30335f2", "comment": "Malware payload (Mirai)", "value": "7ada067c7334f5a24fe0b16f28139cb2336eb4f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998712, "uuid": "ae35f406-a81c-4cd4-acd7-2335c24564be", "comment": "Malware payload (Mirai)", "value": "02a5da686a18c08a2e6fe63396ef4a85784c6725795158649000862c31bc4969f2ed86fe6bcf1102e65872ad3dc31c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998712, "uuid": "805a6a16-8f09-4268-96cc-1d541b74d716", "value": "T11FC34BCAB801DE7DF90FD5BA542B1D0AB921A3515683172623ABFD936D321E4BD03F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998712, "uuid": "63540c84-3f03-4b5d-9463-8f03918a7f61", "value": "3072:qjZpROP0/IM1PQsekJHkzQYjmTXqKYt+RtFm+B+:ERO8/IM1oss0gmLqERtFm+B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998712, "uuid": "87b347f4-0048-4332-8c44-4c694c64a17c", "value": 127320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998712, "uuid": "2047bea9-6900-4f31-812c-2665ff07926b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998712, "uuid": "63944dff-0c6e-4020-854c-24dde271052d", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f801c43-8862-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785009151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009151, "uuid": "79dce178-3e60-4d35-8462-3dd4883b07bc", "comment": "Malware payload", "value": "17ac3a4c603191a68d14a046245ba522", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009151, "uuid": "44e5892c-ce3c-4ae6-8eca-edb739a867e3", "comment": "Malware payload", "value": "ca7fa72c6642d5cb83ea60ce873964eff752e6ad66aac959da25d722ce19256e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009151, "uuid": "8be325ae-d475-45f2-9570-dac32c29f62a", "comment": "Malware payload", "value": "514dc84190643116c35edba01dcf2eee6c908fcd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785009151, "uuid": "ef20e926-4b06-49a5-bfc7-2a3bb79ec8e7", "comment": "Malware payload", "value": "af41b0140818f0a6adc497485d95437323e8332180729e4d5fd9997aeffd0e58cabb75b0e652fbf9696f5bab1369ba6d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009151, "uuid": "8a3a88db-08c5-4927-b200-fe30281cd352", "value": "T190E63388A8D105EEDDA7513CFEF26841F8A838791F36C5CF17405764AD2B1F09A3D29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009151, "uuid": "aa11196d-fbb8-42d8-8fc2-c81f77193569", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009151, "uuid": "ddbab923-14f5-4434-956d-9cc9abd83dc1", "value": "393216:WMaY0ydC3a09+yWnmlT8kW3ryCtiXMCHWUjXucuI3/PGTAI:W3rjK0zs3ryvXMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785009151, "uuid": "dc5046b9-0f9e-4eeb-9b29-284013f4fac5", "value": 14311593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785009151, "uuid": "cf847651-62e9-4d07-b804-3e4dc6fd4ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785009151, "uuid": "c5b4dbef-a1d1-47f9-8376-bf7c6a0ac18d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14348642-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991415, "uuid": "5674725c-3c3d-4b65-9b8c-a086e77d660a", "comment": "Malware payload (Mirai)", "value": "7d9a643afd8546b2a33606029898c75a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991415, "uuid": "4f496fc1-f92d-40a1-8c90-22554169d8ce", "comment": "Malware payload (Mirai)", "value": "cb3b7676551de6c875a04bc1a0fd5664676315a2e631d57f4a6d39301b192993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991415, "uuid": "7667e27c-7d1a-4d96-9ed7-26c38842418a", "comment": "Malware payload (Mirai)", "value": "410466d6563f04e3a15fbf88b4792f02db356ff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991415, "uuid": "c40fd00c-cc1f-469f-b0f6-03e05624d802", "comment": "Malware payload (Mirai)", "value": "3fe1cd9a2f673c1ea147d00bbacb3e85dea718fe6b9af368617a5bac1edaae786e0de7f2f46ac3b244ad16607a864f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991415, "uuid": "9f79f86e-e3fa-4754-9d59-4d67848f189e", "value": "T179A3C51F2E619FACF3A98234C7B74B34A76D23D122E1C684D1ACD5042E7434E591F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991415, "uuid": "1b482aa6-2c78-4719-a24b-22ce96cf2072", "value": "1536:aR3YOBch7fAvnj9hVcOWLf5ADihO/MErX4qHy4Qh/3+q0jgTmKl:hNfAvnj9hVnQ53hOtrTQJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991415, "uuid": "8a97bc59-95cd-4c65-b0b7-4b4d048c4a6c", "value": 101180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991415, "uuid": "06bc3916-96bc-4c2d-9b92-ec8914ffb9bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991415, "uuid": "ef52a6be-a15c-4531-a382-c6c8f38d3736", "value": "ANmR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa9b6fb-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989198, "uuid": "d7be007d-d63a-42ce-b944-cf8d8d91402d", "comment": "Malware payload (SalatStealer)", "value": "7c54db36b3f281e62fbeedcfc3df0334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989198, "uuid": "eb43c35a-9dd7-4d52-b357-2956092bc39b", "comment": "Malware payload (SalatStealer)", "value": "cbd39a1bfb6a591298418c026ac5499733abd16236f412e29082085c476dde49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989198, "uuid": "66e4c247-7347-40e6-a663-f5ebe0219e3d", "comment": "Malware payload (SalatStealer)", "value": "528a24284ae80aa10f3330c572100cd76143cfe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989198, "uuid": "b1402a07-9146-4b9d-baa2-c1b62f5055f2", "comment": "Malware payload (SalatStealer)", "value": "73484abeb966ed1e615fd53d52b26146807392b1453bde07d76725237117d8f7a75a1ea965a402f2f510516cc7d5d6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989198, "uuid": "7f6e38be-0639-45fc-80e9-ba11111e6467", "value": "T16EC65B11FADB95F2E9035831016BB37F23315D048B28CB9BEB547B2AF87B6A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989198, "uuid": "11ffa015-8f67-4418-bc59-bfa823be3122", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989198, "uuid": "205ec1d2-b01c-4336-808f-d95368af79a2", "value": "98304:8un+uBu7zmCvjkqwntcKNsAr4tG20CzEc0:ouK/jl4cKu0Ht1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989198, "uuid": "634daa35-b167-4044-aa25-6d7fb3bbe0f3", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989198, "uuid": "27aeeb14-89fa-427b-8887-2bff83545695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989198, "uuid": "fea7e155-dd9e-43aa-9d3e-e618cd4d2177", "value": "ZapretX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5460d18d-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974773, "uuid": "cef212b2-30ad-4b02-856c-b8e9ea268d8b", "comment": "Malware payload", "value": "c2478860a450fdf184c0723e1afd3a1e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974773, "uuid": "3736a998-a874-4039-b592-dc78afd9c5fe", "comment": "Malware payload", "value": "cccdd37f58cb8e8f41ec7d3d56ce81d3fa682058e3172c8fd7aa762d72213704", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974773, "uuid": "bfc2a764-1e0c-4426-947b-881b9cc37d03", "comment": "Malware payload", "value": "d6b2d17ceee00edd091ecd2f23d9a3536852a042", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974773, "uuid": "f0386230-f933-4541-8f9a-3a2bd09cd016", "comment": "Malware payload", "value": "8d4d8482b4c87b92477d05eb6b4eaa6908af208122c1719d07df77f059cd1c74af7b07b4d0f9b001b84f61c82bc188dd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974773, "uuid": "c99b804b-8e7a-4b18-b493-58442e57f11c", "value": "T162918EF28453A17CC212EC71D8DF4FE51D7154607BD8962F817F28E09DB6B0C0425DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974773, "uuid": "bd735ad9-472d-41a7-8876-9170cff8b8f7", "value": "96:qHY7SYPy1p2CgQ7nywLJSIbyzMIkvOhtgdw0vJBHBSt7Cgu2sBdp8Woq9893RN:ZhPOIC9yqnbCMIkogLv/HBSZClr8WolR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974773, "uuid": "c0e1c93c-470d-43f5-ac79-a734633c7d1b", "value": 4450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974773, "uuid": "cfde0859-4ed0-44eb-89e0-3a424a3e07ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974773, "uuid": "31d1f3ad-bf50-463f-82d0-be59f876fc4d", "value": "images_20260725_065306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39efbcfd-8817-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784976876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976876, "uuid": "a35b7682-5bd9-46b1-80c4-27a4b11b29f0", "comment": "Malware payload", "value": "33492f6f9af0deb485c6e5898ef2da2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976876, "uuid": "56a038c6-7119-47b5-a785-780eb201d07c", "comment": "Malware payload", "value": "cd05fe39b73d3eab618ef2e6b6300f2a24d57d4e259b35647a909a7c616ffa91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976876, "uuid": "c69b3050-045b-4c2f-9216-c082f8e53cec", "comment": "Malware payload", "value": "3b2b37b106b33635870fee10ce160369f7cf2c0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976876, "uuid": "62932415-bb43-4d57-94ed-9ffbe32c999f", "comment": "Malware payload", "value": "ad08cfc8a5546341045a2cde9e0938425aa4ab07df42cceabdde42800efb8562f0b15d1d81f6cc9ba3f9e476b63a74f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "njzlopghznkamkl-cfd", "colour": "#404F18", "exportable": true, "hide_tag": false }, { "name": "tonapi-io", "colour": "#2AC08F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976876, "uuid": "789958bd-809c-412d-a7b4-615c53a0d68d", "value": "T18F942A4C2ACF7180917ABDBB3AF36555E7A84C81624899C8F9D03B2FFC2076ADC55B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976876, "uuid": "28780351-2f5b-4168-92d3-4784165eb128", "value": "6144:SaZW/q1CAMmxkgZhta8NTQMnAydo+eNDRZYS+lXggNC8:6CCAHxk2ubWA+xep3YS+lwg88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976876, "uuid": "9161b589-a7df-4dd5-a55a-181d3bd8cb80", "value": 412477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976876, "uuid": "907acde5-b4fe-4b86-8673-a1f40bca569b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976876, "uuid": "8b481f8a-4efa-402b-9174-ef02bf91f56d", "value": "cd05fe39b73d3eab618ef2e6b6300f2a24d57d4e259b35647a909a7c616ffa91.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93550904-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784981750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981750, "uuid": "71e2badc-5a80-4d5d-a5e0-8a7488a35643", "comment": "Malware payload (WannaCry)", "value": "9115bd384681bae8ad1fda391f0f3235", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981750, "uuid": "0811732b-1ed6-4397-a81b-8ac56a4d1396", "comment": "Malware payload (WannaCry)", "value": "cd62ae8b73fe8129e2912975108f4e9881b872a5e0219c880721c2107bfd4058", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981750, "uuid": "6ad3d307-d7c1-46ca-9666-df0953745989", "comment": "Malware payload (WannaCry)", "value": "0efa9b13c5c572b41788ad56b12a23afec4a54d1", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981750, "uuid": "90771c6d-61c7-4d8d-9a16-0b42290548c5", "comment": "Malware payload (WannaCry)", "value": "80b928544e430a4611b35d05bfa9c688829e6597acdb8271fdcacc190bc6b42be88bb93a48dad56136c55dc7163627a1", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981750, "uuid": "aa307a64-25c0-4960-ae5c-42d2acdaac98", "value": "T14A360237AE5872BBC016223654B7FF1D62B2BCCF316AE2CF9A6C07264C036759A55701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981750, "uuid": "2087f029-3f9f-47e4-8d5f-6383a1e2939a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981750, "uuid": "c3d583e9-5d62-4581-bb3c-512ac2df2c3d", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYa:jnXnAQqMSPbcBVQej/1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981750, "uuid": "0443fc58-2021-41cf-aeae-0f6155c2d0fe", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981750, "uuid": "a8852034-b31a-476f-b8c3-9f35f8540a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981750, "uuid": "284ff034-530b-432c-97b3-7e679218d27a", "value": "cd62ae8b73fe8129e2912975108f4e9881b872a5e0219c880721c2107bfd4058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16702369-8855-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785003445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003445, "uuid": "7fdbe6b5-3aba-4648-9a54-256c222b5010", "comment": "Malware payload (Mirai)", "value": "516530f3f64449f4377bbd06fc4d7486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003445, "uuid": "7af6a56a-3264-47ba-8335-63a2c62afa79", "comment": "Malware payload (Mirai)", "value": "cd8103d0eaab7ebdf0617da38859a0274505986ff9c45583d4e4d95886f8e3d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003445, "uuid": "4d7f6295-714f-4630-84b7-71f5ba9fdb33", "comment": "Malware payload (Mirai)", "value": "302a2cc6c98fb2647fb7c6d16b4fd85d91b113b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003445, "uuid": "078dc961-8fe8-4f52-99e5-14f9dfa007e6", "comment": "Malware payload (Mirai)", "value": "acd964b63857f472a0d20eb8b077fab4100afaaeb50d18d3e8bde19ace236bdbadb38614785c5ed726e0b055da830301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003445, "uuid": "2496ec6e-2cda-42f3-b3c9-4f2431da35ea", "value": "T1B733F1DC239205C4E09E84F9CF21DFA4FB1A17E5D1C7CD496E2761029D8D8A9B40BFA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003445, "uuid": "ebe59c7f-11b3-4fb3-aebd-2aa8f8166298", "value": "1536:PnBL63RmqXNJgQxJ7FQQ5Wq95IY5As9VJuCA:P96BzJRQQ59X5As9VQCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003445, "uuid": "27cdd809-70bc-48f1-9a3e-277269781f31", "value": 51052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003445, "uuid": "9c1444d4-c4db-49bc-9cd3-1ad951b13618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003445, "uuid": "fd7dd833-5204-4b94-a3ec-aa0bc922a430", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c149c1a-884f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785000904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000904, "uuid": "be0810d7-f6a2-434c-aa0f-8453390074cd", "comment": "Malware payload (RemusStealer)", "value": "0755a7cc6c033ed6f38280a4dd78c3e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000904, "uuid": "926edb4e-4568-41f0-8a64-5db6ae2640e5", "comment": "Malware payload (RemusStealer)", "value": "cf426ee0da8f8907c42dfe264552ec560d5a97ff85ec7a7bf4518e773b19ce50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000904, "uuid": "8ddaceef-3645-4f65-ae49-a7b65a8a4746", "comment": "Malware payload (RemusStealer)", "value": "94a74afe4341f23d776410d413582e0f78110ec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000904, "uuid": "c8746b37-4edd-4a32-8d4e-5225837ff158", "comment": "Malware payload (RemusStealer)", "value": "b4ab49ffaedbc860c869e6b7e2c0957cb8fd3a780142d4b571ae18e18919e67a29902b01e0618a91ba393807b6018897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000904, "uuid": "b98e894e-5abf-44e5-96db-934e0299b47d", "value": "T19FA63917BD9048E5C09AE23289B75256BB75BC0C0B3233E72EA1BA782F727D05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000904, "uuid": "08b432f8-c4ba-41cd-a635-04cab4849f82", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000904, "uuid": "20f290c7-c75d-4694-9431-8b16e9027a2a", "value": "49152:5Pj8nkvVzCnN8/IeVB0ysiBzk+coP998B:5wLXY5cKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000904, "uuid": "d7201484-99d5-4540-b70e-d362e5115302", "value": 10037592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000904, "uuid": "9723f96f-97ea-47b6-bf29-7ef70653e1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000904, "uuid": "2c3253c9-1b16-4c28-816f-0e0dbe809c0f", "value": "Phantom Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10832242-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974659, "uuid": "1c0662cd-e4fe-4614-8244-e13526cd8610", "comment": "Malware payload", "value": "21aeeeebaaaf2964c820961e9b72165b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974659, "uuid": "f788836c-4015-420d-bb03-11857205c4b5", "comment": "Malware payload", "value": "cf4f4837029f28d023447116e3f0f170a84951e0a8316db698d515ea1788a6f2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974659, "uuid": "89118035-2c63-4db2-8ef6-406493674245", "comment": "Malware payload", "value": "98dbd55d4aca9d079bc03ee27c628168a071c076", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974659, "uuid": "e1084ca5-66ba-4938-87f7-7da7219f635d", "comment": "Malware payload", "value": "6ada24075a81697222468f2aafee46348f68b5bae066a553c68ef18f4f2cd262d24381e2f65a058c1816587a818aae54", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974659, "uuid": "7569af1c-f548-4bec-b07d-4946507dcc61", "value": "T1E462C0CAC5C897FDCE19563840D88293101F20CF73E5A3664502B7671BAFE9726CE29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974659, "uuid": "a8626d9e-9a95-4b26-b155-25f60b947ab6", "value": "384:z5UoojkTILq45zaNKL0qPgmpoGEBXHG+q/vLm0IhAgy:GVPzeKLPhpoGs3g/vz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974659, "uuid": "dfc91290-e469-47e6-8f4a-b82f8633a8d9", "value": 15752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974659, "uuid": "06b0f5f9-d76f-4d39-9801-8311e31d4fa2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974659, "uuid": "f8fb90bd-478e-4900-b3aa-badd4e8a0dcb", "value": "images_20260724_164036.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22030b97-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784991439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991439, "uuid": "bde26ee4-5b80-4685-82c3-e1b679e860f8", "comment": "Malware payload (SalatStealer)", "value": "3b23e3489c42b7d1dd895be45667ae06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991439, "uuid": "c8c7ee67-f00e-4897-9a6a-128e95b83a44", "comment": "Malware payload (SalatStealer)", "value": "cfef64ebd87c672631f63f65e30f3b14815f690a8a922b38fbe34c3dffbdece1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991439, "uuid": "88de7439-10d5-40c0-8a57-634d1fd43478", "comment": "Malware payload (SalatStealer)", "value": "bedb6f847129f6ec5ec373507626c2c1e8e1382f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991439, "uuid": "b01adb19-0a07-4807-8028-3437389f97f4", "comment": "Malware payload (SalatStealer)", "value": "f70148b612e9249748c8549456c224d03f2fca78deb6ff8e78f207c1ded4511647344de95e30293baabd639932396b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991439, "uuid": "5891a4f6-1704-4858-9d28-6916ecc05c7b", "value": "T108F5330AD2CAAFDEE30C6F7803563093D1E3152C94CF7B92513424E8E9A5DFA2756366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991439, "uuid": "640f01ff-58f9-4b98-839f-db04ad5a33fa", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991439, "uuid": "1213191d-30ae-402e-9df9-d336aab75471", "value": "98304:UXOmSjvnB/GMI46JdTwYSUvnLfosuy0zo9Nvr0:UXO9jB/GMl6r06P5u1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991439, "uuid": "09934b59-c872-4567-b523-43b6cafe0a15", "value": 3587584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991439, "uuid": "6a44f886-7a73-4f03-95a8-aca3cf670c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991439, "uuid": "c2477762-b1a7-496e-8422-d972b78ccb14", "value": "winvertdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68379015-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975235, "uuid": "adf73fcb-0233-4884-a1f7-6e731f411cb6", "comment": "Malware payload", "value": "3ed4a409bfb4526f2cb9d67e4f30c8ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975235, "uuid": "a1925208-25f0-4815-a94a-249c1e0d9b70", "comment": "Malware payload", "value": "d0946bd003485cf78f65a1067de866da7f085079d6c7fcd96380aafc91669115", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975235, "uuid": "1f99e31a-c32e-4020-8152-c407ff72f6ff", "comment": "Malware payload", "value": "3a12249afb25d89666887954c6cfb8f946497d90", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975235, "uuid": "811870af-94d3-455c-ba2f-faa684050499", "comment": "Malware payload", "value": "202be1dbc9a9d2e298151475e6b40abf861d51e4461a50b8bba4b728ca2bd08384f4c8f11d98566cf4ddc0e4a571862f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975235, "uuid": "7cc82a15-0f99-4c97-b4c1-6bf71f5624e0", "value": "T157712A2CA39A010AC3FA727637D8274C0A286275E898E73A5347697960B55D9B63C05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975235, "uuid": "50f33658-babd-461b-9c92-a945b9a416b2", "value": "96:mNKRYvl0Y4M399npfF0tS5dwgDuaV3Q9P:mNKRYOYX00HBDL3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975235, "uuid": "0ee376ba-71c9-4b2c-9c62-75b1f01b3dda", "value": 3579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975235, "uuid": "96559d74-4d1e-4b45-83e5-c4be782ebd0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975235, "uuid": "d28b49e0-ab95-42fd-8cb9-3437111ca430", "value": "images_20260724_202405.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5526d2a-883d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784993431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993431, "uuid": "407992d5-5319-42b3-85d1-6491529906c3", "comment": "Malware payload (Formbook)", "value": "7503c336e6854e0fd68af9dca257b930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993431, "uuid": "0beaa049-4058-41a1-905a-49df8c859079", "comment": "Malware payload (Formbook)", "value": "d1385115e76ee9953b959bfb963aaee1a77a2862842b6995dc057fef332bac10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993431, "uuid": "1e27e38a-70ba-492f-9482-af2c44c4c1cd", "comment": "Malware payload (Formbook)", "value": "5d2c70794598be26a77dcbdc009bd9730f4c67cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993431, "uuid": "2e7f4d8e-9dea-470b-829c-9b3d1b04db32", "comment": "Malware payload (Formbook)", "value": "623b1068fff6190bce0041419b2cae206493e2a223e0b1c2e9909d0f4261936574f519c9b624ab75de30498e84c8fa19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993431, "uuid": "2bf7b4b7-3c42-4999-8495-4428bfe39c69", "value": "T15835023B8DC76F62C53C0F7881AA044C23F489579262E76F3FFD01A69FA17A48636591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993431, "uuid": "f6e5e097-a45e-45cd-a39b-0b8a14cd5448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993431, "uuid": "35674b9d-3a0e-400c-b511-961bd0b23836", "value": "24576:29m2d07VES6WanbpA6d8agynZ7t8K7fhkSiKYzyp:liSQ6yZh/kSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784993431, "uuid": "7a61a28e-d218-4a8c-a020-249da7135b6a", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784993431, "uuid": "bccef8e0-ff96-4d83-bc3e-ad5bb9fb636a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993431, "uuid": "32abc5ee-837b-41dc-b9e3-e74eefc7b06c", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dce8c7-882a-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784985348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985348, "uuid": "d0c4d410-3c42-4e7d-931b-3c7a0179d0e1", "comment": "Malware payload (WannaCry)", "value": "f829810332b993b28f0a3f40cda8c589", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985348, "uuid": "9a83ebe7-ce80-4346-ae86-7328337d57fd", "comment": "Malware payload (WannaCry)", "value": "d15749f77571b9aeb35c82944783d149b45ef7a55a51fd36244be74a9d66c291", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985348, "uuid": "b37f5f6c-8dd3-4c80-9346-f41c1a0b4735", "comment": "Malware payload (WannaCry)", "value": "e3b01f8ad177a686c1bbb03243dbb7b67eb71039", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784985348, "uuid": "acf88961-08a8-4277-8346-137250999ae0", "comment": "Malware payload (WannaCry)", "value": "fc38fa697c85fcdc78a8d3d73b8b8e728caa9e076c58d247f5c5779993f123b6ed7a0300749bf090e5239be333b1de69", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985348, "uuid": "17d29e9d-ecba-4d6d-b28c-3b236f98ba9d", "value": "T15E36125932AC90BCC01A523594B35E25E7B3BC5A537D930F8B948B6A0E13790BB78B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985348, "uuid": "cc4828f5-c8bd-498f-9c32-e1207456b475", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985348, "uuid": "6a191c11-b6cf-4477-9d0c-d025fe1e4c60", "value": "12288:jbLgmebLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7:jbLg3bLgddQhfdmMSirYbcMNge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784985348, "uuid": "bda76958-51bc-43a0-89d6-a89f298bde1f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784985348, "uuid": "1617fafc-bc0d-4032-8b29-818cb1d5ecd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784985348, "uuid": "8472f981-e3ec-4994-9e2d-0bda9b6d18f9", "value": "d15749f77571b9aeb35c82944783d149b45ef7a55a51fd36244be74a9d66c291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49517b60-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975184, "uuid": "5ad8279a-fa2c-4591-a208-f86ff08d6305", "comment": "Malware payload", "value": "1f4ee8c608e7fc470461d6842a4cdceb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975184, "uuid": "55584a47-9e34-443f-a661-dd9bda327a31", "comment": "Malware payload", "value": "d2fe8c1b6e848bed7fa919fc7a3fa9ad2fbe7aa77b8066f523e99752f794306b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975184, "uuid": "ff44b31e-8195-4846-b18b-7adcc85f0988", "comment": "Malware payload", "value": "66b89218a2bafcc4401d252e5d20c793f1c0a773", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975184, "uuid": "9390b282-b148-4c7c-9418-b3e43e4e5f1f", "comment": "Malware payload", "value": "79c2f02f311ada5b197ee4f24508f22dc36ca7e25772b3ed547b2e3109515f221cb387d4f4c6c0fcfb6c2f6adc83dae4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975184, "uuid": "c2ea17da-7c68-4451-80f5-b5529ff684ee", "value": "T1FF52D0D3981329FAC677413931778059E2ADF1717F88655E84F2913C503B4A330EE765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975184, "uuid": "6f533fda-3c5f-4c18-a9dd-cf5cb27917fe", "value": "384:HqnW1xJu3J5xbh8psqyVevQMOl2DMTnNV+kM5:eW3UfxbGpgl2YTnf+kM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975184, "uuid": "02c3a4c6-848c-42cf-a2a1-192a82a2084c", "value": 13743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975184, "uuid": "4bdf0878-144f-45ec-9a3e-0283750858c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975184, "uuid": "5040953e-3d5d-465a-bbab-a14e54a9fefb", "value": "images_20260725_041958.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e2d9cb-880e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1784973321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973321, "uuid": "fa638a57-0d61-4954-a73c-58dd50832803", "comment": "Malware payload (ScarfaceStealer)", "value": "04cb543da02c2227c4ec3a17d72d41fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973321, "uuid": "675db21e-c9c6-464a-a946-04da7ba40834", "comment": "Malware payload (ScarfaceStealer)", "value": "d33fe738471c6f21f7f9c2c56893c5e286f110bb0eb242ec1b3f9145fccdaf79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973321, "uuid": "a50dfcbf-fdfe-4031-8f68-9b4ae68bf3df", "comment": "Malware payload (ScarfaceStealer)", "value": "7707d9dcb3332125863f4432f75d3026d5439899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973321, "uuid": "7e104d8d-b4ce-4c41-b62b-29930a427aef", "comment": "Malware payload (ScarfaceStealer)", "value": "776436ffe77732d652031bcd214675da27be8a819e79aa860096ebc912a5515be4ef067f3cc7c42ea86154099d9acb1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973321, "uuid": "5c1fb82d-9c73-4f28-a068-89e59a67be8e", "value": "T197D612D63B9182B0D0D20A30A58AC3A97580FD4D46F95E0B3CC72C477E5CDEB5D4EAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973321, "uuid": "48f088fd-41da-4149-928f-6fc98e4995b6", "value": "5bce82d759aadbbb257c886bd0225eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973321, "uuid": "cb107aae-6133-4c42-880a-4eeb95fe98ab", "value": "196608:yJNpWi/ZYws5xWZvvgaGnCd9wPqsV46OK7K2FqsohqKKZ7Clv6X:yJii/mwl4bCD6x4cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973321, "uuid": "710e6a5e-b33f-4d77-8900-c53e1349a000", "value": 12696176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973321, "uuid": "5c75077f-e64c-449a-ba0e-1b803aad9550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973321, "uuid": "e0f14332-8c5e-4a1d-83d4-6c1d90890147", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559ab8c6-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784988948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988948, "uuid": "feea2d50-e8fc-4199-a4bb-516894fd1498", "comment": "Malware payload (WannaCry)", "value": "0e95388031bc357808ae5c06bd70640b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988948, "uuid": "64a398b3-1b75-4d43-81fe-4e18458ee2be", "comment": "Malware payload (WannaCry)", "value": "d58ce6cac24a1c453f868afc0d2bc3e3cc32f430bd0c93be395f76c7de2d2fd8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988948, "uuid": "d6bb1645-a25f-493d-a9bd-97d89aab3a0a", "comment": "Malware payload (WannaCry)", "value": "4a7de34a1f9f8409114172f4292d3b871e31fcfd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784988948, "uuid": "6a5d1992-d3a7-4e31-bd14-5730249bc014", "comment": "Malware payload (WannaCry)", "value": "df59f4282ebde8500a44146ec542981caae491a9bf916f950dd2c26310f98a728f40a02af19483661316839ac3820603", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988948, "uuid": "f59da391-367a-42bd-9129-c0b5d4d47322", "value": "T17B36235531A8C0B4C107557488FB8F12F6B2BC2A17FA650FBF504A7F3E63B52A624B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988948, "uuid": "6dd4c6bd-9592-4d79-b303-358754a12288", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988948, "uuid": "9e072bfd-82ee-4838-8bf4-9c735385a00e", "value": "49152:jnsn+LPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DM+oBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784988948, "uuid": "02f51930-f4e2-48dc-bb46-f6bd8bded4b5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784988948, "uuid": "833baafd-0b9d-462f-9b2b-841326421db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784988948, "uuid": "157e6cd1-5b01-40d8-8ea9-cc2290496f4c", "value": "d58ce6cac24a1c453f868afc0d2bc3e3cc32f430bd0c93be395f76c7de2d2fd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90f0f91-8834-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784989544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989544, "uuid": "24843e10-7cef-424c-86aa-d7fb8915f7b4", "comment": "Malware payload", "value": "89be866519283b8b86d4d127141306bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989544, "uuid": "ba6a65d0-de66-4892-8a29-bfb894b7199e", "comment": "Malware payload", "value": "d870c677b1e8460a9b5958b41b2784245ca34a1d0d634a433ae94dcc9665f477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989544, "uuid": "c42de044-e045-4184-897c-c5fdabd52f07", "comment": "Malware payload", "value": "90028cb77be2ddb508b0070833ea6ee2625e948d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989544, "uuid": "b4c899b6-090e-478d-99e8-a24435249306", "comment": "Malware payload", "value": "a42bf71ce11dc8d32b755f0804b3b9d521abe5fd9d1a751cc066bdafb6ae64224bf3b01e7a94aaef09a9da2bc9e0f7aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989544, "uuid": "90833d0f-3034-4e57-b06e-5f743d4947b4", "value": "T19AE5F13FB28B653EE06A5A367AB6A110583B7661A4178C16D7F4C88CCF250B01D3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989544, "uuid": "25743770-cbfd-4208-8c3b-ddd8689b4d8b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989544, "uuid": "4d0e34ab-32c5-4d74-a6c2-f629661446a3", "value": "49152:duIvhqnxj4TmYQWZ/lsjobvJwyqlM/91+f1Ug83BnF2ymqpZSIy1tOI:d5Z467oo9wyr/TTg64opZSIyfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989544, "uuid": "c49f2360-0c87-44bd-b1be-ab65927736dd", "value": 3246160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989544, "uuid": "3d5d6ae3-9d60-4d0c-8fdc-b5fd2325a8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989544, "uuid": "eff4c532-4528-481e-8f80-90206e73930f", "value": "RuDNS_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8570cfa0-884e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785000625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000625, "uuid": "58f4d1a9-0d75-4ca5-a188-6bc9bc5ff227", "comment": "Malware payload", "value": "8ec01a39ef6bae851be7b05fe9114a6e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000625, "uuid": "4c519290-5fbd-4f4d-87e8-5c32e2e898bf", "comment": "Malware payload", "value": "d925bd9a7e6d71e02f34624223878a090efd5f9ae2c55e80efb14e53cf3c4c7e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000625, "uuid": "bd8f3f24-fa6c-435a-8c41-9281b45949d4", "comment": "Malware payload", "value": "602e7a42bf703159e3b06a8ca1411fa86e7cff30", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785000625, "uuid": "cf0d6bc7-1773-4c34-9bd3-6233a932b6c2", "comment": "Malware payload", "value": "1c090d5ae47efe6e5d1ee950cafe6b92bf537f6139a7a101f9121c44a0ee2849e2eafaa9aef9d81f546e57ac02ec3424", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000625, "uuid": "f17e7d3f-943e-4a7e-9b0b-5e9df80b54da", "value": "T18AB61299FBD8EA2BC437513349665275518B4C0A9E42DB537A4C7B0C38BB9D40F8BBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000625, "uuid": "2fd2ab69-0e3c-4de8-b412-30422230df8b", "value": "196608:+aiy69mRB/Lj3StQgJlihDFccUrJR731xq9ZTBAR+LIUyMLPVVyH4:BJBD2CcihBcRDGbg+pyGyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785000625, "uuid": "c8791af7-278c-4026-bf19-a1161dc78ca0", "value": 11178677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785000625, "uuid": "2c68455d-8f2b-492a-a364-e994b616bf5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785000625, "uuid": "89ce68b9-8332-4fcc-bb12-4801b4ead072", "value": "base_temp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bf8d15-8807-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784970289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970289, "uuid": "049a8d96-b3e5-43e4-9b5f-0274256e7d26", "comment": "Malware payload (Mirai)", "value": "cc4e95e85afbe08c0bc680bc5c1154ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970289, "uuid": "632e3ee0-a949-4cea-ac42-d3de89f0ca57", "comment": "Malware payload (Mirai)", "value": "d9298577beabc530e2c99690464f7ef2300516d704dba2c28ce9ff9a15c0e0c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970289, "uuid": "9f695350-3426-4c8c-91ab-adfa0cea4b0a", "comment": "Malware payload (Mirai)", "value": "ddd8d75f76a45a4ec916f51bf4e820068c060a6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784970289, "uuid": "e1e64f99-bce8-4731-9020-bdb8ba623c56", "comment": "Malware payload (Mirai)", "value": "bb1de5cc46e90bac86eb76f8787bd87f9c23d03878f571e5f951d529303d36b51551eba4d8d61b6dc4deaace124fcff0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970289, "uuid": "0a7d61ba-f8c9-4f77-a7bd-343edcb4f76d", "value": "T1DFB2F17C9D4F9127E433C3BB67174E2B753465E1938EA23332CE80B856C91932F65998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970289, "uuid": "f529c63f-1bb3-4134-9d7a-a3f018cd314f", "value": "384:Mi7moy6+jH+dv9tKcgRT2QpID7sd3ZgNzJbEq06bfp0rQoLq6u9dJeD79tUmv09e:1ioc+dv9FiHy7sd3Z6Jbd0ktoLqt9Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784970289, "uuid": "5f7c0cd0-b67b-42cc-b914-5ffdef47b77f", "value": 24829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784970289, "uuid": "f125d947-97a0-4b78-b061-0e262f002e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784970289, "uuid": "ee6b7884-825e-4e54-a8d1-1670fbdc22bb", "value": "d9298577beabc530e2c99690464f7ef2300516d704dba2c28ce9ff9a15c0e0c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e807bbe-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974790, "uuid": "59029b0b-1e8c-4de3-b378-3e6d099e793c", "comment": "Malware payload", "value": "b7d2b2365d6c47fbe611d9f491d8cb49", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974790, "uuid": "fee8d31d-22af-4b69-b213-701dc0b9e519", "comment": "Malware payload", "value": "d994f19e02e760635286c3c01e7a84c4cdb90fc028d081a431ebb1df9706a713", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974790, "uuid": "59008e00-5448-4c15-a5cb-33d77666b532", "comment": "Malware payload", "value": "be0f858d164b73ba1c065c67cc493a5fee963304", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974790, "uuid": "c803087d-0b5a-48e3-aafd-03d4554d3923", "comment": "Malware payload", "value": "cef2acdf01f31d64e8ed515dcfbd769a45c2fa618a22184d0cd33ce2e0eb4e016c0b41f3c29948f70b76e594ec9fa872", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974790, "uuid": "f710976c-a7fd-4713-b2b6-dabd197e93f9", "value": "T1BC51198498BB91A2EAB7D4BA94E729ED1F2D9D924200213FA2CD4F495D531C30E86F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974790, "uuid": "eab40e84-c40b-42e3-96ab-5d543392b2aa", "value": "48:9XLbHWiHtVuzWFDlxe7pxYyG+P6WbNmRiNJVU2pWfkhTEZd1lbjsh3LWEWus:BHbNKaD2NxvG+PVbwRiNRhwZRfsh3fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974790, "uuid": "4aa70a2f-b7a7-4a06-8b54-90b7fd5944da", "value": 2543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974790, "uuid": "691e4100-5a20-4128-9f6e-2fd5dc84f563", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974790, "uuid": "4a9910ad-2053-4111-8248-2e0ff478b4f6", "value": "images_20260724_172333.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca37f5d-880f-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784973766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973766, "uuid": "790faa3e-8648-46e7-844e-b5908873d3a0", "comment": "Malware payload (SalatStealer)", "value": "d33e96d3fab0ef6266c645266c1312d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973766, "uuid": "092947d7-e4a3-4fb6-af33-699201f02819", "comment": "Malware payload (SalatStealer)", "value": "d9caf6b0f7220657c8ebd40ee6e8a20ce2ff71b977d99553c3db0b59bb0eaad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973766, "uuid": "4bbd7eed-d223-46fa-9eb2-8830257190d6", "comment": "Malware payload (SalatStealer)", "value": "9122a7ce2c76efdd19d5670b6eb33ae5bf06ba01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973766, "uuid": "be78123e-0025-4e8a-b6b1-4a4ef5f4ea85", "comment": "Malware payload (SalatStealer)", "value": "04582afceced75158ad7cb04cd5fab0893d713a2864c0eace53bebbec1a6049b4f6f2ffe1c4fdba52e70ce325b4ff60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973766, "uuid": "c6c62a0f-87cc-4160-91d7-a4d2d94b961b", "value": "T1EB847D1AFA6404FDD167D178C9624906FB727C8E03606ACF23A059A75F376E49E3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973766, "uuid": "42e1071b-986a-408c-aa9a-19de0280a1d5", "value": "fa36d7b9c6f9b5769cd72fcad04fc5f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973766, "uuid": "284c7b96-0144-4f34-a425-fe536921260c", "value": "6144:6/OnI0EB2bE0Rtth+X5lHdyxXVgajyEomhEZTVXUy3vnOu:ba2bvM5l4gaijjXUyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973766, "uuid": "51dbe3b3-144b-4b62-a26d-53efad36a9da", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973766, "uuid": "e5608346-91f4-47c1-a08d-01c78a91a589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973766, "uuid": "15754ef2-2754-4d70-86df-a7495a34325a", "value": "Bootstrapper.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d78617-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974721, "uuid": "3d52ec91-eb0c-4a65-9aac-25d4105bf772", "comment": "Malware payload", "value": "2b407d22822ff1f0cc1314ffdb26e531", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974721, "uuid": "4253db00-b850-4885-b017-f01e99cf7a19", "comment": "Malware payload", "value": "d9fd7b77b016c17c08b7a44fc24b0b5fd7708089928399662089bba529470291", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974721, "uuid": "1e6b8a26-9678-4a30-a8f7-c274877049e8", "comment": "Malware payload", "value": "fb10da91d8de19f8e35a71459f1bc9a174e264c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974721, "uuid": "f1d2bcce-645b-4fff-a6ea-4832f2c541e8", "comment": "Malware payload", "value": "4101d1c110ab8b2fe08e2b53a4424736244ac354e75599b0136ffde24c45b94a7669e8d764234c5b205e726dfe50049d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974721, "uuid": "9bd6953f-ded7-4827-a285-73290a94fe3b", "value": "T17421A52CAD788293C9A34075F4FA416DCA081AB512C465A3F9CC027E689294124D963B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974721, "uuid": "cbd7aa3f-c2a2-423a-8272-50993572fabb", "value": "24:99C+BprUZe8W4B60jX/QD0SON+JTt4Oux5+UQTBxqlm7avP63YKH5Ck1NWW:9hBeRVogheTGOxUqXGRKSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974721, "uuid": "3c322cf6-d3a5-49cc-8dc7-b85e0cdb6932", "value": 1356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974721, "uuid": "aa974dd9-3b60-4838-b9cc-bfa3447cb320", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974721, "uuid": "23482cd9-e7b4-4849-bb3a-346408c05367", "value": "images_20260725_063144.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d6a878-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973966, "uuid": "62f9d513-6461-448c-953b-89b0eb136b8e", "comment": "Malware payload", "value": "87a0f0abd8d86d8d47d27db5c6ee90a0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973966, "uuid": "2ff04a05-ffda-4a80-91b5-d4c6dad7b0ab", "comment": "Malware payload", "value": "da9a5798c533ab17e5ea89b7c2dcda8c50fa2ba0dbdffa84e4813d40486bee70", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973966, "uuid": "a51c900c-c370-4b6a-a289-a98c16015687", "comment": "Malware payload", "value": "726cc8b1bb9a2d4cbaa95c89bc7eb4741af9a9ff", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973966, "uuid": "e1e3c077-6189-4bb8-9d4a-b7805a24f90a", "comment": "Malware payload", "value": "d125dbe16b1c9856ff0a2372e1baaaf2c82a5f3a842ba7e442bf874db18a38c1b11661ccec46150e0afe072c2d587e23", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973966, "uuid": "4ec071ea-b1a4-412a-a12f-68059f9a52db", "value": "T1D906BE4AF7489B6AC0F3923A0C359A61415B8CE68F43D7837D64733C58BB9D41E5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973966, "uuid": "4295f6e6-1be7-4b8c-a65f-651bf3b751ad", "value": "98304:f1ij3XVzm6m1EhQ1TWJDdax6Ym1c+FNyPK:fsl+khaxTmvgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973966, "uuid": "74f3ac84-d7af-4a10-ac5a-aba9f5ed2658", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973966, "uuid": "5daf8065-7bfa-4bcc-9023-04a1c5158ba0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973966, "uuid": "09c5b6de-1fba-4595-ae30-a9e218a8dbe9", "value": "variant_10.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921c8032-87ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784966716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966716, "uuid": "0bf3fa1d-cfff-4b92-84f3-1b17281343eb", "comment": "Malware payload", "value": "b2e6215e8ccc5fff73bc8e1070f9580f", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966716, "uuid": "989e3731-95c2-4b49-9077-2b6eab370ef9", "comment": "Malware payload", "value": "db971bdcd977c9f5a80e359c6575287cffdfb2d757493f0b1f513a60a9f008bd", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966716, "uuid": "6c5a1409-7693-4b6f-8ea2-7b5a9f4d098a", "comment": "Malware payload", "value": "394438eddb3c5c79a5a3461df1c007b404241637", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784966716, "uuid": "f3c20ce8-1e8c-49bf-a6fc-faecdfb20fa4", "comment": "Malware payload", "value": "1ab0fc26093cf0626a23d1cedcdb4f4cbe269b5b5386bc244699feef2f95611e36ebb2eb31ba0cad84d5420ba8781a82", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966716, "uuid": "c404fd79-2272-43b4-b02b-a350e957e5c4", "value": "T182D5239CF9BA5670D832D7F7029765BFB02D7B4086B88D8636D86B101D222187C7B379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966716, "uuid": "ba71a2ae-dd6e-4e47-bb15-7a5d34337c61", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966716, "uuid": "c8edeff6-3be4-4929-a48f-d3ea96a86a94", "value": "49152:0cWiuYH3O+Bou+jMCxENAja4DvldRLo1uzlKsrHzezumQAOEQNMAo:0cPnXwJxMAO4D9wClK82O1qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784966716, "uuid": "76cce306-c108-4c61-8a94-5298531ae71e", "value": 2979328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784966716, "uuid": "6e3154bb-99ce-466f-8af6-cd8a390540b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784966716, "uuid": "c0a9611e-85ab-4ca6-8cd7-4685693fd1c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595402f1-8840-11f1-bd95-42010a9c0009", "comment": "Malware payload (Hajime)", "timestamp": 1784994538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994538, "uuid": "f29ea77c-facb-4cad-8785-4fb92df19331", "comment": "Malware payload (Hajime)", "value": "b3979b27ce7bc1ee126308c982ae0cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994538, "uuid": "1469e2f8-d74d-45a9-a9eb-577816e3bae2", "comment": "Malware payload (Hajime)", "value": "dbb5005b671615444278508cbf653bced8847436dfc9905e8b3440a218515368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994538, "uuid": "e56699c6-fd38-4d41-9b27-5f6cfae8c8d8", "comment": "Malware payload (Hajime)", "value": "ed12bef744e9a65e10e97cbdb381a4d751e04483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784994538, "uuid": "1fa193cc-a90f-483a-a799-72f652f9b8b4", "comment": "Malware payload (Hajime)", "value": "d5223a9531fe4f5d06a7ce67fb448ae731c1a69c28b298317a573243cba67c4dc30c2f6b046b80600c3aef1ad90eb4fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994538, "uuid": "b62d78b3-d6eb-4cd4-b597-b7793956a471", "value": "T1DB33024523A63AB6857188F1A7F8FF49F14A3DA49FF51C157C217A58A93236C28C4D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994538, "uuid": "b08471a8-a96c-4639-9784-2b7d257c33a7", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efe:yYI0ARqw1qAEv7UIFM8oJorFquye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784994538, "uuid": "a1485cce-8dca-4d6c-9bf5-c83104cb5f49", "value": 55068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784994538, "uuid": "0cffda84-f555-4015-b996-09a9d20d9cbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784994538, "uuid": "fa2e2edb-4538-4be1-9712-8825ab78a9f9", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bb8700-87ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784943965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943965, "uuid": "320e0354-7a7d-457b-9450-cfd02dfcf319", "comment": "Malware payload (Mirai)", "value": "8fe06d75504a75dafb3602af83af3410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943965, "uuid": "c04c6961-d51a-4c31-9bfb-aca9f5944432", "comment": "Malware payload (Mirai)", "value": "dc38e0c95de476176c1a8cf4e47324d2120cce88882786434c9fb394764b6bb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943965, "uuid": "fa1f9ee7-695c-4aba-9326-5335779e1955", "comment": "Malware payload (Mirai)", "value": "29a0744fa966733b85ecd7cb802241d45bff467a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784943965, "uuid": "84172b1f-56d5-4edf-b4b8-265d5c74612b", "comment": "Malware payload (Mirai)", "value": "6e56fbd3bdc72839476e6928a736f35e99e13db2cf8244ef7237dba6d2ca382f50f58b9f8e71e4d5457751ce69b775fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784943965, "uuid": "05b9386f-8eb2-4efa-812c-3fbb31236a8b", "value": "T16D246D46EA414E23C0D7177AB6AF114A33329BA4D3DB730699186FB43B8779F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784943965, "uuid": "70aed2a3-5783-424e-bb19-2bc7144817c9", "value": "6144:kbfCsOpudTBYCaEKmHtNs3uyCK6aH+PL15M/9o/:kbqsJdTBYCaEKmHtNs3fjkZu/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784943965, "uuid": "cde56c53-c0cd-4001-926c-3c14133d7aa9", "value": 213236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784943965, "uuid": "3a79cd49-298c-4f5a-855a-6231b4b65ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784943965, "uuid": "baeb87bf-1eb5-4cc0-92c3-ad7209f04a24", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58308ac5-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975638, "uuid": "7568db6c-94d0-46be-89a3-b81da62c8e76", "comment": "Malware payload", "value": "504124da846d320974ac6baf6d2f38cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975638, "uuid": "6404864d-4bfd-4dec-92e9-2f855a2c0908", "comment": "Malware payload", "value": "dc3c7e0f95c78952ae9787c90dd3dbd1ad3b356be29d7f950ca9aef43eb10616", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975638, "uuid": "0f3a717d-7b3e-4eb4-af65-a2d48f29f574", "comment": "Malware payload", "value": "a31936828e5cd74b2e4932a2c9c8e68f45291f7d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975638, "uuid": "b4661e05-1f8a-4897-882c-94cf7460f13b", "comment": "Malware payload", "value": "ce92d55f546d218fcd49026cf107dae3647cce5359ad3d824dd7e8fd5b9e03a8360ec4d2c702d40f6183f1a5979f2dc1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975638, "uuid": "b572e609-7b22-4093-862d-3f9f4949729a", "value": "T10672D092FA217092E413017374BBE5591D9CC16D808ABCE24EBF9368CFC46BAEB01640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975638, "uuid": "8ac8c737-16c8-488a-9e7b-f561d4b0cd04", "value": "384:uf5mV55GoPCp9K3PkFVRoW+7fm0B5pcMrlHbOZt:56bKfk+WAy9Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975638, "uuid": "dfe034b8-a9f3-4aa4-9792-fb5ebe11e010", "value": 16334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975638, "uuid": "5e68b009-8df9-4ec3-b10c-5a4098e3c06c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975638, "uuid": "edb239f0-19c5-4d21-ae25-cf8eb2ba7d58", "value": "images_20260725_081230.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531f4009-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973912, "uuid": "ff594b09-2b90-4be0-90fb-a5a65ac71a16", "comment": "Malware payload", "value": "0153dbb9b33a1e702d758963280ba696", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973912, "uuid": "050606e5-1228-4336-9830-ec68470de2fa", "comment": "Malware payload", "value": "dc555e16349e6d310d2150e806123ec540f3bec39fc0e48998d7e4f69358014d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973912, "uuid": "7a2e65aa-92e5-4200-b4c5-1ee1e53715a4", "comment": "Malware payload", "value": "8811272d94f24b41339ac36f124f3989033f5356", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973912, "uuid": "e0bdde8e-66c5-424c-87d9-5ebb62d3f3ea", "comment": "Malware payload", "value": "86bb0e5a2cdde9ef9aef3d78bb97e59f7ea56b342588cee80d0d74c564bbed7bb452207db89ee135770b0586285add95", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973912, "uuid": "b8a967b9-1193-42cb-b521-da884c1347b8", "value": "T1B706BE4AFB489A6AC0F3533A5C355A61415B8CA68F83D7837D64773C48BB9C01F5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973912, "uuid": "3ff726d5-c573-4233-8254-50d539cf6029", "value": "98304:H1ij3XV+9zNEhggT7C0mST+DCGKzxcRAgPFjm0ukfgUR:HFkuLSCKV1Gjgl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973912, "uuid": "fee2ab03-f5b5-43c6-9d65-05135f592d6b", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973912, "uuid": "6a18c71a-c2b3-485c-92e5-8caf52e1a6b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973912, "uuid": "863ecd58-9af4-4da8-9abc-9620f138f749", "value": "variant_01.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99e92fe-8855-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785003719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003719, "uuid": "eb95b5b8-b5ec-47c6-8974-61eb596e8b6d", "comment": "Malware payload", "value": "30aadf0ed97011225745dccdb9571165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003719, "uuid": "63a365f3-65f1-47db-98e4-bc33812c0a63", "comment": "Malware payload", "value": "dc863b3db099b101c6c95a17b70bfccbb9826916e6a27c13d6315a5568ba3f13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003719, "uuid": "9f0cbb7c-e944-4d1a-8fb7-1bae46792eb9", "comment": "Malware payload", "value": "3b8d8e7c437c79f2fdc0ef89d1fe6d6fc7e1dd97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785003719, "uuid": "32db3a2e-18c0-4095-bddc-2a8fa71a9558", "comment": "Malware payload", "value": "092a4ecca8dd4066a5a1b4ba713cb63d49ee316c1495e873c4670753b08e2af4b9310a353f4253907977e93c9b02b2c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003719, "uuid": "d7c0af04-9023-4fb6-96fc-05befcd02109", "value": "T134367C88E793E0F4E25308F0559BD7F761201A355053F6F2EB8A6F65B4327816F093AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003719, "uuid": "4f4011a5-afe9-4781-9073-632b2afb4a34", "value": "98304:d6X6ucuDOb2KZ+5qxyEnJh5eE9iY6TcqyHcdeMk3DfX8mTqSqkS+QNx:d6XvcuDOb2K+qwEJF+Vds8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785003719, "uuid": "f54e1116-ae24-4dd6-adf1-ede3dee04759", "value": 5238428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785003719, "uuid": "6d9230c4-5e36-4fa4-99de-15d518288628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785003719, "uuid": "49b8ed96-4eac-48ce-8671-392e0ee2dfc1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44453d9a-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975175, "uuid": "b153dcb6-07b1-4eb3-84a7-a913b75f8d6e", "comment": "Malware payload", "value": "61b8a705203a609ce8076db6c326b94b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975175, "uuid": "de2ee32f-78e8-4ec2-ae18-76bea97462a3", "comment": "Malware payload", "value": "dcc938ab5c6677815ebda8c284f79193f24da612e06686d12a73b45e3975575e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975175, "uuid": "90fa682e-83d0-4e3f-abd6-295a50233ad7", "comment": "Malware payload", "value": "fbaed881312d3a117ae5482ff461b71ea3f02b33", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975175, "uuid": "3d572edd-a490-4404-97f3-a8c29ce4d413", "comment": "Malware payload", "value": "f3845a815a52bae047da9b155308904f3a2353cec3711c49c747f66afc9a807c65c672c815fd2c1509d474dccb7d0adf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975175, "uuid": "20a33af3-2c7f-4698-80f3-31cfe82a01d2", "value": "T10542C0C40C5B1023F7E57DED4E6D865B7D08EB1267B8444CE8D44B758B098D3A387721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975175, "uuid": "6583192a-edac-4e3e-b583-c8552a115476", "value": "192:u5ggeMDaNw20aQndpfewS3PYXfbM0FdwMst5AkXJxAf14m3YKG433BbqStd0fo:u5gg46pfew5jhdwnxI4qg4Bvn0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975175, "uuid": "284c32e6-9d7e-4bba-bc95-98e58b2a3326", "value": 13065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975175, "uuid": "32976b43-580d-44d9-a9e1-4737ea1de343", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975175, "uuid": "295072fc-2e3a-409d-8449-7f9243c0b76a", "value": "images_20260725_015003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4758cc1d-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974751, "uuid": "017bc0d9-14e2-4c76-86b4-d3fb369f4023", "comment": "Malware payload", "value": "b47dec95a5ff85d2422fcb12fdf33fc2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974751, "uuid": "fa95f659-30ba-4ad5-8a97-27625785df0d", "comment": "Malware payload", "value": "dd65ee67ab768ab310dcd7a3209eeaa83145b01c67cbc5bfdafdeacd7c046149", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974751, "uuid": "7a7750c4-fea6-4f29-a4e9-ecc44ea8e946", "comment": "Malware payload", "value": "b84afd29824f4520b822c8ea03fbc5fe187c00af", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974751, "uuid": "5dbd1fdb-c8b6-44b3-8296-e618c395e44c", "comment": "Malware payload", "value": "8cf66e88bdf0eaa86537a6201d3f24732064ca0c046e0cde9c3c0411c1fc770f373796e7029e020a00f1a139657915d8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974751, "uuid": "93a96836-8721-42a5-9ac0-7cc5fcfa38b5", "value": "T1A112B0247A494662CB5255DED2D5BE03C07358FB0C62FC8D577A007A4EBDC0394A69BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974751, "uuid": "960b5429-78e4-40e8-a331-8fb5672f6f73", "value": "192:kufpU24tHcfH1uewaadllJazPux/MREerGOAJwaKdJvIzLj:kufp349mH1Z7el2ux0RrVAePvoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974751, "uuid": "2caede39-02a9-485a-be0c-a1fe6e7f048c", "value": 9660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974751, "uuid": "880928b0-9fbf-47b5-9b98-cdc7bf86b47b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974751, "uuid": "5c7ef0b9-ad6d-4a2d-9a1a-63df20fff7bb", "value": "images_20260725_012701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b434f1df-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975363, "uuid": "d87205a7-cea1-4bbc-8d2c-c3a0a8e5c62e", "comment": "Malware payload", "value": "294451bea259b55a70d18887accbf1c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975363, "uuid": "2f51a408-a76a-4f66-a3b9-828d85c383bf", "comment": "Malware payload", "value": "de3aa431b761a195fabb3311b67c7fc107105b6946adfd5e7fb2b7bdb71a6c29", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975363, "uuid": "a6555e39-df87-449b-9a49-ab740cf0a608", "comment": "Malware payload", "value": "7a04155c49cf8081b8a194abe83443a68b35b3ae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975363, "uuid": "93c666af-5dbd-434c-beca-31d21fff8ea3", "comment": "Malware payload", "value": "148b99976b8d0aeab0e75751c07d1fd1f1f46b44fa110a79f624ae71dc626cbb45fff020e052df428acb6fba4f2cb33d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975363, "uuid": "a30b9d8d-a8fa-4955-bed8-ba6e0be32a59", "value": "T1E842C04DD0279052A76EC4BAB442AA712E1A5AC6FDD300D3AFE5CEDD9F53AC70701252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975363, "uuid": "d7fe4b18-33de-4405-823f-5931f2cfc5b3", "value": "384:MGQF1k9y7thNLgHwLHumQuizY9Pqv6bARIqgB:MGQF1brJ4wLHZQuizSo6bAR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975363, "uuid": "a5de31aa-7341-41b4-9681-860a7b67b316", "value": 13143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975363, "uuid": "d79552a1-1142-4863-bec3-d7f7ad53f14d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975363, "uuid": "b39f3b9c-d8f5-49da-b0fa-cb5f3d7e2dde", "value": "images_20260725_092349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e6a39d-87d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784947279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947279, "uuid": "51e9ad5e-9906-4edd-a5f9-b7fd33c9f2b8", "comment": "Malware payload", "value": "c5942357b16e3de52b35faf69eb648bb", "object_relation": "md5", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947279, "uuid": "9737cc92-6b83-4eb1-bffd-4325e52f5c95", "comment": "Malware payload", "value": "decebafaaabbd6f67629c0a13d8d497e919c1652738ddbe83761792e388bdd03", "object_relation": "sha256", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947279, "uuid": "873857ad-2932-491b-8393-4f3536c9ac0c", "comment": "Malware payload", "value": "6555b9f5cb01577937391ac26941300a4c6b779e", "object_relation": "sha1", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784947279, "uuid": "d1b0e4aa-175a-4443-9224-b42decc924cf", "comment": "Malware payload", "value": "5509c0714ce006e3e5fadb48c0b8bb780947c139373cffb8501d4e48b5df4cdd7ed36bfa18dc917bdfe3215740161173", "object_relation": "sha3-384", "Tag": [ { "name": "424e51f31d68f573a4621aaede8044aa", "colour": "#51F4DD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947279, "uuid": "fa91770d-5f85-4693-b9f9-69e057cabf09", "value": "T1E7D5238AF9F10A75C472C3B2CF86F46DB0297B898B604D9736CD7A409E639586C75332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947279, "uuid": "2907f097-d2d3-4d33-8c61-4bc284a35094", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947279, "uuid": "d90bbb09-f307-4cfd-ae3c-e3823317fab7", "value": "49152:EBRa4L+zKD0RT/uSVhp8tM4OakjJaHuyduS2TR+nVJjnJpqSWzvXMxW:rNKDYT2W3VokjJaRduS2TgnHJXW7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784947279, "uuid": "bce14c9f-131d-46e2-bab2-4128b1281b90", "value": 2950656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784947279, "uuid": "621fa5e5-89d1-4b27-af64-ae099d69fc98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784947279, "uuid": "dd6e1a86-814f-4a26-b99a-ce90ca319c62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82746733-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973991, "uuid": "86d78642-ef06-4cb7-8eec-7cba12896c6f", "comment": "Malware payload", "value": "7bef126c7bc4d6e57a5b6f5b508102a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973991, "uuid": "aa245542-80d6-403a-952f-bb70af5dbe32", "comment": "Malware payload", "value": "df93ee1354bdd5c55c445c824939aa5f5ffcad7d6c88605682019d9bae913ac9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973991, "uuid": "b01f5039-77ed-4a69-9370-4537b17a0511", "comment": "Malware payload", "value": "cf01af9985af1bbee87a549cff22d7b1fbe26eb3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973991, "uuid": "c6a71074-ee8b-4f32-bd4e-e174e19faf9b", "comment": "Malware payload", "value": "558f10caee806354144585340677e2244fb73421a30b934f27e10e64450fe2ec401eb78bdcedf2346e482a5d979732b8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973991, "uuid": "9c9d9ffc-7637-4099-a043-67dae7985ff8", "value": "T18A06BE4AFB489B6AC0F3523A4C355A61515B8CE68F83D7837D24773C58BB9C01E5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973991, "uuid": "624985b7-247b-4261-a1da-b9394144a79c", "value": "49152:Y7Hz1ij3XVNYUoE7NE+bJ98FdTk/OdSB5V62vKhcaCqbojNsgnTg3EUp:61ij3XVNYUoEZsbTCB5w2v7psgns3Ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973991, "uuid": "77d0fbbf-b414-4608-ad2e-29ff1c6e2f5a", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973991, "uuid": "23f9444e-a481-4cdb-8f55-d50c086a7c7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973991, "uuid": "93954d50-a7ef-4385-803c-c1055e000771", "value": "variant_14.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fa3f16-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975223, "uuid": "a6f072a2-8410-42a5-8785-02264392ff80", "comment": "Malware payload", "value": "035a994662a96334479f0f5d86ce08e6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975223, "uuid": "935ec28d-367a-4168-86f0-c4c9ef090e1e", "comment": "Malware payload", "value": "df94c8d492fcad0c76c2206c0dff13bcd42008960c25e16cc0f5ac5b2e15a094", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975223, "uuid": "79648db8-61c1-474f-a25a-4ea5fac8f81b", "comment": "Malware payload", "value": "9822af69dbca50bd8873994222e4a7b4fdc31b82", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975223, "uuid": "6905fec7-9a84-455e-94f4-0c8c9dc674af", "comment": "Malware payload", "value": "c09b7f391ea89c4045803694bb33af242a68205581ca5c2f3d06f0da6cb4466340e13192a011bd0072539d5a028322c8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975223, "uuid": "e995258a-cab6-4579-bdcf-2959e1410d19", "value": "T117715B6180AC7582CD23D87A30D286BD53CE804B0341DC73A09C8BED614309B6FD2B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975223, "uuid": "362a8c01-0255-47ca-9421-c914203dc413", "value": "96:isM7aayXDR1f2ZcakW6ay/GuHHEGQdY1aVyAEOVL82:W2n1f2Zc/Wzy7HvwfVL82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975223, "uuid": "de63e644-220a-4514-a5f7-717cb7e5bd85", "value": 3687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975223, "uuid": "23b6bb45-7535-4425-a332-80cafe3e5d3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975223, "uuid": "eb0db9db-3e4e-4ddf-8545-a1fee4df3246", "value": "images_20260725_083709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a005bb-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974808, "uuid": "8e2e1956-2ade-4a24-a1da-50427a612387", "comment": "Malware payload", "value": "6b3825494cebd2298a760d8794c9b3d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974808, "uuid": "0c14f6a1-efd8-4025-9b95-04e6f3722088", "comment": "Malware payload", "value": "dfada820a845dafadec60311eb8914d712f08d8fcf18074aa1d4764285207db0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974808, "uuid": "52c3452b-e52b-44da-b4b3-084c49869cab", "comment": "Malware payload", "value": "8f5107f1ee03835953a8ec0e0ad2b2e35e3ca4ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974808, "uuid": "5b480a3d-5ee0-4459-adc9-6979e57b219e", "comment": "Malware payload", "value": "def18d2c2dec439ec8b7266e433b1127ea6025e26035c18bdc8181281503f247f9ed1936b39ece433ae1b5c5cdec206e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974808, "uuid": "c3d53d5d-0b88-483d-a81f-636fdf621530", "value": "T13672D10E916BA71FDBE226F4FFFE96D81304D336C80069D5867C04DADE13226E89590A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974808, "uuid": "32f297bd-0158-466f-a97c-345ef7521195", "value": "384:vy/bJNg5Q/n41tFRPpJNJ3I6Cz5GNFm0b5FcQMoSWQ:vyk5Q/n41tPPLNJ3FwgFLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974808, "uuid": "560d3e6c-0d9d-44a4-b91b-a669deb1a5d2", "value": 16648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974808, "uuid": "724657ac-68ac-448b-b331-54af2430394f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974808, "uuid": "60f0aad3-8274-4fcf-9f4a-90bd7a111845", "value": "images_20260724_145112.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3ac754-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991541, "uuid": "1259ab0f-7fc9-4e0a-b614-ee0ab9edb65a", "comment": "Malware payload (Mirai)", "value": "5ebf023ee43e6e180228b061423e0369", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991541, "uuid": "55a10e95-e2bf-4215-8e98-8d1ca0a2649e", "comment": "Malware payload (Mirai)", "value": "e00522b305c231326d3a2add44ede1985247758f41e803b11fe20de9d0055cac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991541, "uuid": "75bbcb0f-48c6-4611-823d-9c98071b7933", "comment": "Malware payload (Mirai)", "value": "182e3d136a4d4aefca172f269b629814674ac266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991541, "uuid": "a31ff281-2b8c-4db3-9364-3bb8b2e000ca", "comment": "Malware payload (Mirai)", "value": "3ce5ac7ff8a3311fc0068961659a72135e3cc9c21a1586dcc49747abc0bf569d57e1645609f419c184912cc6c8afc120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991541, "uuid": "4e260804-5102-4ede-bc3e-45cd89367c3d", "value": "T1AC1329C5FD82456BC0D02B7AAA6E184D3312B3D5E2CB7717ED164F22374692E4E7BA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991541, "uuid": "ad54de04-9da3-4fc6-b980-b6ffb9868ed3", "value": "768:QS/MXWBtRd710v/fwZQ73hpD+jzsBAk2CeRIQbgPPmvGh:QSLR30v/I6qvI1zgzgPPsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991541, "uuid": "43d703e9-e545-4bdf-84d3-b7a4ce4c8ec6", "value": 44364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991541, "uuid": "f4271289-447b-4ba1-b759-398728d04116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991541, "uuid": "5a541665-a2c8-4fa8-8de3-f9e2bd60c117", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6aec290-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975367, "uuid": "f173d14f-a566-4ffd-aedc-c2f2fe01f676", "comment": "Malware payload", "value": "df8d5ab7aa1dece08c34b87a52d21094", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975367, "uuid": "e2bb323b-a3c8-4b6c-afa0-20eb49dbd14f", "comment": "Malware payload", "value": "e08684c7fda9791935329bc7725cf0dd436b43595dc19d43d914c6a60b50b0a2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975367, "uuid": "b8435037-7893-4dec-bd79-269ad2a015d2", "comment": "Malware payload", "value": "f52fa8ac2a5b4b9de3c09c73c88b37108c207b78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975367, "uuid": "df23c056-dc6f-4fec-9ef5-b0cd3f63b051", "comment": "Malware payload", "value": "34b9638774302ffe44b97cdbb50e7e1d4f1613079b77048e2b18db910887163f747562452285ebb3e929606135456f5b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975367, "uuid": "c0de91ed-1707-4f67-b159-bc1873ae219e", "value": "T18DE1AE96C58D6453FDF7AB3AD6B4B58782744F45DAF84C8248784904E62012F1FBB0E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975367, "uuid": "8e2c5963-86e3-4797-ae97-1cdd5c3ecbf9", "value": "192:uoyDvcpEJX5VWXlqQ+/6cCDig4mm0QiTI:41JpVskQR2b6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975367, "uuid": "d0d3ac19-2195-4ba9-a837-04f3d59750a4", "value": 6890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975367, "uuid": "2b064248-3947-4173-8898-06e3889b8078", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975367, "uuid": "aff1b7cf-cf35-43c8-b6f6-ca2465235f25", "value": "images_20260724_135219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32c0c90-8816-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784976730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976730, "uuid": "b398f708-143e-4aa2-92e3-767aba8ad0af", "comment": "Malware payload (Efimer)", "value": "5819a7037df52589bf6de48a85cc0b76", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976730, "uuid": "de1ca513-b2b5-4b64-9f15-3e3f390453e3", "comment": "Malware payload (Efimer)", "value": "e0a5189ebecb70081ad4ddc0f94f2aafdae713f72302ceb259690b0d4c6a261f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976730, "uuid": "485f8ee9-0ebe-454f-8d42-ee8fe19aba2c", "comment": "Malware payload (Efimer)", "value": "dc1a21832c603a6057eec1d76d0ffd3cedbfeb03", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784976730, "uuid": "9ae5a492-1316-437a-bb1f-22eec451d7bb", "comment": "Malware payload (Efimer)", "value": "30fecfc241d28ed44503362bc0891748ffdf8ed9d4ef66d9b3f129423a034c022f111ff9b7441b9ccaca7f587a3cebf6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976730, "uuid": "71208fcb-550f-4035-9bc9-99b666018b6a", "value": "T1D3E63308A6D007EEEAB3403CEEE2076AE27178694F71CD8B439853965E571C11D3DBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976730, "uuid": "1d94a8b9-bdc4-4e35-a5fb-b01c0b9077b8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976730, "uuid": "d6a8f268-5c33-45a5-9b57-9f9ec5b653b3", "value": "393216:ssKAMPNmEOsjFmAZYO0XMCHWUjXFcuI3/PGTAI:sLAMPXTjsAZYO0XMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784976730, "uuid": "690a474e-a97c-49ac-8f1d-8d12a77732d2", "value": 14284812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784976730, "uuid": "8f496e65-f429-4662-9c6d-da92342b72bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784976730, "uuid": "d62df4ea-e257-42c4-af0e-63f525c0e60a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb56448-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974839, "uuid": "1f54492c-f232-48de-85eb-b7e2d93923d5", "comment": "Malware payload", "value": "26c09a13fe195c0469182ce5968dc7a2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974839, "uuid": "3e810192-cba6-419d-bc8c-a34a578e4d57", "comment": "Malware payload", "value": "e0f0245c291e11e926764475126f77d29118d577517ab966e19791ca3e0f8780", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974839, "uuid": "9dd3ca78-3b16-41a5-a6d3-ee7b52f984d3", "comment": "Malware payload", "value": "e55f4a9da817cebe96d40b6be4c8d8ee00e5323d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974839, "uuid": "a07ede70-d63b-4c28-9303-74d6eedfc10e", "comment": "Malware payload", "value": "05cdd6b35bfb44156c82046b33ce3b91632e68b6109d639bc44ae0a49ab877e089fce334616d01347f5c91c310fa7994", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974839, "uuid": "1146c7fe-e3bd-4a89-a497-a03fbdd0f20a", "value": "T17A514C3799599C62D5C9C2767BC48CB90539E5AC317D636302E0897539480BB220F5BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974839, "uuid": "b90cedef-22a1-441a-83a7-85e9ed34939f", "value": "48:9zWywV24gw4mSI6HJFj3ACLOAXW6kve9j/nF3BPRTJLfSI3M2qLPPGYoG6sj7c8i:ZwVow16HP/OKVt9DFBOIQ7PGYoGBjQ8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974839, "uuid": "2a09a2c8-36d8-4f63-90d8-7394cca08cf8", "value": 2950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974839, "uuid": "7deef8e8-6ed3-4648-9ed5-6937b9672547", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974839, "uuid": "f55a0c02-7b35-4ebf-b54b-5a80436cc431", "value": "images_20260725_074137.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7459e2df-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974826, "uuid": "d87d1999-85ab-41fc-9734-217822fed8aa", "comment": "Malware payload", "value": "6c27d775c730140452d6d4b8e5880478", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974826, "uuid": "59b68030-dd6b-40ba-94cd-c280d51eff51", "comment": "Malware payload", "value": "e16e6bf29f382a5c7cb4059a0b36452db28c42c275eea54402758b8c639d1564", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974826, "uuid": "2af0b899-274a-4c02-ac5a-b563a2f4ab5d", "comment": "Malware payload", "value": "1fbdb4885017179f8802b9a442de20f8787a0dd5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974826, "uuid": "5d0c84b3-42eb-46f2-b916-1666408c9a27", "comment": "Malware payload", "value": "6987239ea3abaaeaeb2ef3027fbf8d5f69fbb364c1b97cee16b3fb075043aaa9ca1e4338e99359deb5f50cab9b3da261", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974826, "uuid": "a7dbde00-b025-40df-a112-e21446ea3bb9", "value": "T13922AF9D99E781A1C6EE70F7ED738443507069325203D6B931B94E84CBA9613E04FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974826, "uuid": "0092a692-418f-4885-a8d5-905f1da7374d", "value": "192:F0mV8QVRukWztF9h+p23ARqYEQezFK7NqiI:K4rRPctF+2wRq9QKqNVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974826, "uuid": "15110ede-0069-4236-9ade-045c7b1f664e", "value": 10460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974826, "uuid": "a825c196-5056-41bc-a46d-04d2e6224724", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974826, "uuid": "fd64294b-b6d1-45bf-87c6-c4bc6d995612", "value": "images_20260724_233321.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9f94d0-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974651, "uuid": "96199995-98ba-4f32-8404-bfb02ccdbbaa", "comment": "Malware payload", "value": "d2c12a969f006eb2c1b83ac513c1eb48", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974651, "uuid": "e355cdc3-c7d5-493a-8d44-7d662b56d5f1", "comment": "Malware payload", "value": "e1873bdcf011417be74438b3f7756b3ef18058f13d3082f9b2ba6e2722a379b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974651, "uuid": "10d6c894-1d21-49fc-82a8-f782bd216667", "comment": "Malware payload", "value": "8d2dd5d830558c86994e536f70956cff2359834f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974651, "uuid": "fb58e43e-852c-44ca-a6d9-a6756c07fb78", "comment": "Malware payload", "value": "1dac7d39e4e66027cb25fb9f4f41981410363cc53ff19e69bb2e11f2dc67ab72fdec741de4c4074cd04525cc3209cd99", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974651, "uuid": "f676b8b3-ff7f-45ce-b478-ed241256b2dc", "value": "T161411B428C9EACA1DBA7A3B0705FC53DD57F8DCB519161D3238C8D6568D17060618348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974651, "uuid": "ee7e71f0-2fd5-40bd-9647-72b84ad1964b", "value": "48:9Fz3a0ubqyfdbD+7s/riJguHB1quTRYqCTPKjCbOYygN8zlQMmTxrEyn:jrD3yfdbD+7GiCuhXaSjCbOYxuzrmTx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974651, "uuid": "1f440688-3f28-4095-9a1d-20200dcc003c", "value": 2413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974651, "uuid": "a1b22ee2-cefb-4d87-a3e9-bf83c4e47c4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974651, "uuid": "1bb061b1-892b-4ef9-8d6c-e30fd82c8a79", "value": "images_20260724_142247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f2ddfd-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784979584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979584, "uuid": "0645c0bc-1535-46f5-88ed-edcfd60f08d8", "comment": "Malware payload (Mirai)", "value": "09b7db8253e49f8604e676c310990f78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979584, "uuid": "158adb6c-6381-4cd1-9bd2-9eb5021e3b00", "comment": "Malware payload (Mirai)", "value": "e1c2d61c3ede17e1301624fdbc49823b22746905a89c039e04576a5f27b5cb81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979584, "uuid": "377e6c44-9caa-4c99-af61-0ba39311953d", "comment": "Malware payload (Mirai)", "value": "0fb77305ea4b4ef15b48478756c6b7a1dc5c978b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979584, "uuid": "11012771-1494-4b43-a842-ad466efe12fc", "comment": "Malware payload (Mirai)", "value": "b5168a7c62f8c47ccfb18dddac46c533e23cf9581aa54da632d653a303188c95f2732b43bc485e953ff612e24cd4048a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979584, "uuid": "b852976e-788c-4b8b-8ba9-da16b3b75389", "value": "T18773C84E6E328FEDF66CC33047B74A31A79963D623E1C685E29CD1051F6024E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979584, "uuid": "0bd3fefe-ca35-43f5-9add-51c5c7ae0871", "value": "1536:K7WbkKm06gGJovj/xpt3eY23HN58UmRHQl:KWkTpovj/ftbw58DH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979584, "uuid": "f89d0ded-a759-49f2-809a-2b3a776e5278", "value": 76536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979584, "uuid": "9962642f-fa7c-46e3-9846-a2693debe7a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979584, "uuid": "2c0e2dc8-2ecd-47e9-ab1f-180c612a801d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157cebfd-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974667, "uuid": "a4161cbb-e991-4265-aaa8-44ff954811f5", "comment": "Malware payload", "value": "d40c117358cb48c669e2c0dbea999acf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974667, "uuid": "8f8c4a5b-fe9f-40c3-8653-7696fbc762ab", "comment": "Malware payload", "value": "e211b0828bc6a1acd5449c80c79e66d79fd58626d6731ede00f9f7a023c789a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974667, "uuid": "2a2e184c-499a-4fd7-a494-2902eec432cd", "comment": "Malware payload", "value": "fa4e5947d3e02d7493748e6955d215bfb5de1fab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974667, "uuid": "9ec4a36c-f4e6-454d-b254-4382bdb7b81f", "comment": "Malware payload", "value": "310fb0ec5bfd9661211bf8c6c573d57e6073ada6fa2f8efc86b467523f2e68c1f0244ddcf1a22e4df5816c84d5d60045", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974667, "uuid": "b4f732cd-7344-4c2e-930b-27342796ff95", "value": "T11962D0CCD04ADC86D41E5BBCBC145AE3E30275BAEAA0258731D12EA4A239DA1F885576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974667, "uuid": "89e57c9f-696d-4fb4-ab16-7e403c099603", "value": "384:/gLl6xXEBE8M8tgNorri+/RT+o3HxOr7a10:/gh+XEBE78taoniGwo3Rkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974667, "uuid": "02f06f6d-198d-498e-8d4f-3a47e519b6d6", "value": 14977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974667, "uuid": "18f70163-bece-4488-8790-6158ff3d1778", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974667, "uuid": "2c07d004-de67-407e-aa6d-c2e9e1b3af6e", "value": "images_20260724_205526.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8045f4e2-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989020, "uuid": "d942ba1d-4e7d-4e27-8661-00fdb670af47", "comment": "Malware payload (SalatStealer)", "value": "e811e3e6d9e7ba41c7cd64e4d24999ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989020, "uuid": "1b5c4184-ccf4-499e-8aa2-3cbf0a00371d", "comment": "Malware payload (SalatStealer)", "value": "e2da32f62c86eea0510dba268c1bd5a51e7bd6dd869a70089da2fa292e325e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989020, "uuid": "989fcf79-56fd-499f-9445-4e44faeb4d1d", "comment": "Malware payload (SalatStealer)", "value": "2cbd66cd62b31653845333003ef13dcfc8bef529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989020, "uuid": "a4c1f1b1-23f9-40a9-af77-4574166d6e9b", "comment": "Malware payload (SalatStealer)", "value": "e931fd4016773e9d847270711a2afc60c67c1dcea6ae1c1f72ce10ec05282fa82bf813538f05e0c473dcd2f0e0c4bf58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989020, "uuid": "74914593-0db6-4ef8-9576-fe8477611285", "value": "T1C7F5334BEFC71AAFCE2F62B295420E7C7025562D9C06089F56DAA330471D5DC8AB63B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989020, "uuid": "100f594a-ccf0-474d-97ca-980133129b82", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989020, "uuid": "8755836e-2118-4895-9a48-2392ca145e85", "value": "98304:i6mDfjLmdmQSmCirOtqyJRLPX0eiUWbL7K8jM:idXmdmQZCZPXWUmL7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989020, "uuid": "dcd095d4-ddda-4438-9cd9-f390e04ba9e2", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989020, "uuid": "5a2081a5-ae7c-4ffa-8802-27d539dd1d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989020, "uuid": "2481a72e-44e2-4bd2-b741-2eba20a95392", "value": "zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9371a4-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975275, "uuid": "6eab44c2-63aa-4b7e-846a-e78bb4a76d43", "comment": "Malware payload", "value": "89dffba8f64fdc32c9194e531421d895", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975275, "uuid": "5430f2cc-15c2-49a2-82e4-006b29893665", "comment": "Malware payload", "value": "e3a7778221a45b276f7ca7048ba3831795474c19da83be65ba6e1cdd9fad2d3a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975275, "uuid": "129f030f-1f77-4cfa-a40b-12c111131335", "comment": "Malware payload", "value": "b09a2173e7a03711eb633844a5a04acb3e264d3d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975275, "uuid": "e638f6b2-3203-41e6-90a7-b31ea71ce7ab", "comment": "Malware payload", "value": "d463ed8ce8cff5873bcbfbf7b2750711595fba823c7f8e88ceb2bd8e2b055311ea2175727aafb8507512249262594673", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975275, "uuid": "a087f39a-b200-4548-8636-d265ae721a30", "value": "T19252E10507B6E716E93A6EF8E2779CF96D82B5D0F204D1408DB69B212C88556E758D01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975275, "uuid": "b6842e2a-53e1-44c3-bd9b-13e8f493b521", "value": "384:VJTVXuZgy8x033bJkA+ggrZeSKvs7kAen7sEd:3luay827MgIZTvkFsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975275, "uuid": "d40146d4-ac26-4904-af8e-8c47d8175db5", "value": 13285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975275, "uuid": "77985fbc-16b5-4725-b2c7-e8cec8d912ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975275, "uuid": "7d5d3ae4-c795-4084-90ca-02e913609566", "value": "images_20260725_040310.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23ab01f-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975386, "uuid": "7aafb0f9-4c5d-4fa4-aeb4-43bd0746ab47", "comment": "Malware payload", "value": "4ed23348cba3168e46fdcbb60350517b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975386, "uuid": "0164dd38-fa3f-467c-b919-6a5a814aed7b", "comment": "Malware payload", "value": "e48b59cfd9481e9b85fd10c370177ce9bbfffd63e449cc2526e2568261bdf921", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975386, "uuid": "8c917dbd-ceb6-4d02-9ef7-c854aae4c8a4", "comment": "Malware payload", "value": "979f0502d765d9f84dbcc1de42b34305976eb3b1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975386, "uuid": "d789c97f-fd8b-4b17-96d8-e5712111f74c", "comment": "Malware payload", "value": "443015d344d38d7945d3fcbbf59313142a1716957c2bbc19b07482683adf63330515dd867c9e830e0541a2c2322fe330", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975386, "uuid": "d0b8d3e8-7a1d-4a1d-b7aa-3e316e71e94e", "value": "T18F414B5A87407422C8607278B87F3FF42E4C62A9F05AB31D7A8C5381B6817BB68C5751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975386, "uuid": "7ca230a3-03e2-4c45-960b-15fba546cc04", "value": "48:9FFvXvLSG/d4UJ/JzExHv6ZPI8nBlQerFpad6KeX7lD6:h+G/HExCp/nFYvKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975386, "uuid": "8b4c4ca7-3aff-4a49-8c3d-c177de5e3eae", "value": 2315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975386, "uuid": "ffb0876d-5066-4559-80d2-5806d15c9ac7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975386, "uuid": "068b6b13-dbfe-4e4c-a808-69bc7d748a52", "value": "images_20260724_123458.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e4ffe3-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991418, "uuid": "c070842e-df7f-4aa7-824d-e7ac235c581f", "comment": "Malware payload (Mirai)", "value": "d8acee870a6bc6f8aa127c70df7fe5da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991418, "uuid": "3c4000e0-4d82-4ee6-8c41-4748440990af", "comment": "Malware payload (Mirai)", "value": "e494d17ccb8ebedaa96a8498cab0ab70dabd52f6d62c9852f60c6bc5cd685323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991418, "uuid": "f55d9686-009a-4532-abe2-295b60d98791", "comment": "Malware payload (Mirai)", "value": "23f04e96db9f07cd0e8a36f4a04c8a4e95fc6b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991418, "uuid": "d341be82-3c26-44d8-a002-188fb0d9c80a", "comment": "Malware payload (Mirai)", "value": "79114b98277dd71e9d2c696832905b9745a2dceeb20fe9902328198ae5c4cce205045dbbcfc0a1db411310587f5e21be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991418, "uuid": "863a2dd6-104c-4258-a675-910bd0b17ad0", "value": "T10383191ABD419F05D4D526BAFF1E438A33536BB8E3EE7102DE142B25278A95F0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991418, "uuid": "ef743dd0-b4cc-496e-ac0b-0a95b7b54dd8", "value": "1536:JSnhtvx2uEQ4eNXC0Z3Y9PrLDgW6aYRTEyVW5BQsDB0ukdlV6iN+2/br4d:wtvD4IpmXlBYRYyVWDQsDBsZ+2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991418, "uuid": "37baebe0-a466-4663-89b3-9b74fcd52319", "value": 82412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991418, "uuid": "7cab0bec-804b-455e-a365-f034ca21aa7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991418, "uuid": "0770f1ce-b804-4bd3-beb5-b7517675bef0", "value": "0aYd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6123718a-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974794, "uuid": "b6f2c12a-868c-472d-b72e-fdcd24ba7a42", "comment": "Malware payload", "value": "d38d28810a91966b136fa94b514b9002", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974794, "uuid": "f4e5533d-c735-486b-a462-1014d3c90b21", "comment": "Malware payload", "value": "e544d35f94c979005ee556c2977d0e7687b41c6719de1582c29093cacd2292c4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974794, "uuid": "a13e723a-877b-4097-9f5e-f5c92a4b4bd5", "comment": "Malware payload", "value": "c6a90b0a73de7e9d826a7150fc65f372987efe9b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974794, "uuid": "3d75f5d3-7c28-4b6e-84f8-31c2d30c98dd", "comment": "Malware payload", "value": "b17acdce9104bbca2915ca47131565872b132b8d874381831736a4ffc03e60077cd526b02d083255df93c4763f033425", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974794, "uuid": "e9df6155-5c98-4f2e-9d67-0bc49be2dacc", "value": "T1CE52C050CC0B849FDAE7C21432CBBAC717CE607A20D8C71693E9B5B5B1A49CD3A96042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974794, "uuid": "6b67771d-18a0-43e8-9e43-9d050fc276ce", "value": "384:bYiRP2SS5EjxW+hMl2xF48OEe/Wq9u2FffM/1czcgxLjYB34B6:bXRLSSjwNfEaWKzFfz7pB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974794, "uuid": "17aa4dad-204e-4fe0-8da9-02eeb095d739", "value": 14484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974794, "uuid": "6ba26edb-bdc3-4044-bbf1-db4d71e75831", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974794, "uuid": "448a0209-c1f8-4cf6-9ff6-641d99b07366", "value": "images_20260725_074755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb433d04-87f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784962490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962490, "uuid": "ae1e1a6a-3e29-4803-9e9e-50e63e518e9b", "comment": "Malware payload (RemcosRAT)", "value": "cc7e9ae7f054d90355af2dd379625ec3", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962490, "uuid": "20efdda9-7ddf-4a41-8c6e-82dc6b77f0d2", "comment": "Malware payload (RemcosRAT)", "value": "e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962490, "uuid": "a31cc39c-b754-43ad-acc9-00be58ca7457", "comment": "Malware payload (RemcosRAT)", "value": "af381a40b1babd7f65f118608a958fc1aa48f115", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784962490, "uuid": "44c7ca9e-661c-44f0-957d-1087323e2c07", "comment": "Malware payload (RemcosRAT)", "value": "948869a8e01e5ab3c3191f529d4bab6d03bb55090a1a1986a1b359becacdbeeb0919dea716f404185ac4f4bfe14acaa3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962490, "uuid": "8546789c-8bad-45b6-a147-f35627d0f761", "value": "T197452353A1F7EEB2F965B835221AAE04F31F75BA022743D21B96415A4613F11FE3C326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962490, "uuid": "a3971edc-12f0-4f39-8d6e-b1b56273ba88", "value": "12288:F0vDZDrODKXnas0hitTDlQzbW/wYEGOfg13u0LOoGg2Fd5bxWU:FOUDWnrtNQXvG31lyotStWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784962490, "uuid": "c2ebfe29-734a-4e61-ac44-294f44ab4d34", "value": 1227831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784962490, "uuid": "e877952b-603f-4f47-9725-e7d62ea704c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784962490, "uuid": "fad029cb-c669-4c20-aa6c-12dca33d8de2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42d154d-883d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784993509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993509, "uuid": "d758eb58-cf4e-4019-a990-32f2cc3f135d", "comment": "Malware payload", "value": "bc1239e04ce9419fac4724bc9d8e996c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993509, "uuid": "c42c8887-4f1f-466f-88d2-e31ee416b59f", "comment": "Malware payload", "value": "e5dbac50755b3dba5237bf6f9d4c42ce965dbee297c9991e261e86bde0b5a511", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993509, "uuid": "6a3bcdb6-3bfe-4a80-96dd-f448b3191d6b", "comment": "Malware payload", "value": "f584df6373c3527771c1dd61c4b382c65294e9a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993509, "uuid": "bcfe790d-cbf8-40b7-a05d-379d2b5351f6", "comment": "Malware payload", "value": "a8cde54db337b08dcb122b5e0a0d88751d39f3e24b7a8a60f4c7b345a03ec4e2cc3fbf0fe77f57aea5343b3d6a26bf9a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993509, "uuid": "a8265fde-eb4e-4944-9e94-82949c93b9aa", "value": "T16384BE0BBA944B01C7956671C4D79C3003E6A98B3733CB9D3F4912DA5C823B9BD4BB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993509, "uuid": "29c17c5a-3d1b-44e3-89f2-70374db82f48", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993509, "uuid": "d83627fd-dc21-4323-9876-f67d9a6ffa7e", "value": "6144:6M03heac9tb9kyfY8tVy2RGcuQIjB9GTF5COn1XCAPN6iEtMK4f4:f03v8ZfRfjRhuQWm59pCAP+tGf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784993509, "uuid": "9a9cdd32-fdfc-43a9-b5f2-308242555dc1", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784993509, "uuid": "f63ca6aa-0853-4f27-8f39-fbda057a9ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993509, "uuid": "df2bbd7e-8c1c-4f60-ab35-f8f3cf1ffd53", "value": "Zinqolam.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7453a4c5-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784991577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991577, "uuid": "19158a13-13c9-411b-982c-0a6db45b6bf9", "comment": "Malware payload (SalatStealer)", "value": "7ceeb0955c8bd51f57b3ea264316e1ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991577, "uuid": "4b850908-0dfe-4b81-ae3f-6c60366813e8", "comment": "Malware payload (SalatStealer)", "value": "e62cc271c23df1c9473a6c6d486a76e5b1e429702e791aebbe7dfa5eecece0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991577, "uuid": "c100f5c9-2a57-4d82-838b-81fa81313d32", "comment": "Malware payload (SalatStealer)", "value": "39aeb3d1df69c8c8ac6d4b664471c6e7bed43498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991577, "uuid": "7c1ab2f5-cef5-4b2d-b08e-5ae9f83040aa", "comment": "Malware payload (SalatStealer)", "value": "d3056a416b00c4a4cdecee48ac5fc0387eadf597173274f704cece6f61db4663c2ea2b8811cbeb5c6ff462b98eea89be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991577, "uuid": "5b16424e-9eca-40ff-84ae-234c3e313dc8", "value": "T11AC65A01FA8B65F6F9035831416BB27F63305D048B28CBDBEB583F6AFC77691192A245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991577, "uuid": "f249250a-25e1-47d9-9783-48b6bc82a843", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991577, "uuid": "f84a76ec-2912-4ddd-a19d-2007d117ad60", "value": "98304:xApidexJJj9/YYkTWIerjzz4qrN4E5/a:DdexOYUWIsHzn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991577, "uuid": "bc113b29-684d-4927-94b6-8cfa7fad8ce1", "value": 12544000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991577, "uuid": "538f2064-7193-421c-9f00-1479b5feee46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991577, "uuid": "6d0b8c7b-0898-401d-b65c-a01e3d48ce24", "value": "winvertdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2897be23-8875-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785017219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017219, "uuid": "76c81c1c-7117-4e2a-9edd-a69a004a0364", "comment": "Malware payload", "value": "351daac6ec97ffddb26b8e2d86360377", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017219, "uuid": "791c6fdc-5a0e-4ef0-939b-fc0acc2f9af6", "comment": "Malware payload", "value": "e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017219, "uuid": "e19a1820-fa45-4583-8dd6-e095b19fce94", "comment": "Malware payload", "value": "2483acd76189628741372b41a3f0c7c354bc32ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785017219, "uuid": "bf5f98c8-9be7-4701-9abf-c5b1d2f12bb9", "comment": "Malware payload", "value": "0d27e34bd466a1359928213041b9036f1fbfc6563bf89ebc511895f4d5ed8a1038f83704ad3771e3b876576ece8de9e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017219, "uuid": "f0e39388-9baf-443d-8074-ff38ed11b719", "value": "T1132276E1F8A0DD38378DC03EA44E9581354F142B05492C68B59FE4646F7D6A4A3BC7FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017219, "uuid": "1b8ea9cf-c366-4bc5-915b-4d7990ec616f", "value": "192:8WEPNWcD9Ck0hXmtnTtxLKkT+2Kq801HzZ69UkOaWF+HKmciGSOSo2aH9AZIkw:8xP8ClXtTtxL3yzItbkUF+FciG1S4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785017219, "uuid": "0fa32848-e35e-4313-9281-69e16a2614ea", "value": 9991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785017219, "uuid": "3669ac8d-bbee-4e19-96e2-fd0a7dfc5873", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785017219, "uuid": "d147e6fb-c11a-465e-aeec-5ac1d26a3c26", "value": "e69cad1fc4f37b152dec7c2c8c80b9516ff10a28a04041fdeb0294bd8f0dbf78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8807ed06-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975718, "uuid": "13fd4b63-207c-4822-ae30-6e602d222fe0", "comment": "Malware payload", "value": "7a39ebdd67c83f613de179c9359c813e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975718, "uuid": "d3da322b-e7af-49af-9ddd-0f351a10961a", "comment": "Malware payload", "value": "e6d6ccbb6adbb7e6d16eebe3f34d08a7b48647dfc5b1930f9a0463c2e64c11a7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975718, "uuid": "41d13132-99ea-4fa6-a2ea-0a6328171437", "comment": "Malware payload", "value": "3a28649c6d1d3e1eab127d3a8ebee595f4fc3324", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975718, "uuid": "06ccd8b9-7a34-4d30-85ee-3885c0d01692", "comment": "Malware payload", "value": "dfbc4c04c33ae7c67f913db6f5a4d8f61aaa289d6db7cfe096bb758efcf799219edb9452f8ce82a4898245f4f458ee99", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975718, "uuid": "c05149cc-26ac-419e-bb5b-f14849f32ef7", "value": "T14252B0D9F1415CBFE3E7CA2B634BB12F25BB16005B5238E3019059B09622911E6E5F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975718, "uuid": "fab5ff25-5b09-4f60-b73a-75996e0244a5", "value": "192:kSQFBkjC9E5M156mQQ6pWO1kul5TKL+yIRsa6CniIZ23T6cy52lteTjnOlZ20en:kSQKX5s6mQQ2Rk+tRB7+K5SeTynhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975718, "uuid": "94933629-684c-47e4-bc93-05f678252bce", "value": 13402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975718, "uuid": "c21a1378-bbf7-4df4-8480-896d6a807a2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975718, "uuid": "8b853da3-50cd-4d72-b98a-29e43410a94f", "value": "images_20260725_024010.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393705f9-884b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784999208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999208, "uuid": "9c23fbf7-329c-40d6-9a32-ef2369e379d3", "comment": "Malware payload (RemusStealer)", "value": "2c04e7af16f472c1354448f81b7a7ffe", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999208, "uuid": "243f7de3-1576-47d0-839a-e3293907a1b1", "comment": "Malware payload (RemusStealer)", "value": "e76d373869783dc10414994a1f2a052f8740e257372f4d4de17615cde3c87a3f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999208, "uuid": "0640b336-f14c-481e-947d-e86e494ffe45", "comment": "Malware payload (RemusStealer)", "value": "bfdbd7aeeca0e7d995cac4a2567a18bcab1eca50", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784999208, "uuid": "8983821f-b40f-4ef2-84cd-3c6643c93442", "comment": "Malware payload (RemusStealer)", "value": "32bc1810173e4cf1c191c01419e543bbaeea2cc0f3fa94301a424f88a54be0d63be9d6bcb1c34d3420fe469f200a042a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999208, "uuid": "251263af-b0ef-4eeb-bf51-094eec30dd77", "value": "T14BC61257BB859394C0D30E306A46C3D933D0FD1986E98B2B35CB6C03BE61DDB4E4A5A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999208, "uuid": "4af42ae3-17e6-48a3-82ad-2af35231c55d", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999208, "uuid": "45f38d71-639f-4173-bcff-916692eea8da", "value": "196608:egc04g/pEb/JhzsW+rlS1+LSuExEnMkWhLIPdfeZCNJJ/T9BS3gVw8KC2jpk5eN3:14g/pEDQRrcoLDE6mhL6eZCNJFT9BS3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784999208, "uuid": "ce90e646-2b73-4202-aa19-dab464253e47", "value": 12256944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784999208, "uuid": "8545d223-a0e2-44da-8ef3-4cce198500bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784999208, "uuid": "99a7e672-679a-4b30-b68c-92f4fb53f33c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7db06f-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974033, "uuid": "adf99b56-34e9-44e6-9cb6-7db0bd3d73a5", "comment": "Malware payload", "value": "d961a947ac6976277fba19f6fa476ec7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974033, "uuid": "e5d24f10-35c4-4056-8c4c-a24575430a99", "comment": "Malware payload", "value": "e7b5067808ac92a0e7817dce59b133229c3cc9f6edef31fc33c39c3003d7d9b6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974033, "uuid": "b68f447f-b0c2-4756-a6e5-5643025926ab", "comment": "Malware payload", "value": "24ecb2ec0afae6e48012f873b32c474b6a4067b9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974033, "uuid": "a8ff8828-05f8-471c-ab02-c4a93565d2cd", "comment": "Malware payload", "value": "55d4f61172d92c402438afa315166099be328fc0d1206ba1237a73785a236b7dfff9c2a35c1fc337407cd8faed251b13", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974033, "uuid": "18358390-1a30-4970-954a-f56287a736b7", "value": "T1D906BE4AF748AB5AC0F7523A0C755A62515B8CE68F83D7837D64733C48BB9C01E5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974033, "uuid": "8fc648f5-f2cc-4246-afee-a498b0254f76", "value": "98304:n1ij3XVsrRrEZ0CTWUSrAoSZd01KAQe9Z/yv/Ln2M:nj2ildYlq/6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974033, "uuid": "c553b883-da3a-4798-8bcb-5efd0eceb4dd", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974033, "uuid": "9cb58727-5039-4ff8-9427-e1c5d9112466", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974033, "uuid": "d5f32045-4e77-43ca-961c-431ad6dc6094", "value": "variant_19.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9ab321-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991453, "uuid": "a1a0edd8-4ddb-45f7-a010-ebe1b05b9fa2", "comment": "Malware payload (Mirai)", "value": "e090a0bd5d944d0a14f618e23a5dd7cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991453, "uuid": "770d174d-cb12-478f-94da-6332adf7c670", "comment": "Malware payload (Mirai)", "value": "e8651e6239cb035facb2e7ed72a447aea560edcfd08ace5f29e8b4ca97ee1f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991453, "uuid": "9523a874-465a-4aa2-a2a0-21e557844a5a", "comment": "Malware payload (Mirai)", "value": "3f9a51cefb47e946eddbd2cc8072af8d3db662e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991453, "uuid": "3621efcc-1484-46e2-805e-3e93f715fc96", "comment": "Malware payload (Mirai)", "value": "8c87275bf91abaad7cdad5fb1c5d28a1218f484470d58176232f0cb5d530f926db6dcff536759dd6bd43578440285b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991453, "uuid": "318d5f4e-621b-4ade-a717-c87878085921", "value": "T112043A46E6408B13C0D72BBAFBDB42463333A75493E773059928AFB43F867A94F26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991453, "uuid": "0391809f-e42a-4048-9c7d-ab7d78742b3a", "value": "3072:+TSg8BH1yu0AMU89aYLxE/z81/Ue02FRHoAM/ROs2s64y:ng8B4u0J79aYLxEL7e02rIAM/REs64y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991453, "uuid": "488ae812-2615-42eb-828a-f8dc7497f4eb", "value": 189969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991453, "uuid": "29947c99-7ac2-4a64-96ae-72c59347a862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991453, "uuid": "205d828f-17f4-4f54-b9aa-030a3279515f", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01f0132-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975329, "uuid": "98318205-e195-4eb9-bf5b-77c0970a0f52", "comment": "Malware payload", "value": "0773d3b4f1cda0057a857435d5b8b85b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975329, "uuid": "34057197-1a5f-4746-82ff-f72c884bdcbc", "comment": "Malware payload", "value": "e8a8f15404aff99d1c5ad2406ff7b6944f7164ce453684c49d93f3a43ee348e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975329, "uuid": "b04fc6f5-5b19-46fd-a78d-ad5414b642c0", "comment": "Malware payload", "value": "0ae9524a98c02b3342936d087b4dac71a6efbc22", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975329, "uuid": "24c23813-90b6-4169-9040-925bd5dffe91", "comment": "Malware payload", "value": "148b1815ab9c680a326f50e814218da50cda517ec1b3fb7b2c57863ed677b76640ee5c0ae901164b64ab1b265e69cb75", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975329, "uuid": "7e738bdb-a733-4b9b-bcdc-d644c445a179", "value": "T1CF62D1B74D880BDC9AA175346A9B835B9AF249D74A80EFBF541FB711344B58C250C4EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975329, "uuid": "7d42ca7a-6e73-427a-97c3-add14dd87bef", "value": "384:tMuqTQ8LthPh52Q47+0f/VXT1+5d20QtLI:SuuLZ52QC+eZT1Ud20cLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975329, "uuid": "01d63119-fb42-4c5c-9939-f7afcca34719", "value": 15331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975329, "uuid": "4d73b95d-a7ce-4a9e-b1e3-2079c6615b71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975329, "uuid": "55a8f72c-fac5-4ce8-97ff-6118577d23df", "value": "images_20260724_144211.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474428a3-87e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784954135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954135, "uuid": "e1c8603b-7476-41dc-a0ab-1bdffab52dd7", "comment": "Malware payload (Formbook)", "value": "6ee45924e83a258feef3de17d9d41d19", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954135, "uuid": "2f0ebb25-4f05-498f-92a4-7c5a2cd3b568", "comment": "Malware payload (Formbook)", "value": "e999d3463eb7f77dca85bc0e3be1a8ff30dc44aa75a8dea846f132fa57808c41", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954135, "uuid": "5d1aee28-39d3-4abf-9503-3c487ea7afa4", "comment": "Malware payload (Formbook)", "value": "aa8c5b8124c40dbde2ae2b43723789f0e3d267f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784954135, "uuid": "b92c8c8a-33dd-4921-9505-3c29845bbfc3", "comment": "Malware payload (Formbook)", "value": "3282838ca8ed8cf47c4929885ac98ae6894b8ac7998b83e3fea53a847751a95b8f9dc8928da972bf4e7f8ef53c9fc575", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954135, "uuid": "101cca92-621f-4300-b940-ac55203ab085", "value": "T165E5E8D22BEF30D64E19739ADC48ACC40B5AC439DD41B4E8F1CE4A89972F14B5EC499E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954135, "uuid": "f0a02b0f-784e-405b-9b85-fe08752d563f", "value": "24576:eiqKlYaBsDdHFOfWrYMVlTOez61bQhz9b7E+hW0myMlA6CiLubRpKUPl:PqKGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784954135, "uuid": "03053490-5bbc-4ab4-bf37-06af31a0e21c", "value": 3127727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784954135, "uuid": "571d9c01-12b8-485e-84cd-117aef2de0b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784954135, "uuid": "a76fb955-1e98-4653-a9c1-fcaa55cc6dc1", "value": "PO-1105902.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1046c56d-87c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939869, "uuid": "3db3499c-2c8c-4ad7-ac54-63f48818e19b", "comment": "Malware payload (Mirai)", "value": "70c4a153e31572e082a016da78bd8eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939869, "uuid": "4c6e6e96-7c2d-4adb-8654-158c701aff7e", "comment": "Malware payload (Mirai)", "value": "e99a7bd37ed9f6a21066b75329d30c9757a4460a32d61b6d551fdd229c39803a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939869, "uuid": "edcdb472-680a-4e06-bad3-5c2445221bd5", "comment": "Malware payload (Mirai)", "value": "0196e2d400cbf78794368bc2e5b1d2290659bcc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939869, "uuid": "974dea5d-e9d5-4f5e-9899-7a9e60b07b28", "comment": "Malware payload (Mirai)", "value": "90d672c5dd05f4f1a4eb3eb673130c4eea5b1df3899fd985d1e841dc5dcee59624136a9af9b1de5d08cf92240937f269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939869, "uuid": "010596f7-8689-42b0-a5e0-35d48f17e141", "value": "T1F4C32980F58F85F6C50B8D3060A6F63FDA31D5A981A3C66EDF949F72CA73581921238D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939869, "uuid": "398f134e-21c8-4802-928c-1fa9716c6144", "value": "3072:2Mi2qQo4lHF7O75FhI32k5sfPHPNCAPRX9qsrHx:62qQo4lH9C5TI3H6ftXCEHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939869, "uuid": "266bd46a-ca0a-4bef-a187-70270d75da38", "value": 121172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939869, "uuid": "e0fe158a-568b-4639-8da5-5e7bc5b56568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939869, "uuid": "8af2c6c0-dc11-4ee2-b965-f5996459585b", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f3500a-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998716, "uuid": "a5373a84-2a1b-45b2-a84a-165edd096cf6", "comment": "Malware payload (Mirai)", "value": "1b1b906c2fd668d818421a72d658aa1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998716, "uuid": "12d7ecee-12c8-49d8-bd29-aeadc84edd08", "comment": "Malware payload (Mirai)", "value": "e9df735ea30bc4e950ab968c75569b83d5c6bb0d2e4a5e442ff21c3b1320cb01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998716, "uuid": "c125346b-9d80-42d6-8eda-530d0e6d6e62", "comment": "Malware payload (Mirai)", "value": "452b5134586c0b4de8dea14bcbe4a3edb1c6700a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998716, "uuid": "f6a9ad80-3586-4c06-81e3-43d89dfc0918", "comment": "Malware payload (Mirai)", "value": "cb019bbbbf2dab7db91e2b7b12405078a295fd7539c1f1f07665f63fbeb1d63dbbd10dba1feaec1fa9f24b7d81abb4a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998716, "uuid": "57711dd6-5d33-49c5-aa5b-2c934228e2ec", "value": "T135E2E0B1A5C0AD04C7A014FE8D998FC3AF4D4F79E1D2774B2A08575B928318A67BE4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998716, "uuid": "525c7b33-ff2d-443f-bbef-ff95fd4897a9", "value": "768:avRZrkQEbcMLSWN3Sz5atCpQNrnhS6Bz96z/T4Ps3UozB1:QReLN0pohBBMrTzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998716, "uuid": "ee302978-ba38-4fab-9dfc-2488d88fb6ae", "value": 33508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998716, "uuid": "2be0f669-0dd9-413f-8c8c-ec0c2e4c0947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998716, "uuid": "b4826090-d09c-4acd-8154-eb4323104e1f", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6a793c-8851-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785001950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001950, "uuid": "6c732d90-b97e-4660-a230-bc376f8f1e6e", "comment": "Malware payload", "value": "33387319481f1758bed1546cded72d14", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001950, "uuid": "9ccab071-8779-463e-9e47-ba2bdc9aae6e", "comment": "Malware payload", "value": "ea31e8a1d6cb9142b29a79592436a4842065bd9604349e564e6489c486837509", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001950, "uuid": "f62c5033-53ef-43d6-bd5b-4894b4ab212e", "comment": "Malware payload", "value": "586f0e187204b43b3007740ccefb61c7868511c9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785001950, "uuid": "f48453c9-ad9f-41ad-a0b8-1833369e005d", "comment": "Malware payload", "value": "85e4a0eace31bbb3fae8241ea43a17f3ac8c6b4f363d127799b475d7c760b67ef7ee0d4f59aa52ca38c898f5386dd9a9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001950, "uuid": "9b33796f-57cd-4eec-917f-e46816785290", "value": "T1A1E6334C57D016EFE5A3513CEDE24965E8693CAA0771C8CB07A1C362BE1B3D09A7D227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001950, "uuid": "5863cb7f-ee08-4c9d-af60-41c39a517cec", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001950, "uuid": "cbd6d156-8845-4674-b153-bf10d74ba49f", "value": "393216:JqEgE4WzMrUvY2LYLQPwINXMCHWUjXVcuI3/PGTAI:JqjLWgIvY2LwINXMb8XiH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785001950, "uuid": "204cd1ed-5729-4344-b798-45961e4bcd44", "value": 14302321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785001950, "uuid": "3d404133-23ce-46b3-bbb0-27d6b46b176c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785001950, "uuid": "c92e28c4-e512-4276-8dde-256bed4eaea3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128b8987-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998714, "uuid": "a7bf21c0-84c7-485d-b30c-1d448365da4d", "comment": "Malware payload (Mirai)", "value": "4d1f8674b83f0e45fe44c289bc5b2127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998714, "uuid": "c6f003f9-f033-4f8f-8292-69216b2602e1", "comment": "Malware payload (Mirai)", "value": "eb3f90ca702eb63880546c67d1530a9a994e66fdca6d0567b2860887fdcba14b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998714, "uuid": "4c4bee9b-a12b-4539-97cd-2750febb72e0", "comment": "Malware payload (Mirai)", "value": "8aed28fe6d23f513a74fe8103a8a07b3a6ef0559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998714, "uuid": "e621bb55-cf38-4738-bff7-85c383e7369a", "comment": "Malware payload (Mirai)", "value": "d26361769e64b42078833fa9e867cb0fb4cbcab80ca7d5b9b858afee0642ea1993878c8e4370ef3105042265fe33d78a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998714, "uuid": "95e225a5-10be-4126-9de5-a312083a8384", "value": "T1BB230271F23DDD28E5E08EB679F4186750A24B2DE2EE703614055B8CD09F60A34BADD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998714, "uuid": "c04d0ad9-8ca5-4fca-9440-8d603a8bafb7", "value": "768:IlRnxlPQhwrSdyGsBpxd7A0a+YMAi76lqhpQA3CvFGSd4jlT2qqYE/YVqYs3Uozp:sRArdyhBF7pfgi7UeDyGKIlzPLVszp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998714, "uuid": "283ea580-72e9-4b78-a211-cf30881bc60f", "value": 49976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998714, "uuid": "44d2f8d6-96f4-46a1-9520-5f55c8fcbf29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998714, "uuid": "7d904088-0db2-45bb-8c1c-961691dc1983", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68af1db9-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784973948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973948, "uuid": "4c00b18b-4325-40d4-a1e0-52434e6fe727", "comment": "Malware payload", "value": "4c71fcd7cb4ff2e2d6e8caddfbe726c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973948, "uuid": "3102c213-a5df-40a0-a3b9-b25b77232f10", "comment": "Malware payload", "value": "eb7b4fd1b521ad8478fbd73edf92875e4f34f33603f4cf8e7df4d07aa6a5b9f2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973948, "uuid": "45b62c54-705b-4283-8582-3e36912133a7", "comment": "Malware payload", "value": "aff77e6c4a999ade761eaca76de5963b0fc28042", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973948, "uuid": "c319efa8-51a5-4de4-b629-5479a875d929", "comment": "Malware payload", "value": "1a5cf08e685028e40ec31f4fa37097d820777cd57e0c571dbcb496c8298147c16f2d00da04b8d503111d7ef03b366fb8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "semprecardsecure-com", "colour": "#7C1D06", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973948, "uuid": "c31f5fdb-414b-4540-a12e-2817ef5a1811", "value": "T1E806BE4AFB489B5AC0F3923A4D355A61411B8CE68F83D7837D65773C48BB9C01E5AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973948, "uuid": "49e181cd-e1f5-4902-821f-4d15194cd754", "value": "98304:01ij3XVUjJTEwm0KTvcs7inspW18rFV7IVjoNAn:07eCOcf048rFV7IyNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973948, "uuid": "3a4429c3-ac3c-4138-a243-9330c4230605", "value": 3751253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973948, "uuid": "33f3d64d-bc3f-494a-9a67-5b38e5efce97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973948, "uuid": "872ff4fe-d5a9-48aa-a43d-ca313532171e", "value": "variant_07.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514b2d20-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975197, "uuid": "f44c13c3-a069-4580-814b-338ac5f8c209", "comment": "Malware payload", "value": "ea6fd7cd96a9d441203fc5211c1e6d0b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975197, "uuid": "7728d183-283b-4fd9-8b2a-71006b064ab2", "comment": "Malware payload", "value": "ec14c953840193a9af922c09a7b3c5b48f8db177d69689ea927b034fbea43a72", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975197, "uuid": "80b72c9a-8324-4ea0-8ef7-866c47bf3759", "comment": "Malware payload", "value": "588fb0a0aed5c449c8335886219365b48085b665", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975197, "uuid": "a892f2cb-5162-4f8f-80e5-aee106c08798", "comment": "Malware payload", "value": "fd42221144de90c210ac070c3f38b7a044adaaacd3455d1edd54aab76037ee6d8fb1fd4cfe5cb3de901cdbb9e9575f67", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975197, "uuid": "42d02204-0a88-446c-a527-c79e24a82bdc", "value": "T1CBD19FCEDD9A1A11A332B2F253FE68FCF9C000D903A56F6B45981B9F05932131F64485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975197, "uuid": "fa30daad-c42d-4e16-8f54-69e846b0f88c", "value": "192:LDAE9lN65TVEAsHCGCEABgDUJkN2KEewM2nLdCtOVggGzd:LDACN65hEAsHCBuDUJkN/EjZhIzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975197, "uuid": "0b5f928b-a449-43ce-8bb9-191e22e3c50e", "value": 6743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975197, "uuid": "68f9b3ed-86f6-43f8-ad2b-7cc2b04ccb49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975197, "uuid": "5f17803a-5b65-40e0-9ba7-a0f94ecbe335", "value": "images_20260724_120518.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cb55dc-8829-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784984570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984570, "uuid": "06dc3e83-8e0a-4f77-ab6f-0f159c8abfa7", "comment": "Malware payload (Mirai)", "value": "ec1aff4d1a82aa90a95bf0f080cb5040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984570, "uuid": "6f5c5969-617e-4203-a03e-daf58f532967", "comment": "Malware payload (Mirai)", "value": "ec1f047aa026faddbb2a8626bafa3215b54962643af0346011bc083612c73743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984570, "uuid": "3107e433-cffd-4553-9758-8624ab9a2a80", "comment": "Malware payload (Mirai)", "value": "a62e1973654ce63263f46e3cd55e686f35c846d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984570, "uuid": "7e27c1b1-ee72-47e4-bdea-d2182ea8a371", "comment": "Malware payload (Mirai)", "value": "7b8ac802e8a51033706f355f9a4d8d373063b486e70eed7674e9c1bf9ac983e5190dd07e01704f57517bb9fcf96e9319", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984570, "uuid": "cf6006f9-d556-4d91-99d9-0d86c58b7e67", "value": "T1863301B6C60800D3C2A01971CEAB01C4FDCD57F8DADDB2899B6C615D91D6D6EBA3B093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984570, "uuid": "b6c0ad8d-f4cc-49b6-b4a4-e5fb30fd7b44", "value": "768:ZXDapbs5qLKsdYBPLyEtFPtVsfT+ZtaozadAwUyTrMcsycng2ElYxO9q3UELCw:ZXZILlYBPLyIFzsf0takyKtg2kYFL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984570, "uuid": "70852f4e-b0e3-4554-bc48-90562583f27e", "value": 52428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984570, "uuid": "0a6f4a7e-04d8-498d-a69e-a4783e1659b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984570, "uuid": "4d0955ce-4551-4459-8475-960fcd357462", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2ecb8f-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974813, "uuid": "d569a583-532a-4bfe-a6f5-17ff47580282", "comment": "Malware payload", "value": "92f5c273036c9e4be69c8e4c4afc5065", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974813, "uuid": "522f7e20-3b82-4cbf-aeb5-1b6e764c8125", "comment": "Malware payload", "value": "ec54d0e96d86b5fb7fbdde92e3031617377601a521ce5af1ac6c8d5c74974125", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974813, "uuid": "69807db5-3c52-4892-bb05-c84bbfdf90d1", "comment": "Malware payload", "value": "7581efa093f222db3dbb8e58430854ece8b36bd8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974813, "uuid": "312b7f9d-ad94-4f32-ac66-44a667ca00d7", "comment": "Malware payload", "value": "217b56e2d48031b38333332cc6cdd045883ce0b371692149fd8f1192f43edb737b002fa40c8dd2534ce88b1e91c9cf15", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974813, "uuid": "6d429cab-05b3-464c-863d-8424c10b6cb1", "value": "T1D1511910ED2740B1C633BFF269FFDF14951068944686A77EE3FE5102B1897CB2A9B509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974813, "uuid": "e851adb5-76ae-414a-9a98-0ab46aefb4dc", "value": "48:9JXwRw1IDp2e9C+hoqmxolJXkGOZ71N0BffxWdxWES8YTMtpcoJ:LXwCIAkkGm7cRJYjOTqphJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974813, "uuid": "7e04676c-917d-40a2-8203-332d4f7ae9a3", "value": 2898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974813, "uuid": "1b22137a-99a6-49f3-91ac-cdf97bf3ab97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974813, "uuid": "bb66d347-d7e1-49ca-a39e-8f2e189b8e11", "value": "images_20260724_160333.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266ceb77-8822-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784981568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981568, "uuid": "d974e93f-50a0-46d1-87a5-3f6509d203bf", "comment": "Malware payload", "value": "6eae1ac69208089d272a51779b13b5a7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981568, "uuid": "4d57b184-0095-44aa-ac28-fc1a56a226b4", "comment": "Malware payload", "value": "ecc5d9db7200962aacbfeaa2a1768d51dfcb9aa78f0ab470558b3f82664629e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981568, "uuid": "983ba1d2-f05b-4885-8b67-157f62f22930", "comment": "Malware payload", "value": "c703832c101eeb879ea0a668f5689d3d0229d4e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981568, "uuid": "afab4881-c8a8-4394-b513-e797435e5133", "comment": "Malware payload", "value": "d53d5e56d98b834244fec9144596c6f165ddda7d53d4f522c5c43b425a19d10c38f956a66b9082cf323671880fa0f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981568, "uuid": "b991a738-6cd6-4a10-a208-8d4009f73c1e", "value": "T197136C6516953C28AE99883B5D7E2F0CBDA983E1304491DDBF8B3CF18C55A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981568, "uuid": "662312ab-f3df-4e71-8d8c-dc913d36d9a9", "value": "768:99NyXsZztCk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:9HusZMco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981568, "uuid": "9131eeb7-7b70-49a2-8e94-8a2a7e737b0d", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981568, "uuid": "3ccb344a-4703-496d-84e0-d01481a469a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981568, "uuid": "da505423-6ed2-44ee-bfea-1a2218a730bd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f2c363-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975171, "uuid": "52a083de-d126-4af3-959d-6446abaa4971", "comment": "Malware payload", "value": "506be0f3446082df2fe9976758a50804", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975171, "uuid": "18bb693f-75cd-4928-9e91-6bf5a9a869b6", "comment": "Malware payload", "value": "ee40cb76cede7138b7302f11c739fe28f8833381caadd3b7c256ac92d874c25e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975171, "uuid": "4bf81940-c31a-4cf7-9b07-c9453eb98a81", "comment": "Malware payload", "value": "349d49f273f9e795a32eacf19a206cf109e6ea5f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975171, "uuid": "076e01a8-e76e-4acb-8154-979c70855378", "comment": "Malware payload", "value": "31fa0e70c68e53267da31bb4b93234881f52cd9b7076ed0d82f6fe6044b7ffc748de6b397100129322e4ae49170d73b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975171, "uuid": "45087585-cb45-46c4-8eb8-e112de57982c", "value": "T1A531F886DE6FBF02F11332318A549C4A3F1821CD89E7CAB9600D57AC36823B20401535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975171, "uuid": "e5fa6706-d029-424f-b0c6-7688a4f39b45", "value": "48:9ap09D4rrUWJuuk0E2qHdkaK8GdgUk0QNrOx2D4L/Ri:k44rrUguukzh+aKFdgUr2kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975171, "uuid": "5ff6bc4d-9e17-40d4-b41a-b7832f98db80", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975171, "uuid": "7ddaebae-23aa-4be4-9059-aecf4598e804", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975171, "uuid": "fc27beab-e204-4118-a64d-7fa76cccd1af", "value": "images_20260724_134228.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5233dd7b-884a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998821, "uuid": "d398d4d1-32e0-4b82-b325-b920fe5b2a5c", "comment": "Malware payload (Mirai)", "value": "6b0d92f5955366d23ce0bfc548a40136", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998821, "uuid": "85e491c6-b82d-4795-a616-57c3544cfc0f", "comment": "Malware payload (Mirai)", "value": "ef97a019a136f7e43ad006f8a7fd44236df44058053b5e01dd60755d24c86011", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998821, "uuid": "8fe79d0b-abe1-457d-829c-5dba71e3ee48", "comment": "Malware payload (Mirai)", "value": "00dc110cdaf86dc8e511c820c6d7a0c145d5cf5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998821, "uuid": "c5cb21d4-a2c6-48fa-843d-739d84e980fa", "comment": "Malware payload (Mirai)", "value": "12611bea0a9f2b17be1a6a38129af23bee53cec55032c1c4975b5dcb61d44f86f3aa14678ff41419a3b78e3564a2d4ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998821, "uuid": "8bb9cb38-426a-4f75-9bb9-1bb3ea8ecc7f", "value": "T156246D46EA414E23C0D7177AB6AF114A33329BA4D3DB730699286FB43B8779E0D63705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998821, "uuid": "9900febb-aa39-4bee-bdf1-058eb31b6ca5", "value": "6144:pxrU3P5KyEowlaNKmHtNgrufdCzCaHIVL5FM/9uk/:pxrUBKyEowlaNKmHtNgrqdK2ni/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998821, "uuid": "cfa1a2c0-cd0e-4724-a7c6-9d596c91c107", "value": 213236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998821, "uuid": "b6bfd4c2-d15c-4b4f-a394-192fdcceb24b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998821, "uuid": "ee0c3bb0-f7e6-41a2-845c-fa0b9ba31767", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0156b38-885f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785007998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007998, "uuid": "bb119302-e22e-4eb0-ad5c-46ea252c64af", "comment": "Malware payload", "value": "3703292caefe9b29f637f7d768e7fdf5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007998, "uuid": "20487b0a-088e-4e36-9bb9-064f4bf75ed4", "comment": "Malware payload", "value": "efa742f512968d4e7c320f426551b3f4aa21e80ce8b40ebfdfe228e1f1980d4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007998, "uuid": "50d2bdf8-90a6-4e1d-b3c2-ee17112e69c9", "comment": "Malware payload", "value": "3e47108ad6f49a1f63f5bf71b716aed2750adab0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007998, "uuid": "d2d490ac-fdf0-4d9c-ad67-2c3581df2b0d", "comment": "Malware payload", "value": "eaa00c7906244b4afdf78625612ff979f9997f689ccc35e4fd40c1e631295627b2ba84d6440369f4707797c50c7e61ff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007998, "uuid": "809b960b-c571-4c7d-a052-11c0069e0710", "value": "T131C27D96AA867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007998, "uuid": "c26f11bc-a918-49bc-9bf6-754c041182f7", "value": "768:B8vCB+25j6es8RLK9FYpMSUpi+20qUpi+20YQX:B8l25JL8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785007998, "uuid": "ca22c1fd-9935-414d-80ab-19151394764f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785007998, "uuid": "8bfad771-cd1a-4c61-93b8-c4b5abfb0bd1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007998, "uuid": "e236e566-adec-4fc7-add9-243117b06277", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc00e79-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784979697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979697, "uuid": "fab14b22-0848-44c7-a86a-d517279ccfe4", "comment": "Malware payload", "value": "021b6cadd5a2a4a85af458f3280ac9be", "object_relation": "md5", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979697, "uuid": "2d66a0c4-30be-49e3-a645-bacd522bfcc4", "comment": "Malware payload", "value": "effee0474582c2da48ee22bccdde87acba0599416321e261d039ad016b167fc4", "object_relation": "sha256", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979697, "uuid": "52cd049f-f35c-4bbb-bed3-07f4e3fde5f3", "comment": "Malware payload", "value": "6e36e1caa0444263c95cca9225a439b8e3f63f17", "object_relation": "sha1", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979697, "uuid": "387c0671-c939-436f-9c5d-137a48883c6d", "comment": "Malware payload", "value": "42221ddd210b53a95182d078d819f09d03bc80207e728697dfdcc200c0ac4670e4391b8d40a090098bb83e97b7f92082", "object_relation": "sha3-384", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979697, "uuid": "c805f180-3aa8-4d9d-8565-2fcb1bf7da1f", "value": "T1D676E016FB45C966DC7B403540E6832A2703EE2BCA468B87158C739E7C774E46ECE6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979697, "uuid": "590b8980-03ff-4a44-a875-cb3bfbf79533", "value": "98304:tJteTdU3kAtkUC4SPfd7ApzkSXOEJm7DcmLAB9jnYU82WQjKP7qFvVffH+oGE:DYhU3NM4SHdGzkJEsvc3lYU82Yel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979697, "uuid": "ace61491-42bd-43a9-99f1-ef169ed031b2", "value": 7314469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979697, "uuid": "c8b92622-25aa-49ff-994f-25d8f8c3c748", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979697, "uuid": "11d75e4a-0178-41c4-afb0-a9e2b3fd49dd", "value": "effee0474582c2da48ee22bccdde87acba0599416321e261d039ad016b167fc4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d714c30-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload (SantaStealer)", "timestamp": 1784974815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974815, "uuid": "655f4cb6-a3fe-4be4-b43e-216d3e7670d9", "comment": "Malware payload (SantaStealer)", "value": "e48b80bf5c9990c155ec29b51d923a58", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974815, "uuid": "badb348b-0482-4983-b78e-050bdb7c7ef8", "comment": "Malware payload (SantaStealer)", "value": "f0765c67ba0cd814034113bce666ec27034afd6c66ee8ca559116b74232554f6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974815, "uuid": "6d3f9335-d03c-4780-86c7-438b26c5cb14", "comment": "Malware payload (SantaStealer)", "value": "1644ef86847f96a597549547b26f7800af5075fd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974815, "uuid": "956940e5-69c1-4b8a-82a6-2c193a30d574", "comment": "Malware payload (SantaStealer)", "value": "6d3d8c523bb02a642ae94efc8de8b49cfc3ed9d00f784e0c36a93f0660e5cef6063e480af3c8e6e9370e917d59dd25f8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974815, "uuid": "d6135147-8382-46e9-8f7f-648d0da992d8", "value": "T1B76633AE07640CF38A279E21A77449F91D7276B81CC5408329E046E7F0BBA3D6CDF55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974815, "uuid": "74f12e27-708b-43cf-8e22-8950b243e7da", "value": "196608:Di9fnb/6mImjMKXKSOU+LaRC6+KQMtbz8lT/WsF:DiZhMj1T2gNMxz8NtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974815, "uuid": "d4b3b1cc-7895-4abc-b66a-5f58fbe517e3", "value": 6971160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974815, "uuid": "b886441f-8b4c-47f0-afa9-9c866b334505", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974815, "uuid": "ea6547ff-dbce-400d-9c18-4c89eb6cd604", "value": "f0765c67ba0cd814034113bce666ec27034afd6c66ee8ca559116b74232554f6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66b24a3-881d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784979688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979688, "uuid": "c7f7fc1e-157d-4315-b857-218d64992180", "comment": "Malware payload", "value": "bf344f513b79b3478ea775d4129dcabc", "object_relation": "md5", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979688, "uuid": "f6d6f8d3-7e99-4225-8a21-676ba2bc863e", "comment": "Malware payload", "value": "f0d69c519ed9a1ad78751bdff0e9fcd943d11ef4b91134dad054a8b0993e46d0", "object_relation": "sha256", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979688, "uuid": "0209ac7c-043c-420e-a529-314c824916be", "comment": "Malware payload", "value": "3cf3ebb1fc1437c2a9d887f40233e9e649208c73", "object_relation": "sha1", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784979688, "uuid": "757eebf3-2e92-45ca-8b3a-397d3806ce7d", "comment": "Malware payload", "value": "dde6ee5b1e2d9d9391df34435c4c4b6b639b7c3d1dee2cae52857abf3e15cef4439a6f4d566124a0055d0b7a1a509507", "object_relation": "sha3-384", "Tag": [ { "name": "103-106-66-147", "colour": "#BAB08C", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979688, "uuid": "b8a4ca68-91dd-4b02-964c-21a0df115196", "value": "T15976D01BF7818966C8FB42B5A5F2431A2B13DE168A8387C7155C75BC6C730E43EC9AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979688, "uuid": "1297291c-c14f-4596-8cf5-b42ebd62f203", "value": "196608:MWHE7g4pwpdP3T+q1FWFoFbjtGOgXolQSt:MWHEDKdPxWK22tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784979688, "uuid": "e2a41bf9-f1b7-4055-a78f-c037b68d8990", "value": 7363797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784979688, "uuid": "30e3d41e-a20f-439b-ae40-c37a1381b485", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784979688, "uuid": "302dc657-1a93-44a4-af7d-d4caea4c79c3", "value": "f0d69c519ed9a1ad78751bdff0e9fcd943d11ef4b91134dad054a8b0993e46d0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eec895-87cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784944850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944850, "uuid": "fa8ddf6e-8f57-4da6-840a-f2bf5713dcfe", "comment": "Malware payload (ValleyRAT)", "value": "3335b635f486559253584c0e54438d78", "object_relation": "md5", "Tag": [ { "name": "43-128-26-132", "colour": "#9CA4E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rkdrlc-pw", "colour": "#900D75", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "yfdhsdf-1433552157-cos-ap-hongkong-myqcloud-com", "colour": "#B86EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944850, "uuid": "8a44e1bb-a54a-42ce-8c66-fbc69788d355", "comment": "Malware payload (ValleyRAT)", "value": "f1b32c30b55ba9b23f033ad50f94d32b9ba2f1ddbad3f21bd5882f6f44514b99", "object_relation": "sha256", "Tag": [ { "name": "43-128-26-132", "colour": "#9CA4E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rkdrlc-pw", "colour": "#900D75", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "yfdhsdf-1433552157-cos-ap-hongkong-myqcloud-com", "colour": "#B86EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944850, "uuid": "3f8d91b6-33cd-4665-a902-82d135b8cb0d", "comment": "Malware payload (ValleyRAT)", "value": "9292468934ac1c99dcefbe81a970df268af74004", "object_relation": "sha1", "Tag": [ { "name": "43-128-26-132", "colour": "#9CA4E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rkdrlc-pw", "colour": "#900D75", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "yfdhsdf-1433552157-cos-ap-hongkong-myqcloud-com", "colour": "#B86EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784944850, "uuid": "b3176926-2988-4f96-95b6-ef3a208d26ad", "comment": "Malware payload (ValleyRAT)", "value": "ee9607f5f88a093d9662fb7bf0362a3ed3f6315ce4deaea267cb9e8babb9b03c0489f5fb67225481dd61ff0dfb72fd63", "object_relation": "sha3-384", "Tag": [ { "name": "43-128-26-132", "colour": "#9CA4E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rkdrlc-pw", "colour": "#900D75", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "yfdhsdf-1433552157-cos-ap-hongkong-myqcloud-com", "colour": "#B86EF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944850, "uuid": "131f9164-d563-4d90-b708-cee78155cd79", "value": "T1C406E01235814077D29F86B04919B3ABF6FCB57027F641D737B4DA8C2D72482463AABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944850, "uuid": "831fca00-0a92-4f78-87c3-a5eb976fb9c6", "value": "c4515976a2a9ac3424b7883c8c32a8ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944850, "uuid": "b828ac17-a4cc-4c9b-b900-a97f8abc8f1e", "value": "98304:sSIgCa4nLYNSaFCGt4AKmlsApaoMX+F1yHTn:sSGnLnQMAKmlvcobFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784944850, "uuid": "0bd92b89-d1de-4b29-9659-f434d6cf776c", "value": 3707392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784944850, "uuid": "82ab8d8b-3bd2-44be-aa58-98e50b5a0e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784944850, "uuid": "3756adaf-ff36-47b6-a73f-9fffc58c03e8", "value": "PdFcOrE8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2298e4f7-8873-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785016350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785016350, "uuid": "645939e3-b0ec-47f0-a15e-904361e89ab7", "comment": "Malware payload", "value": "7e0559341981ea975fe99657f4f417e2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785016350, "uuid": "e8232a13-8ed5-4ef0-a704-a7250aa6aac2", "comment": "Malware payload", "value": "f1f22912b7a9999e3df0c2deea7158c9b64a0bd5370710f7cac9e745683194ff", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785016350, "uuid": "7f3e6c0d-d395-4f57-81e6-acfec965156f", "comment": "Malware payload", "value": "6d68b60d681b7984a1517927362901a3fa56ba2b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785016350, "uuid": "33adb0b8-c584-4734-8dc0-08d500fb627c", "comment": "Malware payload", "value": "6683c1f702b9cb375e9305b00c2a2ececd94e2154b5768b44c26edb6e9cafb03a8fbaf3fd2a62a8ef79dec3d2193460b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785016350, "uuid": "1f8b0919-0df5-4664-a8f9-f06f3447f6fd", "value": "T1BDE633989AD012FFF562923C9ED363E1E5E970274B73C69B1BC485E53D632E0093A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785016350, "uuid": "066290a4-4aeb-44f1-bb14-41c1cc3fb135", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785016350, "uuid": "e6f954d2-7aa2-44ff-90cc-61be7da5937b", "value": "393216:5/erMWYkwgaA6f9NJpYU5XMCHWUjXtcuI3/PGTAI:5/eYUwk6YgXMb8XaH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785016350, "uuid": "581ee2c0-07b3-4626-a18a-b4823d2eb178", "value": 14272346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785016350, "uuid": "e1960358-4781-4321-b232-8ec6be891d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785016350, "uuid": "5fe2e994-0f03-4f51-a6a9-051fa38c8dfb", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3caed6-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975803, "uuid": "627a1c6b-9136-4f40-b9db-dc1c80a997af", "comment": "Malware payload", "value": "d5df4712cee46de1f6e6bd0d03370882", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975803, "uuid": "6e34c221-6d31-4820-82a7-4cf4a7a32d5b", "comment": "Malware payload", "value": "f32fb384ba3ec4e62970611553c27a0c687a82f301ab30650f77f322eef7e2af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975803, "uuid": "e309e779-ec1c-4e8c-a825-15b78cfc20d7", "comment": "Malware payload", "value": "fbe5a078c126308dec935ada17799f33d9d79622", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975803, "uuid": "2776ca23-a8ce-42a3-a8fa-cd6f96fc4674", "comment": "Malware payload", "value": "0650951c6aadbb338a245dac0349b67b4ddb9bd759d3faff4e9b4acc62771478e6a3d6a5138a061547a3fac23adefa9d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975803, "uuid": "b21f6944-28f5-48ca-bdcc-2f844b4b41bb", "value": "T190B19EE69D00E14BD08FF2F9B156445CC2378CAA4245DC253FCD2968E0825BB7608F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975803, "uuid": "585fbe13-8bb4-4fb2-b391-89f6484a1335", "value": "96:6e2TtAZ/YvsdbtypPwNNozRoGu5z3rzhpMFuCxCeiPC/a41yzBC:6rTtAZ/Y+y5xzRoGgz3hpMFRCf7Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975803, "uuid": "68a06830-113e-4601-97ed-a573292ef2ab", "value": 5549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975803, "uuid": "01e01567-56fc-4ea0-85eb-d5669dd82808", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975803, "uuid": "d3c3fc27-4148-4c49-b30e-cb787bb757e9", "value": "images_20260724_105355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152dc03d-8839-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991417, "uuid": "75abd0c1-7a87-474c-a497-d71fe1db9081", "comment": "Malware payload (Mirai)", "value": "249c689e78aead58dacf9f8aa4856087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991417, "uuid": "864efc0f-2639-4850-a0d3-87b26771f829", "comment": "Malware payload (Mirai)", "value": "f39916af4d4a869edf80c73f6fd567187e44a9e03fad16e2cf312adb0ce459af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991417, "uuid": "6a89b330-5def-4958-8190-031d37c9f826", "comment": "Malware payload (Mirai)", "value": "58faccacd2ffa54d727ab40722792b95dab4682f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991417, "uuid": "6d47bb20-7928-4540-8c62-60189bccd701", "comment": "Malware payload (Mirai)", "value": "bf6ebbfd2012fbbc4c84b028f12e7e215fb930c5f1eae648aafcb86406294e0b0a3940ffc35b5e6acd68c869471a169c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991417, "uuid": "5660202e-adbf-4329-a6df-e06f5db12549", "value": "T11F633976F9918F26C1C91677FF1E8389331723B8E3EA7113DA192F55278B91A0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991417, "uuid": "a3fc8a18-7bbc-4f6c-a628-85035439f16f", "value": "1536:qxdSNmgQTP6v9ZdU5lNIw81GYabDoQX1JPJ0XjtV2hZcN/jFdEeJ9LCnRxgy:qxdSNZQ78Z8+1GnR1JPJ0Tt0Li/jFdEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991417, "uuid": "c4b2876f-8d8e-419f-a292-7805651676b9", "value": 71004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991417, "uuid": "c2fe0004-ab30-495a-a7f7-dba0672213f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991417, "uuid": "784ad18d-df89-4248-b94d-f1ee959795d0", "value": "PMw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cb5ca3-87bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784939184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939184, "uuid": "ff2c4929-3c95-4652-9189-86c25b8bdb17", "comment": "Malware payload (Mirai)", "value": "51c5c224879fa6752e319139b545a793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939184, "uuid": "273c1a72-c383-4253-abd8-f5c2b4c5a4df", "comment": "Malware payload (Mirai)", "value": "f40b9499b0e34a77f5d01a8aafda388a198d90feb01c6b6b055ab498564b4ed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939184, "uuid": "c2dd055e-7ba3-479f-92c2-c58bdcd60e77", "comment": "Malware payload (Mirai)", "value": "4516f79d1c6deb5e91b9f8d845390b8b316b9309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784939184, "uuid": "f04933d6-9dbb-4f2e-a12f-84ae68a64322", "comment": "Malware payload (Mirai)", "value": "ac8cc7fd3c9c522a9735c228b3c1f6b343d87b414a040c6aae01495acb8489378568b299e245111cd3ced2e8663c12cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939184, "uuid": "90b396ce-6825-4b2a-8fc2-6d54367eb96c", "value": "T161E3D61E7E618F3CFBE9823047B79E26975833D636D1D595D1ACE6001E2028E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939184, "uuid": "aab7c998-3714-40ee-8f09-9e2e776a4fc3", "value": "3072:+2JG2CYTcYpA5C7gMtspYX29A8uXENQDw/HKK9t/w+T+7oywvyMiRZtkpUptH/t1:LJG2CYTcYpA5C7gMtspYX29A8uXENQDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784939184, "uuid": "ae0a1270-906a-4c23-a35d-71914a560287", "value": 156992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784939184, "uuid": "0a9f9c19-c360-40ba-90d0-82c136c75933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784939184, "uuid": "eef0e190-cd75-4882-8e42-9f04e088363f", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5a8600-8833-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784989152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989152, "uuid": "7dca343e-5a3b-4e23-9d1c-72d6b09fe8c6", "comment": "Malware payload (SalatStealer)", "value": "e7b0885f84c96d3d3c5a133f6406d678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989152, "uuid": "196a614f-6358-4fdb-a52e-2122e3f5fdb3", "comment": "Malware payload (SalatStealer)", "value": "f4c635ed4761ec8bf5f0b2355afee43110093952eb2b13441b64ac1a93bfbc40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989152, "uuid": "9e73aafc-d476-4be0-84f3-d681ad9df786", "comment": "Malware payload (SalatStealer)", "value": "7bd71cc73d62bc6671436952e8e356e0a505fd08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784989152, "uuid": "7c86f9f1-7d2b-4916-8b39-fd2e429a934c", "comment": "Malware payload (SalatStealer)", "value": "a75f7d50c426be8e3243aabcf7e47bd4c4f86c04c3515d1e4c116058ae9e76e74a59d0ce7d384a199ba5f1bd75126425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989152, "uuid": "1180aff0-f165-4c8e-93b4-536246e74a45", "value": "T1F8F533064B024036F6171A3D4A0971D7F85069B347FFF2AF9898A4BFD58C52983A87BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989152, "uuid": "c2ec49ed-7b9d-4e95-bdd6-126415b7a05a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989152, "uuid": "53f3babc-1326-4f64-b123-93dd9348981d", "value": "98304:ex1VggfR0X0hR7TaNX8lcvTAQf0dmt4pEba:YD5II7MXic8xMt4pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784989152, "uuid": "9723b3a2-f3e7-4383-aa53-d8d6f3d96143", "value": 3596800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784989152, "uuid": "50b479a5-3717-4a34-bb0a-1b56130f6980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784989152, "uuid": "1253766d-a90e-4e39-8eb2-27e6e270acdd", "value": "ZapretX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fa67d5-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975337, "uuid": "e95c41f8-60f7-4e5e-8dc7-d318af9446ce", "comment": "Malware payload", "value": "ca703df8e25e207f6090e3446e39af68", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975337, "uuid": "0779fbc6-2454-41d8-b47f-b2d155b4e186", "comment": "Malware payload", "value": "f539b338cad185a8f2c3f5dc8854e556b5861ba08f9484156535c03c928da80b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975337, "uuid": "15791832-be82-468c-adde-2f1f2eec79fc", "comment": "Malware payload", "value": "4780016750de770d0ff237fdbaceadf72132a14f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975337, "uuid": "8a823e0b-37ad-4128-a626-6eb964051098", "comment": "Malware payload", "value": "52a8f7f5de824434a369f4862f997c2a8f34768e9bdeaf70e0917bb21288763e7f1255dec5c9973847dfa28fb6c8c166", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975337, "uuid": "d996abc4-61dc-4fa8-9791-672dd500995c", "value": "T12042B068BA792727C071D2F263715A070084F6D9E7BA151DD487067A9735304F38EAF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975337, "uuid": "3f10b251-65ec-4331-b6a8-eaaf75bba060", "value": "192:IOp8UCGnxAS0IsAoVPeIFU0t/3mxmz3TJwDTERbQZKVE+iK+zK/P2oxtfYaS9Sam:IOcGxd0LZGIS0mxmPJgTAvlUmmuBRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975337, "uuid": "0bae538f-c3e0-4542-a492-3725ccf1bfb9", "value": 12892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975337, "uuid": "9abf3063-5b43-4639-8405-d8a7d1ecafcf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975337, "uuid": "7f9cf2bd-ae57-4cc2-8d37-841f060b0fb3", "value": "images_20260724_163250.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff453a1-8838-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784991355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991355, "uuid": "fb753f6d-2443-4f9f-b3da-b86782c4f6f7", "comment": "Malware payload (Mirai)", "value": "bdac0cbfe302f0601cf140524ef97d40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991355, "uuid": "a9561f0e-502a-408f-8ac1-2a1f73eae853", "comment": "Malware payload (Mirai)", "value": "f70c7f9c59216e4d98b5004aec545d61b8e326637b148a7586bba897be3e9b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991355, "uuid": "95c4ed1a-e87e-4a39-aa91-a4b3cc42207b", "comment": "Malware payload (Mirai)", "value": "57ec256e06fa82d18aa5b02339a81d35a439e93c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784991355, "uuid": "39a4d44e-1443-4b88-b0c8-6818be4c3df3", "comment": "Malware payload (Mirai)", "value": "0e4de6e9a0e9d6087280cc187d587db3bb7c6e11a9fd5516598826b62ac1bbd56e2d65bae5ab38bb8e74ee64c1d7eda3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991355, "uuid": "1174bd3c-b98d-43bf-b900-c9e50162ebb5", "value": "T14253F28DB26AECC2CEF54CAAC56D27F85B08705237E0475CA3129C4DDA2D04EB91767E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991355, "uuid": "3feb1b49-3228-430f-825e-c555168c96d9", "value": "1536:ejTVsLY5DvtA1XCx7SxQU5hwCxsO67WIkID06:evXy1XCIjX67WIlI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784991355, "uuid": "f5ee570c-9ec2-4ae6-86a7-11c747055ca2", "value": 61268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784991355, "uuid": "85970610-9267-438b-b05b-6b827f2862ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784991355, "uuid": "c35400ac-dce7-4510-9387-9fbe261be148", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd215dc-87e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784956961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956961, "uuid": "68d72eea-c88f-4469-a2bd-534fd443a241", "comment": "Malware payload (Prometei)", "value": "defc07a01cd414be83daac3623dff93e", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956961, "uuid": "aa9ac888-505a-45e1-a201-2aba45cb2d48", "comment": "Malware payload (Prometei)", "value": "f762c6535517e49b2347cb3fd1e7135fd17cfa7d5a6c46f01467102ce378dfa1", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956961, "uuid": "3207378e-249b-44b2-98e5-fcb1904d9bb5", "comment": "Malware payload (Prometei)", "value": "df5d88a12f702775175afc1b5b1810f1f02ed152", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956961, "uuid": "9be91600-0944-488a-89e5-c302382c5e0a", "comment": "Malware payload (Prometei)", "value": "119c8e55a949543d75020457ac17fa3ad7019bc3de3dcb1f6561828ed3479b07ea682528e12521e49beaac399c39f7e0", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956961, "uuid": "5a58e911-55d7-44eb-bb72-76d34974ae80", "value": "T12AD16664B8A49A31674EC03D9D9F4901308B522F451C2C19B9AEF5503F3E576A3F87B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956961, "uuid": "6832be60-d029-425d-a1f1-845d7d4fe07a", "value": "192:zY79T3zVsEg04I3ssa0x+Fg7PHFd+bM5be8x/NzB:q61bz8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784956961, "uuid": "00d627b0-d6ae-4b4d-95a6-4238e1cf1285", "value": 6273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784956961, "uuid": "86f33877-e21f-4a57-a0cb-12bb8145c4b6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956961, "uuid": "3a3652e5-00e7-4fbc-85bc-2467e6564527", "value": "f762c6535517e49b2347cb3fd1e7135fd17cfa7d5a6c46f01467102ce378dfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2f2484-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975378, "uuid": "8fe1e7bc-2a9f-425b-b05d-337290150849", "comment": "Malware payload", "value": "1c3f24ca0657097f1a9717a72a165490", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975378, "uuid": "5c8dbad0-30d6-478a-8086-eea161f1b5b6", "comment": "Malware payload", "value": "f77149d0a6b657da42daf1603037f1ac0f12b0f4f15c613931997b8abbdd5b92", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975378, "uuid": "7966223b-81f7-41b9-ac78-d6bf438a9c3d", "comment": "Malware payload", "value": "7aaad2b2b408b4dc22100aca98e48a577d552f80", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975378, "uuid": "f7d7a975-b928-4a3d-97d3-1be4f0352cb9", "comment": "Malware payload", "value": "e84e97a5e1db94d02c4abbcaabf2ffd5d3903373e02abb32c07aa6a27eb294cf7ee23440cdaa8bf3ffa82ad6835e5940", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975378, "uuid": "5ae92945-a2a0-4d55-bb75-997b8d63be70", "value": "T14D72D1008CB25936950F77BCD0D82376D6EF89B0A9D4E2239BCADD2CA42FD611D78794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975378, "uuid": "90f550bf-f9c1-4466-a6ce-86e659d2ad9b", "value": "384:/etzyg+Cwjn52K9lLFX2E3DQcwh3HsAF3KuSR0p:/UzJ+CwD522ll33qHtKug0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975378, "uuid": "396ff4c8-0ecd-43c7-ae44-95960130707a", "value": 17152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975378, "uuid": "b68cb316-83ee-42f5-8110-18ae7b1a911d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975378, "uuid": "5eb44ba2-512f-47e7-880e-cdc2ef69d54b", "value": "images_20260725_083138.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8a54bb-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975617, "uuid": "00b7392b-f215-4f25-a8fd-f00a38e527d6", "comment": "Malware payload", "value": "ae09c526225f04ab83f13519f57e26ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975617, "uuid": "0718af6b-c9b3-4a6d-a574-d9b1c9a8090c", "comment": "Malware payload", "value": "f91e7ab06d116412bd9c2942d130a0be342c981ac5a711a260cffd5dcfac295b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975617, "uuid": "c9bdc231-ebfd-477b-a2f4-06b8658de7f0", "comment": "Malware payload", "value": "ccc75c5acdc192cb112ff788e4b3063f95b05708", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975617, "uuid": "f1b7ee10-d4b6-4800-9255-136aa07818ce", "comment": "Malware payload", "value": "b7f85fd3c54a3d0f4547c46189042d3646da7c06fd0f69d31a985a347d96e783c4249ca7de4919fdde3ceaa11802317f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975617, "uuid": "eb67c912-f90c-4553-b557-ab685b07387c", "value": "T19142C011B6F505FED0767199A6BFA3FA3A49091F739D79D795E8C44C02BD032E944018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975617, "uuid": "3c7d8b2f-445e-49ce-beb2-bc4468e2b3a4", "value": "384:nlVKj95mzlPLFA+kaY9V1x9cDPe3vJybI:2fmzBJA+u9VrCTevOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975617, "uuid": "9efa5b41-5abd-471d-af0e-c10f886b58f5", "value": 13048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975617, "uuid": "fca30fb2-a794-4f90-bd67-cba0ace9d41f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975617, "uuid": "01adfab6-51ea-44f0-aca3-1c4b55798055", "value": "images_20260725_081435.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1acac3-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975299, "uuid": "455ab2ea-0b66-4557-8c67-c41da401731a", "comment": "Malware payload", "value": "18d4f66000dd21d013873719e2048b77", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975299, "uuid": "34bc70c6-1bc7-491a-bf67-a22815d948cd", "comment": "Malware payload", "value": "f9999dc0eb0bcfb797ec90a69e9f61c1f04ff2fcfa1e74d8ad7ea34443559027", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975299, "uuid": "fbefea88-905f-43fd-a160-623bc2575761", "comment": "Malware payload", "value": "7ae6bfa49f5a2bb70b2f83454e91628a0c093e24", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975299, "uuid": "bee71e60-bc22-4c47-8e55-cc8395f6fa72", "comment": "Malware payload", "value": "dd1a3e93287ffc9cfb4386b77da7949ebb68f73378091a0c4b6646502f9f8cbdb0362b19440a4514b4dabcee59a0d268", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975299, "uuid": "d98348e7-1fab-407c-8290-b51d16c3d644", "value": "T11432BFDC1792DD50AF6D0039804C9FAB537F8D47714CAB62F66C58646CA2EC860CE6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975299, "uuid": "e5cff64a-7633-4d90-bd1d-efc35c550bda", "value": "192:kMhJlzMXE4NZrFLs6s9UckWIOacKU0DKuPjY1Rlot/MkTRE2yKYbSqZwQ:kMhJl4XVLs6s9UK3IhEKmwZp3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975299, "uuid": "094cfbe1-648b-4b4f-b37d-8152b21f85df", "value": 11437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975299, "uuid": "10b25c47-98e2-4fd8-b906-bf46967f8de3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975299, "uuid": "6e9aaec4-f528-4891-aebf-a35189a88ba1", "value": "images_20260724_174529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f554fec-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974684, "uuid": "7c12fccd-b1f6-468e-824a-35243b802064", "comment": "Malware payload", "value": "9f8493e86bc07ce01d35052871a65258", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974684, "uuid": "351096e9-95f9-4623-9d52-c7161f6f591f", "comment": "Malware payload", "value": "f9e3cf66cb732678457f1471a276c97bde63cd738c6ddc7bc9b43cce34651b82", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974684, "uuid": "bed62ba6-ceab-4b75-ae63-4db560558b48", "comment": "Malware payload", "value": "8ece0c6ccc6cd46919e488dc2e017308f839518c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974684, "uuid": "8a61c53b-7362-4767-8818-9b5cbd99c2e0", "comment": "Malware payload", "value": "fe40a15383e691f1abdf90c94f159c74d7ed89cde0cecfeb47d7133e879ebfa5de77d44f74884a092bb8070be5d98c10", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974684, "uuid": "d62c55d4-1fbd-4d03-babe-d91fcdd7af09", "value": "T17822AF248D38E9409DE33FF731E4E7B4A4AD92B5C504139E9A8AEF4A4501EF26177804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974684, "uuid": "79fbbfc7-1118-4207-b7ba-38ccf79401b2", "value": "192:UGkemVOkZQMBteHKoo0UE3VUz8fwJOsDda7tVL5vAFiokO3mmym9:UzVOaeHKoo0USOzKkOsDKVL5vxSd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974684, "uuid": "d2c3b5e4-1ecd-4ba9-bf53-beccba8f0d95", "value": 10209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974684, "uuid": "252b6bc2-4b3f-4354-b65f-7f397393a26c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974684, "uuid": "0fa2783c-42e2-4539-b0d4-8997e92500a2", "value": "images_20260725_050857.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f02c428-87e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784956188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956188, "uuid": "3c1ca7cd-695e-4f68-89b1-d91d6c8a1530", "comment": "Malware payload (Prometei)", "value": "00ea37d0e01bf0b60b880bd5df215b4d", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956188, "uuid": "ecc2712f-cd4e-4686-8f44-aef340b5ce41", "comment": "Malware payload (Prometei)", "value": "fa0e083227a2394550d09405503eaf0ddf4501a7988b0d0612296bfe16ef949a", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956188, "uuid": "6652a26d-82ec-4f1f-a297-3dfe6ef63029", "comment": "Malware payload (Prometei)", "value": "83b1da86542206e9383e704d95dffe2369233fe8", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784956188, "uuid": "bf31c64e-5223-4e2b-ab33-4074be49d43d", "comment": "Malware payload (Prometei)", "value": "71892729a9f04bd77bea4faf8e2822ab6accb369621ccc52ce5d6083abef1842c2af54d57c4304100c370198d56e4148", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956188, "uuid": "30639a72-09d6-4add-9013-e61566cb552b", "value": "T1A7B15664B8A19D31634DC43EA99E4912208B922F051C2C1575AEF6603F3D576A3F87B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956188, "uuid": "55f85b96-e195-4587-b126-5e2e80385bc8", "value": "96:zq17ooDDzVsOg04I3ssn7m0x+Fg7PHFdqP3xmkMmbwD/NlX:zq9T3zVsOg04I3ssa0x+Fg7PHFd+bMme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784956188, "uuid": "53ff4cd8-ac44-47a5-aff4-ffc09bd56a0e", "value": 5272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784956188, "uuid": "ec96accf-0952-4571-912a-8a230836b6ed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784956188, "uuid": "43ab16f8-011d-41ed-ba6a-452667960a0d", "value": "fa0e083227a2394550d09405503eaf0ddf4501a7988b0d0612296bfe16ef949a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a93b13-882a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemoteX)", "timestamp": 1784984969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984969, "uuid": "0fcc517a-9cab-434b-a633-7c9e681c029d", "comment": "Malware payload (RemoteX)", "value": "1dcab6f5621e7c3b7096bf817bf5ba5b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984969, "uuid": "3d8429a8-1758-4dc5-964a-29756361c81f", "comment": "Malware payload (RemoteX)", "value": "faad7b41abeef3da7099a6815d7799c647108a13d2fc397ab2ee468899c8a5c4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984969, "uuid": "794c2bf3-ac2a-4e15-898b-57ac6f2ebf95", "comment": "Malware payload (RemoteX)", "value": "3038c746d4059f21c02b6ba0a3aa3a70ad1450ec", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784984969, "uuid": "5cbfb7e4-1c3a-4153-b6fa-fbc60edbca69", "comment": "Malware payload (RemoteX)", "value": "807239a75be348e14fa6e07121148731bdc26963de9a027f683afeeba11559bb68e77992105b75d1e71e7cccd985f33f", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984969, "uuid": "335b26bf-5428-434b-8779-a03593bb8394", "value": "T162F64A47E8A145E5C0AED175C6669212BB717C884F3063D72F90FB282F72BE0AE79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984969, "uuid": "4285dde2-9995-42cc-bd30-58fc2c348b09", "value": "bf3d0d0ac28688e113006e8b183acf31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984969, "uuid": "d0eea5ba-dda2-4fd4-84fd-1c5d44cd52e2", "value": "196608:mb43gAW8t4nFnCBQ9UJB0HXZ97MUsJ1Ve:m03gAW8CFqQ9Su7MUs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784984969, "uuid": "487363db-0047-41e4-8705-487fbb303679", "value": 16446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784984969, "uuid": "df244228-16ad-4a36-acea-99a701187e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784984969, "uuid": "533156ee-614e-4638-94ae-4365a0589ab9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c05eee-8827-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784983929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983929, "uuid": "168f9d7b-09ca-4c19-9972-2289d515de3a", "comment": "Malware payload (Efimer)", "value": "c861ff93e1836ff9b0117fdf0960698d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983929, "uuid": "aca7faa2-a09b-4037-841e-8be81b02c4a3", "comment": "Malware payload (Efimer)", "value": "fb161cc64fab576a19e3ccc99bcaf69b3960ab8929b0d636061514d7cdf1b06a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983929, "uuid": "aaf73c1d-a5f7-4ca4-999e-2b83f23cdffd", "comment": "Malware payload (Efimer)", "value": "0ccc478b227e512c6f327564991b9809326de394", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784983929, "uuid": "d2cd45fe-c2ed-4996-b2c7-ffb4ac053d2b", "comment": "Malware payload (Efimer)", "value": "062970c81884b9540fcd2710bb489474a9ae16506001dd5af2218cde75d3dc12f640020aa159bbbcf7c19c640b148d55", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983929, "uuid": "efa04bd0-1a4d-4b37-b460-f8eab7df3370", "value": "T1AAE6330897F12BFEE9B3503DCD622255D82678760376C68B579483867E372A1CD3EA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983929, "uuid": "182d85c8-d412-442d-ab77-f92b609ae7e0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983929, "uuid": "54e257f6-b574-4310-b9c0-ed365da2ac13", "value": "393216:vHAUIItpysXv0y+TGmoIXMCHWUjX7cuI3/PGTAI:vHAgf0y+TGnIXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784983929, "uuid": "80cf0648-3512-402b-96c0-6071a3db1027", "value": 14285432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784983929, "uuid": "8a620f0c-c520-4b96-b1bd-038547a2c8cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784983929, "uuid": "886eb655-d9d6-4f9d-841f-83d3877e33d4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4794a24-885d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785007200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007200, "uuid": "e8170238-2161-4232-831b-59e5abe24584", "comment": "Malware payload", "value": "037e28e730a293fcb69c68bceac4bdb1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007200, "uuid": "db061a60-e31a-451c-9a52-db576317ab23", "comment": "Malware payload", "value": "fb2aca6aa66d3f3ac1f3df3f3d95a8bde050698e576404d5d5d9ec218407f86d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007200, "uuid": "e2d313e8-60d3-4639-bb9e-99f6165557d1", "comment": "Malware payload", "value": "6f2ebd1d9f5194252cd0417a1195cf5369f7b0a7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007200, "uuid": "fc1386d8-0e57-4a7c-8d3d-88a4ae90d0ef", "comment": "Malware payload", "value": "ce895bf18fd7c63c1f86d8b9a9b8ebb4f1173e40a951020c413d42f26010bd372c8a1138a1097cce237ed2dbec9cde94", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007200, "uuid": "7c424183-f729-4cdc-8868-e01d133560cd", "value": "T19F623C0AB4818035EBE144B4827F526645FEADB623C4F9CBF7E064CA5AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007200, "uuid": "a85863e8-526c-406e-beb8-707224c54974", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007200, "uuid": "b3c4a304-0981-4dd5-b612-256568f99325", "value": "192:AWdsGnjXgjk8LMRI+wBdzMtJFeIFFBKUSfEzQbd1gJxTmv8U9cthf9ik:AUSMycUlEOyav8U9clX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785007200, "uuid": "61e051f2-8903-4664-bfd7-02a2c691ea15", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785007200, "uuid": "5d76704d-eccd-4700-b352-d2a29b814521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007200, "uuid": "c202b159-2c99-4ac3-9136-18b5a65ca762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d17ec3-885e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785007370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007370, "uuid": "e1820d18-fef4-4eec-9118-108c18dfcc6b", "comment": "Malware payload", "value": "dfeeb80755e1ea1911232eacfe7dcc0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007370, "uuid": "30298861-95cc-44a3-b177-263188fd5f3f", "comment": "Malware payload", "value": "fb4c3e7dc26b98030ee6f118356105780a293aff695652df6edd3f1058cc5d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007370, "uuid": "e140fe9d-8622-40f1-a010-72fa8a081363", "comment": "Malware payload", "value": "bd01100e2e3d5ad028806ca3bc70885442ddfb37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785007370, "uuid": "40a2bfe5-94e8-493b-833c-4079aebb6832", "comment": "Malware payload", "value": "44b271d83ddf1c922b81bc8fbdc82a4d8a6e563eaa6357c373926ca54f217e6e86cbc44cf3b82c1b6108c830dc3d073b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007370, "uuid": "f5b9edcd-6ca1-432e-b6fd-fb7ada33e2fb", "value": "T1C8065C85FC41CF52C9D03A7AFB6E828833130779C2EA70059D255B7467DF99A0F3AA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007370, "uuid": "595e1ba7-c1da-4572-a7c7-f6e09ed92abd", "value": "49152:k0QkUw6lt8SLNxTP55iPqE71SEA3omiCWfbplVH:/UpltxPTP55i3G4miCWTpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785007370, "uuid": "961c2494-f655-4a1a-b3b2-034950475908", "value": 3924792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785007370, "uuid": "798d2761-2d95-488b-be3f-29f9b89a1b5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785007370, "uuid": "b5cb6b37-768e-4bb4-ab91-7fd458bc4c18", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93684be5-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975308, "uuid": "a9ea26c4-b56f-43f3-82b4-25f8e90ed372", "comment": "Malware payload", "value": "44c53af6dc94c87249a87c1fc68794cd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975308, "uuid": "e966653e-0745-47f9-92e9-3a105e85dcea", "comment": "Malware payload", "value": "fbd9b413dbc148d5b65d4d5dd395e0e5ca382dd78f90be504056d85fd1615dce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975308, "uuid": "ca217166-6845-417e-8a88-0b689e2f2573", "comment": "Malware payload", "value": "985dd467c2932bf4038aa467d042cee4e8663991", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975308, "uuid": "bca47373-25ff-4b0b-8475-db9c62c6222e", "comment": "Malware payload", "value": "c3db202e29f86d7fc89f5a21fefdcf397e6694b0b041d92ffeada1c3319fe98ef602d3b62e3e8d0d882d448e009ff8cf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975308, "uuid": "862d05ed-e1c9-4149-8b97-ca6c2ed91e48", "value": "T1C1413B691640E159DCC0A1B6F338369C131FBEB480EC97174F1C3E180BAB97099032C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975308, "uuid": "7fd0167b-6850-4dc8-a28a-f6ccdcd16c41", "value": "24:9mv5LxmdNZnwiuNw4jPZa/I0FqfVwdaf+8D7/QT+0x0ou5Gy0Y6a0Rd32keZm/TY:9myN3KP0vqfVwUW8np0K+yrfZiGHbLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975308, "uuid": "5e2e7699-80e7-41b3-8e2a-c002b29c7e87", "value": 1936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975308, "uuid": "d8e09d5f-f937-413a-b698-58da7972a9a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975308, "uuid": "80fb784b-6a0c-4fcd-8c73-b7871bd52678", "value": "images_20260724_224254.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a05d73-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974696, "uuid": "585edece-3dc5-421f-87e3-c35270b78773", "comment": "Malware payload", "value": "096102dcce13d83b8695add2f1e5cab9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974696, "uuid": "d87c250f-9063-49d5-9aab-9cd223b7d553", "comment": "Malware payload", "value": "fbdfbae230e6b08f49dde9c7e208700ead780a4415d2a47b96437dba152ee110", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974696, "uuid": "f8f25aac-f999-48e9-a88e-0ea341156046", "comment": "Malware payload", "value": "73fe5a814a739f791d68927e3fd6a3fd4c16ce64", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974696, "uuid": "88f0cba6-2b97-4814-90e8-a7aeaab64265", "comment": "Malware payload", "value": "04582aaafd223b0d9f9944e9b6406ddb3a3fc7f3fb19e0fe9e6d37274ed6dbc365409c0b38b9584c1c5c08f4db83723d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974696, "uuid": "82cc1c15-a683-4bdd-a77d-17c537b72a22", "value": "T19D62D01E9FEADD1FC101BC786FF31BF5469C4F8D89413B81828C34618E5616A4E26A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974696, "uuid": "8d533c68-340d-44b1-a688-d6de22225d82", "value": "384:GWNYPEt6yYnfvJ29jTwO79wazYQTm8JUw0Y2I70sl6iUqA:XKb3vJ2jP9TRCn5s6iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974696, "uuid": "6bb7b8e1-370f-4b1c-bd5e-82870c4556f1", "value": 15505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974696, "uuid": "15e0af69-0dda-4f9b-bfe7-1370d31dfe03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974696, "uuid": "1663b8c8-afb6-469f-83f0-e7e209da492d", "value": "images_20260725_031740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05416df2-8810-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784973781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973781, "uuid": "11d050aa-9198-4eb4-b847-1d1785e19bd6", "comment": "Malware payload (SalatStealer)", "value": "fa80df233f896120abded61035b868ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973781, "uuid": "b8bc2a1e-4e8f-4e88-b98b-828d1262bce7", "comment": "Malware payload (SalatStealer)", "value": "fbf4ef28c4b49c6304d23a738afabf8981590eae8585834bf24e3c7e87163c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973781, "uuid": "8a15c1de-dec2-4414-9c8f-83900fbaebbf", "comment": "Malware payload (SalatStealer)", "value": "e63c4d2932bba77476fc82814d696bce1caf337d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784973781, "uuid": "bf863a5e-8807-4523-8657-8d61f0318878", "comment": "Malware payload (SalatStealer)", "value": "efa63371a65757cc099e28a2aa598d02efd61adced5d6698f625967d7481ea6fc66b3363b3376ec669747fb58c989f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973781, "uuid": "956364d1-9b09-4e4b-b4fd-a4ab5781354a", "value": "T1C8F533283FBC5A36D5B8EB76891028FF1D4A3D6F0D46B161A66CA706C4C6F7D500BB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973781, "uuid": "35dc1254-afac-4400-b952-a0a9567243fd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973781, "uuid": "e1a00e50-8de9-4f28-8b32-7bd5d39b72ed", "value": "98304:/xPTqowELnIRd9B9ARictG9Mf2t0vRmV:pPTqozURfBAicwQ1IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784973781, "uuid": "df98f506-7fbb-4400-bd79-4cb1952cc1f9", "value": 3587584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784973781, "uuid": "24ea7c58-c7fe-4439-be54-87c29fc8d922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784973781, "uuid": "9bf2d437-e592-42c6-a75f-749d6d98d2a4", "value": "877901a58750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570c3784-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974777, "uuid": "60f4af62-8e63-4694-aeac-7e7cf886b2a7", "comment": "Malware payload", "value": "c85ef51f9c0528dfb2edaa12aa784aa3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974777, "uuid": "00885525-007e-4bfe-aab1-c6dd8dca9eed", "comment": "Malware payload", "value": "fbf5bd493097f2202af7b1b2bfae3f7267a6f1b4e1da3036c495c805dda253c5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974777, "uuid": "ca9b692f-888f-4c59-97da-b8329b3557ae", "comment": "Malware payload", "value": "ae73ed8d8d4973c26cbe1c0719aec10ae1ca0518", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974777, "uuid": "e68bee97-9f42-4ea5-8528-0184ade95374", "comment": "Malware payload", "value": "97f3fb2c1ff72abea36f315282b03523d553c3aca2aaf487848a1edeed844b4c9eb024b4f6995ed3dcb82070aca97e19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974777, "uuid": "c1c2559b-39eb-4625-bf12-076f13265911", "value": "T1ABB19F33815634FECF53A63991EF57BE49855AE316DEC72634D84C390A029852006E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974777, "uuid": "367452bc-17c1-4277-8d81-bb841614b818", "value": "96:/mAVY2+hMo202xkp47yEGV1MvYANsjBulAHSNCuHv7/5Wqo7uvFz0GhpXO1VUMYD:/bPhod347yxvMvs9ulAiCUv0/MqGhSYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974777, "uuid": "d010bcd5-32e9-4cb0-90b3-584237b3ae58", "value": 5489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974777, "uuid": "cd071188-f77c-4cd4-898c-504dd1f950ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974777, "uuid": "6094f03d-e45c-4531-9cc5-3add1c0ffd3f", "value": "images_20260725_071430.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14415502-8821-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1784981108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981108, "uuid": "116c4cfb-21f1-40da-8e54-11b49807978c", "comment": "Malware payload (AnimateClipper)", "value": "79f30bbec34fbbd5fe391949dc6af0e0", "object_relation": "md5", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981108, "uuid": "9849fd3d-3619-4c5e-9e0f-1daa34462472", "comment": "Malware payload (AnimateClipper)", "value": "fcbc96043c0217e9b62e9329d6b98ecf5223ee0e3976ed5ac83c263428c2d947", "object_relation": "sha256", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981108, "uuid": "69d57ce4-8490-41ba-ad3b-5f18fa71f13a", "comment": "Malware payload (AnimateClipper)", "value": "e205f23f4b70e461008a7a42c34ee70637469bc3", "object_relation": "sha1", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784981108, "uuid": "0baf611e-0716-4a7d-9d83-815b8d1a8fa1", "comment": "Malware payload (AnimateClipper)", "value": "cdcf44fe93e646c579a4d611f8b16d00261a64b0bb6af5f69336a78890e81686c9b5c56adddffb038a1c2eb4244d29cc", "object_relation": "sha3-384", "Tag": [ { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981108, "uuid": "aa927d11-203f-4c95-92f7-03a99914e20c", "value": "T1BBE4748F416424F9D42462728339FB0E7BEDBCE69C9159EFEA1E3310E978448EC56136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981108, "uuid": "325db25a-9846-404f-a6b5-6615c975e368", "value": "12288:vn/4YDS2Du/eMQ4dmddqHTIjtCC6xkSlt1ka6JYiszjWzNettkEwrmZQaMHRQZlb:vn/4YDS2Du/eMQ4dmdMHTIjtCC6xkSld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784981108, "uuid": "7d49bf20-716f-4729-b74d-77a1fc471105", "value": 715040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784981108, "uuid": "b39aa269-7e77-4298-b338-11cbb60b7375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784981108, "uuid": "e095122f-480f-4e6d-b109-a384c8d21cbf", "value": "SecuriteInfo.com.Trojan.DownLoader49.57914.17966.9817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deaa16b-887d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785020611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785020611, "uuid": "ac043dc1-35fa-4f00-ae82-d3df7927a0ad", "comment": "Malware payload", "value": "b4bf72c31058da40e162ec2e1a567f14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785020611, "uuid": "acbb55e2-6fd0-45aa-8841-7b79b9c152a9", "comment": "Malware payload", "value": "fd0466080f4a0836beab8ddd824540dcf47a32e4f1cbc95274a455d18f3dfbf9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785020611, "uuid": "937bdaa9-9aee-4e4a-ab6b-d9309439ab64", "comment": "Malware payload", "value": "77c75c1b005d3f5a386deec95a671d529319b2f1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785020611, "uuid": "8539a569-6dba-4bb8-b244-147205b6f64a", "comment": "Malware payload", "value": "fd0b3d2a7cfb5888d16be2df1f87fb7691d7c3b44de246a02349b53f61689fd1cc46add42429e1942bbb81577b34b6f9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785020611, "uuid": "2bd8f6aa-16d8-474a-9291-319db8c1dc18", "value": "T141624C0BA4818035EBF14474827F526644FEACB623C5F9DBF7E0648A4AB46E1F43206F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785020611, "uuid": "e3559872-a8f4-4fe5-9c8a-ab3e9f99a8d4", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785020611, "uuid": "8fe97c6e-2c24-48be-ac37-9dfbb6cf64ba", "value": "192:AWAsGnjXgjk8LcRI+gRdjMBIfeF5oIV1BKUSfEzQLd1gJxTmv8U9cthN9ik:AFScSxferoFE+yav8U9cnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785020611, "uuid": "ee1e93ec-8039-4fab-a8f5-790837afa737", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785020611, "uuid": "cb07daf1-39c2-4306-999c-3ae85a593ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785020611, "uuid": "f53d9cf6-6538-4bc0-a54a-af90b5673bbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389dde18-8812-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784974726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974726, "uuid": "0e410fd6-34e8-466c-930f-56e4698bae74", "comment": "Malware payload", "value": "afa1f766eae012853ff973b4866da32e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974726, "uuid": "202a300e-8857-4320-a514-6db7a4deaf9f", "comment": "Malware payload", "value": "fd1e60c9166dc4afa0a664cb768ce032d73f4965dacec8c37c660f646b077ca4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974726, "uuid": "fe7decce-bc90-4164-bb2b-b4ae468bd8e4", "comment": "Malware payload", "value": "c3b5caae8fae7ef2f7c5c71a88bf90d926792316", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784974726, "uuid": "e971b09c-fb44-4e7f-b34f-3b9377fbc0a8", "comment": "Malware payload", "value": "778a5a453b0617eddf997d2d78dab652ef84fee7cc4c0fc1a14951f9c28acf7e677bdf68f101f3175ec7c7a246dbd5c8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974726, "uuid": "0167d7bd-e7ef-41b3-9a45-23eef5d59f39", "value": "T1F6817EAE572CE86BD731B2BDF29FF6450154B9B81425147973022E7276392062FC50DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974726, "uuid": "55aa6eda-433c-4713-911a-e265631a1a48", "value": "96:VZcWDwO54i10d38siyn+ebiiMFwJVN6+mnSJzLw5:VZn71K6y+4i9WLmS1w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784974726, "uuid": "ea4eb085-8ec0-4beb-b455-932b4597175b", "value": 4166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784974726, "uuid": "10ea59bc-0238-4dcd-9ab0-5e3886d7f26e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784974726, "uuid": "59ebff94-37c6-4346-88da-f1051d2649df", "value": "images_20260724_132414.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5d3ec1-87ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1784959512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959512, "uuid": "584cb560-db90-41e3-8f0d-c2048298b2b7", "comment": "Malware payload (ConnectWise)", "value": "731219563f05a61e639b645f4892d6cb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959512, "uuid": "0a20b100-b844-4a35-b825-a5caf85a9504", "comment": "Malware payload (ConnectWise)", "value": "fda5556e3fa55664509ab396469d00939b0ac6260d01c8cdfbde999ee3a9d0ab", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959512, "uuid": "579ae549-03fb-4821-83fe-5341ceab74eb", "comment": "Malware payload (ConnectWise)", "value": "812c33061b418ef74dc6be4522dc9d7f0efb284d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784959512, "uuid": "a988fc60-053f-4094-813e-194d418120eb", "comment": "Malware payload (ConnectWise)", "value": "5eac4554e93076108264539d84f37371315001d9244a2b2d39de128973ac1d757ea0cbd28def68e856431d4754721530", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959512, "uuid": "39c0aeb5-b178-413e-89b1-cdc319daf54b", "value": "T17346E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959512, "uuid": "b1d74e22-3902-4cd0-bc67-e2d262a616f4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959512, "uuid": "68049cdd-1ad6-431f-a59f-5250fd5b7c88", "value": "98304:czIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:chfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784959512, "uuid": "5bba35a2-edce-4d87-9e6a-3cbfc6233101", "value": 5644104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784959512, "uuid": "58a6665c-7099-4275-b43a-6d254bafb75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784959512, "uuid": "514c350b-777c-42f9-bb58-02fcbbf86080", "value": "fda5556e3fa55664509ab396469d00939b0ac6260d01c8cdfbde999ee3a9d0ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8996479-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998644, "uuid": "9b050cfe-539b-40c9-bd5a-2dec9dd25134", "comment": "Malware payload (Mirai)", "value": "116804ec9a4042332231544a4b819eea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998644, "uuid": "95384f01-e807-4373-a601-e8dc2e012290", "comment": "Malware payload (Mirai)", "value": "fdd6e95f3377bb637cfa50598aa986982edc532f17c96e829ca81ce2cf2baa46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998644, "uuid": "88900752-3887-429f-905e-7a0c0de9e2e8", "comment": "Malware payload (Mirai)", "value": "e476a1ddb7ae29d7a2708925c9b21a347b91ce2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998644, "uuid": "49392852-169c-4d1c-844f-a9cf02f2ef49", "comment": "Malware payload (Mirai)", "value": "05c7d244cd2a46f55948ab7adbd3686d2a4af208506c764cb40ad35802e5941fcb7268bd337b4285dd1d77693cf6e9b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998644, "uuid": "c2e74bc8-37ea-46ce-951b-694714bbfd89", "value": "T1A333F14104952239C7B5A3FAC23746AB26E949BE74F7E556610D0A6C3CB21CB48FF90B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998644, "uuid": "a9a940bb-4ff8-4917-ba1a-02b98efb385e", "value": "1536:8yofFprq9m4Ko7juz0O+zkRH7RpDh9f03TUDjtL0:6Z4P60O+zkNpDnfgTUNL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998644, "uuid": "099f4a5c-be31-43a6-a480-8ca48eddfe10", "value": 52420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998644, "uuid": "d6c1d62e-8cff-4741-ae62-f908a0c61b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998644, "uuid": "1796c1b0-b056-4118-9124-3cbff71344f3", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0551984e-883d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784993108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993108, "uuid": "0a218c7b-2caf-4ff8-a355-5f34b4341ee1", "comment": "Malware payload (Mirai)", "value": "bf15538b132f3f581214898f50ba30f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993108, "uuid": "0e7b77ad-6321-4235-b327-2a5c9c5c8535", "comment": "Malware payload (Mirai)", "value": "fe733770fdf210191e7713d57de50d4f8ae1e5a8935c1bdd24adeec5938f3250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993108, "uuid": "d7fe1f5f-7f33-403f-a1ee-a546d6ec69df", "comment": "Malware payload (Mirai)", "value": "c487867d5a49ca6a8e5a725aa008bdb650a94f48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784993108, "uuid": "4f0fca07-6f22-48d3-bf77-c4ecd628604e", "comment": "Malware payload (Mirai)", "value": "cb0d69a6ae4dd5b86ce29d0f2ec1a9a7075cf50590c5d8f4282482472d550ce2451ee6431254a6e1d1d370ecb1729b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993108, "uuid": "94e66d33-047d-4cbc-8f82-659b92364988", "value": "T16B33020ED62644ACCE4CDFF7C18A7F3528C075D1135E9F5D53131960B63A28CA61D2A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993108, "uuid": "4545de6f-826d-4460-b00f-c832a9447b3b", "value": "768:u4ipTnIkhLCdKxSC6eLolRacJiX5pHp/PXhUJrwe3HJgryPpwFa1To0WtV:uR5nIWGsxSxhlHCfJXkrJHJgrACFaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784993108, "uuid": "1b958de0-0e8d-4d77-ac2d-4fd7da482b3b", "value": 53360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784993108, "uuid": "87edff5a-b52b-4188-a5bb-2a8d28c857bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784993108, "uuid": "2f88e814-582c-4780-99d6-ddc416b6d786", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4454ccf-8814-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975819, "uuid": "6f0315e0-2687-43a5-8395-9d4743f62d42", "comment": "Malware payload", "value": "63c4b5ef8f777b2db827cad9b9d22a23", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975819, "uuid": "5e56cda4-6889-4681-ac0b-cb88e4b1a8e5", "comment": "Malware payload", "value": "ff1d42c0674595a0d48f6ece5edf4f974985b354e1dcfe72814a04e176dc3685", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975819, "uuid": "b497707a-58c7-4c09-a59f-696e2142b755", "comment": "Malware payload", "value": "16f33de0e51872e32c5fa5345b11141b46499292", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975819, "uuid": "22b2c71d-c7b2-4c50-8eb1-d7c8e07d2c40", "comment": "Malware payload", "value": "8071a69a02a13cd935094b3482a688193f4e62c780dd6009144d0a02c0ced02696aeb8a06145e5db46544fc67a407277", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975819, "uuid": "075face0-1949-41f3-801b-41643f4a3837", "value": "T15542AF76041E49F4AABA97F1B89F2CD83EF37F01A4184713B91E0EC7113A81293621BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975819, "uuid": "ee87a61c-0dfb-4a83-912e-63bd38fdf2f8", "value": "384:Qf6MFiE4gSCvfDxjrUXvlvOWLRLxy66Ly:Aj8GSyxjQXdvbLjR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975819, "uuid": "e8b2c14e-8bcc-4a53-8101-05056e424e45", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975819, "uuid": "3e29aa39-cefa-4005-9d9f-5b1115c92598", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975819, "uuid": "326775f2-b4e6-4c4c-8452-e6d8f752ad40", "value": "images_20260725_015802.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff52cae-8849-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784998656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998656, "uuid": "5fec979c-361a-4f8f-9b62-14208bbe8855", "comment": "Malware payload (Mirai)", "value": "44b7b58590a28f5f7ac666fc7a6e2798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998656, "uuid": "41e3b060-f024-413c-bc00-8b0ecfc96257", "comment": "Malware payload (Mirai)", "value": "ffbfd13c46e2940bad1fb91a9ce11e282cdb4e22acd648e5fcdf13ac9b1ecd30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998656, "uuid": "68833b8a-965c-4d19-94e0-ad92f43a1d11", "comment": "Malware payload (Mirai)", "value": "61cbb608f971011a2e5a61173ae9f3cc7d9a46cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784998656, "uuid": "341d085d-a7b2-46c3-a2c5-d5dae7d2a604", "comment": "Malware payload (Mirai)", "value": "2508cb12dab75d0d4f96c937e67a07fa56ccfdf2b3f04b834da23bde43d1ffb3d1c0780d6c69605ac8ede26de39b5ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998656, "uuid": "d9cc4c1f-6e55-4772-82e4-0deb8f938034", "value": "T1D7B35CC5E243D0F9EC6605742136FB3BDE72E4BA1229DA43D3F89B66AC52681C40679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998656, "uuid": "fb5f4157-9c8a-4f47-9932-6572ccf16ae3", "value": "3072:jHgHynlsNpZEWPMwZ83h1VvP+S2NUsDMHmn6n8:TgHynmpZEWkH3hmfMHm68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784998656, "uuid": "64699f32-8831-4e3d-b02a-95836a15a52b", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784998656, "uuid": "57eff05a-6340-4b33-aa19-3bc01d1b0b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784998656, "uuid": "fe2669bc-b662-42b0-b29b-1b0ec517b341", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96011dbe-8813-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1784975312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975312, "uuid": "caa4d987-71b9-44e0-99bb-fd6d0e6de3d7", "comment": "Malware payload", "value": "58285442e844b89f209bfbd34679c35c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975312, "uuid": "db6b6ebe-7115-4bc0-9e81-9964e00afe13", "comment": "Malware payload", "value": "ffe3345c0fcb025ee2406c6e88ffa3dbccdfca716166d1af604753466bae772f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975312, "uuid": "4b5ac105-bac5-4fc4-99f2-e906be3ca96d", "comment": "Malware payload", "value": "2d5d639c6954e215023c2dc7d27508fd4b9c20c5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784975312, "uuid": "f377dbc6-7a54-45ec-be3b-1801b8b905e2", "comment": "Malware payload", "value": "14a6332ffd4783c88ef153bd62cdc82ee13e7e3a7d511d94db9104af42dbbcfaa3132672bdbb5e3f88fd088cb33bbc95", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975312, "uuid": "9664a772-e843-47e4-bfb0-6b4684d46611", "value": "T1C752D1B0C7999517FDD7075CB18B9C3B4E6A1E50842516EE110388FCB6ADFA5371D4C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975312, "uuid": "a0106f45-e451-4a92-a633-55ce3595fc1b", "value": "384:YYa4B0FCZ2S0TfpuCcnMXHDTcBzaeCXnWAVH82DkoLH817f6Ieh+l:la4iAB0zpuCcbzaeC3WA58fu817Sxh+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784975312, "uuid": "0d9cc139-0daa-4e46-8d13-264ce1f8589c", "value": 14440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784975312, "uuid": "b00a45c5-9d5d-4eb6-b9be-d930139972b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784975312, "uuid": "d8cd5e2e-350a-4270-ab88-c9ae453cd1e4", "value": "images_20260724_171802.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }