{ "Event": { "published": true, "date": "2025-11-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-17", "timestamp": 1763424181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f09ac378-ea66-4592-b293-3dc31b23f9de", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562f5b8c-c3da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763400296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763400296, "uuid": "a74e7dac-6fa0-40ed-bb08-4257eb32a504", "comment": "Malware payload (Mirai)", "value": "8321b5a7917def6535563d4d3db0e85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763400296, "uuid": "1d6a5a04-4b4e-43db-bbec-acd195e3fa21", "comment": "Malware payload (Mirai)", "value": "00a2258f554a66b35f5fb8cb9d13f8e41692ee22bc3d02aee28d56c9cb5bc139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763400296, "uuid": "5c395660-bf19-412c-8d4c-fe0a7597dd41", "comment": "Malware payload (Mirai)", "value": "02af1667fb1e5200bd7f14113ef158fb8d89e4b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763400296, "uuid": "5300fe15-e08c-4601-b64f-3e0b14b03142", "comment": "Malware payload (Mirai)", "value": "5d511f9b0ce1cfe3f8675bb4d0811414aa20971441ec040d5998e31bd7491db3f19002e568c98e6544cd4e36b782a6a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763400296, "uuid": "a3174c10-ad4e-4bc5-8a2c-a8374d15b350", "value": "T15E341906AB119FBBD85FCD7306F9CB1224CCF49216A5373A7174EA1CBA0A58709D3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763400296, "uuid": "19092d75-a5f3-4af9-88f2-0627f09ea0b7", "value": "3072:F3Okj93K87pj3ERHmuipB6K/ftus2XSDMXdAQoYJ2A:F3FJ39wHmu6sKgs2+MtAuJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763400296, "uuid": "35fa71e6-823c-4ba8-83ab-59fe91fbb695", "value": 232556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763400296, "uuid": "e9d0f3d8-2903-4364-9de2-52f0b2744856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763400296, "uuid": "41b1de34-a2be-49b5-950c-fb218d235db3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58be81f5-c3cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1763394287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763394287, "uuid": "7bc7f2d2-6ffc-4918-bb45-bbc06973e54a", "comment": "Malware payload (Blackmoon)", "value": "5634d595283ef66ccad61aced0b53082", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763394287, "uuid": "0a949535-34fb-43d6-88d8-8cb8d642bbab", "comment": "Malware payload (Blackmoon)", "value": "0259075adca93861dd02c548ece119844d3a790548e892be43d5a526690725cd", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763394287, "uuid": "9be1ca14-e55e-43c3-b50c-a1f060247060", "comment": "Malware payload (Blackmoon)", "value": "7bc3da45760ec23c794a13452f56730e677acc77", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763394287, "uuid": "c68e489f-5642-4fe9-9d79-bd85b4fa2d99", "comment": "Malware payload (Blackmoon)", "value": "b5f4cb79afe1afb4361a29f59e0d1c63d612feddec1ff378938c2a3d536e886bad5254296f794266ae061cecbf9ab8ef", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763394287, "uuid": "f6c60f75-1e0a-4f0c-aada-f87b89853d40", "value": "T1CD07332673F65D38F7DA9C312CFF026E3AA9E78F0E918415BD4D248C0B9915D2879623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763394287, "uuid": "a643749d-a478-4232-a4f4-1d9e39613bd9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763394287, "uuid": "3de12ad3-a454-4603-b6f2-52be1dd3e1dc", "value": "393216:ngu4NRRPHh20SbDLFoqtZx6foKhWup4l4ngBjB7giwwMImSd:gbRRPBMbfFZx6Av64l4ng3UiYIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763394287, "uuid": "764df98c-3a19-4756-b07a-d70e71e30e10", "value": 17723259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763394287, "uuid": "167f0302-5825-4198-b52f-22164069a450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763394287, "uuid": "8e642955-6c96-4ba8-858d-aa5aa2de74e5", "value": "Install1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da43fa8-c402-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417462, "uuid": "edd53c44-3854-4f3a-a6b0-dfc6c1ef7396", "comment": "Malware payload (Mirai)", "value": "df5f038e2612f426b8efe731888e58f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417462, "uuid": "bab2325c-fb98-4f5b-8635-b5efb15ec346", "comment": "Malware payload (Mirai)", "value": "02694ef03b07d173fcd9047b47935702c6137771dcfca956404575de87c11727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417462, "uuid": "28cc72b6-8dde-435b-9b09-b8f69e4b7b5d", "comment": "Malware payload (Mirai)", "value": "440ca26ff8ff0e91d6035953b981136a444d300b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417462, "uuid": "135d8d92-f050-4612-8b35-6059517741a1", "comment": "Malware payload (Mirai)", "value": "b57bef4bfc9b2c2954076792b802a06156158468a4cb7e08e1ea5f0de9fc5ee632244319e59fe66408d4a3a875bd0ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417462, "uuid": "7cc5c2f5-7353-4cc8-9062-6240e5a9dd2a", "value": "T1BEF2E174CA835DE9D7FA2E19BE1166E473618DBF87B14D86B325ED301851C321B48BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417462, "uuid": "d740496e-f9b1-4b6f-915f-9f603fe4f071", "value": "768:1YuyZ2aT3TxTT7hRelojVvgh9dvTsdGbwBJgNMUMj7gyDvjPOVSvrv4uVcqgw09M:CwKt7TRjVoL2PgWiyXGVST4u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417462, "uuid": "16ea5771-9764-41ea-9848-0848bb12f669", "value": 35756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417462, "uuid": "eeeac8da-58bb-41e6-a2d0-c845d52ac5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417462, "uuid": "e98ce973-9a7f-4c08-84b6-f96d7159b791", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d89b0a9-c402-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417434, "uuid": "6139eb24-242e-4a70-975d-7526241c44f2", "comment": "Malware payload (Mirai)", "value": "967ddb4539bcd60a36d5e428eafc1259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417434, "uuid": "a581624f-1032-487a-831b-1476ef0881f0", "comment": "Malware payload (Mirai)", "value": "02fac68739802cd2d1a14a0365414ccc1fc4d5dc6dd3c41a7a4af75e8c319b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417434, "uuid": "db0f4aa1-002d-40a4-a7c6-ddf0caa6a70a", "comment": "Malware payload (Mirai)", "value": "9257d93af5e221158e0d88c3b227c42acb800322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417434, "uuid": "cc4e4812-7194-42fc-8356-be2ae9942f0d", "comment": "Malware payload (Mirai)", "value": "f1298c8fbc395408ea340ae6ce7f31767b6ad99a588a4f3c33dd9a8756c3bf1315f9051e1163bc7c4666f488f0d0e9c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417434, "uuid": "414fbfb9-88ea-401a-ad55-6b55c6465d43", "value": "T17B834A41FC829613C9D512BAFA6E42CD372623E8E2DA3203DD215F217BC691F0D77A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417434, "uuid": "04cdf1c0-05d8-4d18-8bb5-b6bfd86dcf1c", "value": "1536:Ic2yZrIvcfoMWHllGkIERE9/JIOO9CkebGAQvfb:IZyZrRmXm9xc00fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417434, "uuid": "4ba7c019-f110-44b9-8917-ff1ac727ee6a", "value": 80908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417434, "uuid": "3897a148-358e-420a-b2fa-03b78328186a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417434, "uuid": "189b645d-e547-40fc-9d24-206ee7cb4da5", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e4bbff-c38c-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1763366949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366949, "uuid": "03a3f0a9-43e5-42c7-8356-cd30c0cf3192", "comment": "Malware payload (VIPKeylogger)", "value": "03f276f2e663e4580fa5bbebb65bd03c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366949, "uuid": "221402c5-aa77-43e1-9671-8f675ed9e419", "comment": "Malware payload (VIPKeylogger)", "value": "03034db898bb76e51b941005585251b64956ae5ff4ce2e55cbbdab9174e00a55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366949, "uuid": "534d6524-4cab-4309-a80b-2deb3fb5f21a", "comment": "Malware payload (VIPKeylogger)", "value": "6cc2c6128a404fcf1642bba11d79ebe749f5bb2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366949, "uuid": "871d37cf-c1d9-405c-9e51-64f869031950", "comment": "Malware payload (VIPKeylogger)", "value": "f2e7414abe33d287079bafed823b961dfc9ac8f140d42b7742642f4f9382db8f9f36e5fcb995307ff0bc5656df48fbeb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366949, "uuid": "0772565c-3a58-415d-8274-07f2f00715f1", "value": "T1C374C639A615CC47CE6B1F52F12686717063ED23F2730AA89221E8516D3D6EEBDDD80C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366949, "uuid": "947eb9ed-bbd1-41be-b9b5-7b80f5c38434", "value": "6144:CPHjQ1kZ8tcebFo4pgTMa7Y5mZcexuYL2G29MQ8Z:YHjQ1kZ8hFgga7UuiytQ8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366949, "uuid": "9026f9d4-0992-4d41-998e-b4da86ac7574", "value": 345938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366949, "uuid": "6b063550-1ee5-429a-aaf4-cafa78a3416d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366949, "uuid": "d9602eb0-d521-410e-9a09-dd1712d9c6fe", "value": "Th\u00f4ng b\u00e1o c\u1ee7a H\u0110\u0110T C\u00f4ng ty vi ph\u1ea1m thu\u1ebf qu\u00e1 m\u1ee9c Th\u00f4ng b\u00e1o s\u1ed1 10964001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6a9da1-c385-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763363885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363885, "uuid": "baa1281c-3457-4f8e-849b-90b0a284027b", "comment": "Malware payload (GoToResolve)", "value": "9eba2e78c3cd4af9ff228b31435b677f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363885, "uuid": "d98d2549-42fc-4cf0-84f1-ece1c0c3dd28", "comment": "Malware payload (GoToResolve)", "value": "048e043ba2b04954d5e8a203a068d0d78ecc51c39b95780a1716d00dec3f0ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363885, "uuid": "602d94a8-638b-4005-be90-2eb3ea2a4ab2", "comment": "Malware payload (GoToResolve)", "value": "d06e46086b60df2dc04950940705ffc23e9265ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363885, "uuid": "f23d3e59-4677-476f-923b-53bb915b0c2a", "comment": "Malware payload (GoToResolve)", "value": "1fdb32b7ba15ad5fc5bd6049be93d7405b1b80ed90847318b8098f9d2367fac92a27a91b901f6ad7c9ff8b651231ab0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363885, "uuid": "dc49aa8f-d648-4d78-b9c2-ec92cb10694f", "value": "T165373321B155C032D85221F2A928BFBBA69D98344B7119D773EC5F299B301C33B36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363885, "uuid": "d04abb8a-efa8-47b4-bfaf-9f6fba7813c4", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363885, "uuid": "bccd3df5-1bf4-4dbb-b3f3-c529548bffd2", "value": "393216:fUCnUEBz6o1cXTQPw1OP15IP8EH5egBMYjZSteu26Gg8Lxiy8zgvXw1TT+WYi:hnUYSsPly887otT2zg1WvXw1TT+WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363885, "uuid": "12521ee1-7d60-4a42-b7ea-7f17c08a242e", "value": 24444392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363885, "uuid": "52599a09-a341-4445-871c-1f9270cb7e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363885, "uuid": "971f9837-ec3c-4e9b-9efe-e263146ebb1c", "value": "Contract11-25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f098d0-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763366426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366426, "uuid": "626591c6-29ca-4e42-a71b-31548d67ea60", "comment": "Malware payload", "value": "f3370345f3e747bef1274bce10e2064b", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366426, "uuid": "140e4110-6198-44c7-aef4-46bc5ce3628e", "comment": "Malware payload", "value": "0501889bf03e8049fba3315e2b8cda1ed4bb04ac433755765663e803e9f84df4", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366426, "uuid": "1b146ecf-252d-4b4b-9387-638a2012bb74", "comment": "Malware payload", "value": "46835285b77ad2a1def8a44695b3fdee73e9eb69", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366426, "uuid": "3250db3f-46c4-44cc-b0f0-8b68032fdffb", "comment": "Malware payload", "value": "5efedccaf94868b2b2159a6d11da89c6597b334a0f76be9ab7973631cd7fa2dd360a7269b92b25618ad65c1528ce42fa", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366426, "uuid": "722ef2be-0524-4013-af46-bde80dc05397", "value": "T1B3D4223759C4BE3DD04DFAF36457B270B2A1AE8644B170652A2783EC2E5298C2C564FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366426, "uuid": "535d7b00-4361-4945-a8ac-51a315dc596a", "value": "12288:YiUbARhuYIlPCBRVgpxGT6nI8NlpTxGL5FXyIv8ESxSy7ZqcCZ/tEVOw3fChZ4:YFbqhuB1qQnICdxGFFXFULdbKI5Cr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366426, "uuid": "e3d73ebf-431f-4d07-ba35-3688e7ea5ba2", "value": 618720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366426, "uuid": "0cc6365f-1a42-476e-b230-b5f2d444c543", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366426, "uuid": "f53ea56a-f941-442f-8fd1-19458b053bfb", "value": "PurchaseXorderXVO-2025-1-003364XCECHO...docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce9e2bb-c3c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763390160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390160, "uuid": "0fedebcd-f3b9-45cc-ac58-fdaf85faddc0", "comment": "Malware payload", "value": "35e7f92d20ec322a7fb5f669761e261e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390160, "uuid": "f85988ee-d554-46aa-bcb3-39772d1c0030", "comment": "Malware payload", "value": "05f23e5c668c73128b6140b2d7265457ce334072a0b940141a839ec3e7234414", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390160, "uuid": "a70b220f-e7bf-4664-a2c0-ccab7092e940", "comment": "Malware payload", "value": "15189e2da0ec0e00d6700674f9adb89859da2985", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390160, "uuid": "8745c94f-24e3-4783-850d-b04b43d1ffe4", "comment": "Malware payload", "value": "bcfa708821f8abafa3f16477471bcfe0647e70fbd35a92c966c63854eddbcaffa43c484153241fb20782a49508f6a2f0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390160, "uuid": "e019cdc1-580c-4f90-b9c9-375736391611", "value": "T11B916CBB66F00883D880D035268E995BEA973922D31E16DABF5E380E52CD03C634C2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390160, "uuid": "ec5d9c89-b75a-4b8f-8794-066798167bb1", "value": "96:ZSoPV8/ILmzLFdH/FH7bSfDyMkUoDEB7rIKGJFDKcUd9TN:1V8/N3lbRUoUrvGYdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763390160, "uuid": "0c6a360f-04e3-4d78-acbf-8d55f07cc468", "value": 4206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763390160, "uuid": "a267f1fd-e055-4b1f-a447-d85434d89f57", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390160, "uuid": "c7699dda-a6b3-4267-8f16-f698a2004084", "value": "9_5_5_433_17.11.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ef771f-c401-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417153, "uuid": "d54bf966-1f70-493c-9815-85c8c58319f5", "comment": "Malware payload (Mirai)", "value": "a078fdf58d1d6bdd6acdf97b512b5bdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417153, "uuid": "15c2402e-7a1e-40eb-b24c-ce9b95b362b3", "comment": "Malware payload (Mirai)", "value": "0617315ba35de0d66665fc8001206d20d80060118b02b0aaee8ddbb3cd766c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417153, "uuid": "3aa14f13-b03b-409a-9a37-c60ccb770d17", "comment": "Malware payload (Mirai)", "value": "f777af0f89f17da4ae0a697c9ca7aa4a1e8afbd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417153, "uuid": "83f4b4b2-f066-4339-9403-a5c071eec617", "comment": "Malware payload (Mirai)", "value": "c07b536b54f2bb9f30ad518f7dc8c501a8f978e1ae96028df60f376beb20a634fe7b4e95a842d94d1b919a9dac989fc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417153, "uuid": "abb217fe-23b6-4cf9-a9c9-ac1a3d7374d8", "value": "T13B834BAAF800CD7DF84BDA7A44574A06B570A3E506830F37E3ABFD63AC721955813E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417153, "uuid": "bba5bb5d-4343-4aa9-a5d1-665680565953", "value": "1536:k8UntpZNYOuM018fymZMFtBtEwb0SYrLwYkNfv8NGmbTAydd+:k8UndtuM0kymZMF3JYrkYsKnAydd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417153, "uuid": "9084436f-e879-41ed-acb0-33bc7e5e56c2", "value": 82640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417153, "uuid": "1b86435f-6731-4cbc-8cf1-76ac88a3dfb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417153, "uuid": "ceaf80e8-2f9e-432c-819e-6f49fcc264d8", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd68d5b-c35b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763345712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345712, "uuid": "fc4d0fc6-aa30-4e3d-8740-2204e2389507", "comment": "Malware payload", "value": "c55c241bb871b4ca3f07981bb6f6493d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345712, "uuid": "a9771d58-ccd9-43c3-a6f8-ecc16fba59bf", "comment": "Malware payload", "value": "06eb4142f01e6982a0edc1e595c5d3109929f3f4019cb879f5382e77396b0413", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345712, "uuid": "3f2610ef-b88a-435f-b944-58c2055e77ef", "comment": "Malware payload", "value": "eff1e833fbcffed83e34119bec597c67bdd0efb0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345712, "uuid": "9460c1a1-2447-43fb-a1cf-f3e720fa92df", "comment": "Malware payload", "value": "c6216ed87f6c1fca21ae8748d8ba29b95f907a3fe4a634a0a9b039d297e6c684dfee7970f45a356c7a243bd511e37adb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345712, "uuid": "4fb85c71-46b1-48ae-8a97-07dbf33b6cdb", "value": "T17C17120AA8E48CF0C2599735A42FD0912A74FD514F9327E34B9433C82DA69E45F3DBDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345712, "uuid": "4dd8af72-983a-4ec3-bdd0-fb994cbb5ea5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345712, "uuid": "e27db6b4-8ccb-4480-be02-65790c69f329", "value": "49152:teBFR/2WqRW+sk9z5F1PKTQ+rKpZQvJjbBOJGomN5YjQ/2YLX5SFlmJS6DzJK7vG:tyJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763345712, "uuid": "a3a1db5c-514c-4f55-9ee6-5a5076bf85f8", "value": 19480648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763345712, "uuid": "2439eae1-07ef-458a-b3b7-27e2b0cfa347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345712, "uuid": "036f7196-189d-4c77-a2d2-d43a17627492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2688b4c5-c3a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763377453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377453, "uuid": "8507087d-0da7-479a-a99d-408d3f98d76f", "comment": "Malware payload (Mirai)", "value": "bf948916d3c273111918adc9f519db75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377453, "uuid": "4a58cb00-d4e1-40ae-8ce6-5895c745fc0e", "comment": "Malware payload (Mirai)", "value": "0739e0f0577c2bab82f79df50b5d0455070d060d717f6094aa370c4132d478be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377453, "uuid": "1a74c450-25a6-4759-ae63-571adc7f8de7", "comment": "Malware payload (Mirai)", "value": "f9a1fc042b59c4963324173d27ab0de1edc890fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377453, "uuid": "59ef2305-e98d-4fcf-ba8a-154ac7b48b19", "comment": "Malware payload (Mirai)", "value": "c17da33199f3241385f3051bd89d1aebda5b8286bfceb5b9d819209e1ac77af5ac11aaac28eed26e2243ce0d4df31721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377453, "uuid": "0f1f9794-9703-4dc4-8314-066ee46e441e", "value": "T1FF230205762CC941F096713E146A390E0F38E2A6F4E4EA9FBD94A5FD8B91E3F2064F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377453, "uuid": "dd5c2501-2ee8-4095-90de-ccfba9c64a96", "value": "768:yboxgTnApWmKwnarDd6uw2pi3nd47qC72AKnUE9BrRF0Ttl3ALfi+rmqw6HAiNnx:ysx3orDE2piXd4uCKAIUaYROmf5i5WDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377453, "uuid": "ae9672fe-591a-4b27-91cc-d56bed162e99", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377453, "uuid": "6778e6ef-4ef5-4c1e-8d05-f44c6a6b4080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377453, "uuid": "0cdeb40b-7770-4af1-9a4e-d937ed2ca9c7", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3f76be-c3b6-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763384712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384712, "uuid": "b3c4519b-e5b6-4fc8-b3d9-fe7b360cad38", "comment": "Malware payload (RedLineStealer)", "value": "33a7d58b594e5e02bd6aae3c7f9fa5e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384712, "uuid": "a6b77fe2-9b89-4535-9dfa-b3c354cc8fdf", "comment": "Malware payload (RedLineStealer)", "value": "0af0f0c75b075ed4a03bd7e281f5e6680a84e43d74259b8d58ff69c437388f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384712, "uuid": "b58a484c-274c-4e48-9028-070a09862424", "comment": "Malware payload (RedLineStealer)", "value": "1bf8c1d86a1bfd022ba5cbe7cc0a0b15c2432f6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384712, "uuid": "45fbcfb0-0979-461f-8c00-20157dfd1663", "comment": "Malware payload (RedLineStealer)", "value": "6356051d43372323c46bf5c2c31dc0cc1b500879a2fdfe957366f114bb9bb85943e5b937b7d41ff1f0803892248c0e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384712, "uuid": "5d33a215-9c0f-477e-b6bd-df4abf1d616e", "value": "T15445D01273DD8365C7B25273BA25BB01BEBB782506A1F56B2FD4093DF820122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384712, "uuid": "0236b94d-2c18-4f1f-899d-382a83f23ff7", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384712, "uuid": "eb655259-6601-4c76-9c38-f41d8972b9b7", "value": "24576:Ttb20pkaCqT5TBWgNQ7aA8zQyomU2a26L4Ax9f6A:QVg5tQ7aAHyjsbxV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763384712, "uuid": "63891935-e77a-433f-8623-eb1888bb24d9", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763384712, "uuid": "870d7e59-c0e7-4c43-9f6d-b4cbc4f05a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384712, "uuid": "f959371e-b164-490b-9ce0-54e92c0ede10", "value": "916400273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc7c1e6-c3b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763386080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386080, "uuid": "bc86b5cb-fbae-4bf4-8ed6-f6b8016d3eeb", "comment": "Malware payload (Formbook)", "value": "03b06b6da1e1c5a495436a2a5422b63a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386080, "uuid": "443dc888-83ff-4caf-8e8d-691a798d8120", "comment": "Malware payload (Formbook)", "value": "0e38340d38af31fc4586db05b626616b49721b99292e1d425f56363041b16ec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386080, "uuid": "e47d5ccc-c585-42c9-96bc-9dfefc6e19f4", "comment": "Malware payload (Formbook)", "value": "36de7b0b1fec12b4fd854e124b616ce94e4ec632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386080, "uuid": "dbd9faf3-1454-408c-92ef-067c3f47b915", "comment": "Malware payload (Formbook)", "value": "d43dd409c8740ce29517df937e3168d67f92eb30218a84657dffa41b6c78894d2486a5a39414a21ce17d04fcd7212016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386080, "uuid": "7214ef1c-4b59-41e3-9ef5-418a5b4aac8f", "value": "T17745CF2373DD8361C3B25273BA25B711BEBF782506A5F56B2FD8093DE820122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386080, "uuid": "b7c9ddc6-f5e4-4e0e-b82f-4829ed061298", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386080, "uuid": "3d2254cf-ee2c-44bf-ae77-01035c2546fa", "value": "24576:stb20pkaCqT5TBWgNQ7acc5TwIVXu/Aw+6A:VVg5tQ7acc5TwI0m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386080, "uuid": "7f777196-ce72-43f6-b5b4-dfb3fdf0bdc3", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386080, "uuid": "a3c924ed-45ee-4182-9c71-bd4d1a8f0581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386080, "uuid": "5330b60c-cdb2-43b7-8e78-355af718abcc", "value": "October statement of account..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7412eaec-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763387461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387461, "uuid": "3b19f39d-1586-44e3-b124-9455d2d982e0", "comment": "Malware payload", "value": "e5ca35a3e8de02995c96a2e8972efb23", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387461, "uuid": "7e8d44a4-4a55-4e3b-87a0-abb81732fab9", "comment": "Malware payload", "value": "0fb471c7e4fc6f7ac62a6be901f4f0a8c3cf2691210be2c00bfed94e2d874b2d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387461, "uuid": "89a74311-189d-4498-950b-9d4736a10997", "comment": "Malware payload", "value": "c43bb932b4565b12b7893379e075a78bcd681620", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387461, "uuid": "e0272576-833b-4c61-9333-48ad8151ecbc", "comment": "Malware payload", "value": "c9b07936cb9fc6376d28bd92aac57ee9cdcc5cf49de22cea4e0ba540b8ecb3a36866a856d04728ec28d3086198f59543", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387461, "uuid": "39542724-e664-4a18-be1b-cba249a22b37", "value": "T135372357BE86D4A9E95740F293D6C262642D42D8E80BD0AF0AF00BC65F71D4A0763FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387461, "uuid": "dce9b14c-3dec-469d-96a6-aeebf47b17a1", "value": "393216:gsWSrFpxSHJl2XaCA2m5fVidhWEQpOCj3Jj5V1lO44kjzAMroh8WDz:g7Srd2luBEdCQE5CDJb1lCkhWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387461, "uuid": "04a1096a-891e-4d4e-9134-db308a9320f1", "value": 22817668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387461, "uuid": "339ec867-1f35-4145-8e9b-8ab2a106abe6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387461, "uuid": "63eb5dbf-e893-465f-9a38-a53b36bbc7d3", "value": "0fb471c7e4fc6f7ac62a6be901f4f0a8c3cf2691210be2c00bfed94e2d874b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6b18c4-c3b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763383667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383667, "uuid": "e596d2b0-4207-4efa-8eca-14dd3cec722d", "comment": "Malware payload", "value": "950c5be36e97ab8f01e8bdadf36c67ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383667, "uuid": "38b85127-3fc6-4f98-8b60-1c590fc628df", "comment": "Malware payload", "value": "0ff46fefa2ad27bd0d858c5c8db59f20c723392559b9645c9c58e363675c2ee6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383667, "uuid": "17860d84-22f3-41f1-b42c-0f3c3ae7a752", "comment": "Malware payload", "value": "6f4818694b4927f47aca40b72a7076d5dfb3871c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383667, "uuid": "23c1c6a2-296a-4e57-aa43-18d2a5988958", "comment": "Malware payload", "value": "d27c0cd1b852608910c3d8d30799a2db2f8020f00810be614937ba046a7626452ff4715b2012c3ec780a133e95407bb3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383667, "uuid": "c2ea64af-6593-4009-8918-0f5b7d73e55c", "value": "T14736330D7574C4A2F4B74BF03CC95F269392A56B02B11E2B6B8E7C9449B9082ADF707D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383667, "uuid": "03ee7709-26c5-4116-bfbe-d732e1c42b0c", "value": "98304:VsZk9o3G2DXIlqeD2bZt6RUCSyhS8vxNNMmzEw6sdA6Vv9rQvGgh3dPz5nT:eZu6IlqeadjCfhrvx3tzEyA6VCGgLzJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763383667, "uuid": "06889b5d-9f0e-44dc-a03d-a5b2cda25c29", "value": 5088958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763383667, "uuid": "d579e1d1-a07f-40c7-a4aa-663bad1a7a7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383667, "uuid": "00d24959-13a1-47d9-bf3c-18fbf7f04fe7", "value": "luajit_mod.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedc4e8e-c3d3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763397438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397438, "uuid": "169e0c36-7be4-4564-bd18-0136ae022cce", "comment": "Malware payload", "value": "f47864b01b77f414e8d1f61c3e7457c2", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397438, "uuid": "e7974032-e8a7-4f63-8f19-7cf3a88d736e", "comment": "Malware payload", "value": "108b6645d86b0575e1dcd9cd0a35f77888243dc58e219cbaead8b48f76bdab6f", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397438, "uuid": "02396499-815e-413e-895d-3d80f0c517f7", "comment": "Malware payload", "value": "889ae3f07e64049eb703ee5d511ad2c2f4b04e17", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397438, "uuid": "3be46453-f741-4d52-8de3-3e7795b9bd1d", "comment": "Malware payload", "value": "678505408a3416c84a71684a29557abdbe4ba56833d567d2b53c3b14b3ee9ec2437752a4ef88c633af2e383cf7c930b0", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397438, "uuid": "edfc3a2f-1ae3-46f9-9166-2008e734f4b7", "value": "T13F01DBBE91A8895206B5C5C7B2B5814AC490508BE2FE5BE6F38D49336F66CCE3C5320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397438, "uuid": "f442e918-b919-44ec-94f7-571197b883b7", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+njRBk4Dplk4DsJB7ZhG+E6:FH8j/wWi2jznI8SX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763397438, "uuid": "21fc7543-b176-45d2-b1fa-fbe50bdcb482", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763397438, "uuid": "0828cfde-1847-429a-b6aa-875a739b1eee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397438, "uuid": "c03159f0-22ae-48e1-ae01-e300cd857a44", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116ea2cd-c409-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420367, "uuid": "45efa4f4-4c72-44e0-9269-80e56218f8b2", "comment": "Malware payload (Mirai)", "value": "7f11a3d17ae72ff470870013416484b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420367, "uuid": "2566f7a7-792a-4420-be3f-4441fbd923e4", "comment": "Malware payload (Mirai)", "value": "125e0b5ae5193b4c50d797e7e079833e78ca680f66dcc2484b8de8fd66ab792f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420367, "uuid": "262f07cc-f21d-49f1-92bd-288cd9f55f77", "comment": "Malware payload (Mirai)", "value": "99ae888f0eb95ead0870fbb7fb2fe1f54f0323d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420367, "uuid": "a899255a-60af-42ca-a609-79849ee7a292", "comment": "Malware payload (Mirai)", "value": "fedf567771ae25a63cc591bf4e47e71593c8015bf890aca9404ba78c4b2277084ba0f24f5a5a294bb148b20de5fe80c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420367, "uuid": "ada71188-deae-4096-b056-adb9d47bb5b7", "value": "T1D1231B41F31C0847C1B36EB13A3B1BD0E7ABAA921294E385761FE689E075E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420367, "uuid": "6931f0c2-1fdf-4cb7-82e0-155fdd0569be", "value": "768:0iJTirnjZNSAo0h3G+9v6rNq1ZbWklWPvmr3OFMRtDTOEGIO:zBirjk0ZjvyNKZbWkEP23vRRyEGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420367, "uuid": "28559045-8922-4239-9b93-8b35ddcfeaee", "value": 47336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420367, "uuid": "2d870a14-e6d5-46a5-bca3-8e54085695f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420367, "uuid": "8e7f96cb-ad86-43fc-bc60-b60580e7baee", "value": "wewe8.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b60567-c365-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763350068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350068, "uuid": "76681f4b-21b9-416c-9580-e8533259d84d", "comment": "Malware payload (Mirai)", "value": "404a6d013b50bfc6e23af6d4146681a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350068, "uuid": "41d9e8b9-0c17-404c-933c-5befa7dce3d1", "comment": "Malware payload (Mirai)", "value": "1299a84282f2f96e29acbe51f1822ba5860b14b4b61aae7b0cf0a045677413f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350068, "uuid": "d71bca86-46c6-4e03-9a74-300b79d1966f", "comment": "Malware payload (Mirai)", "value": "9d9be9842d4c07f473e78bd81aba9bccb980d582", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350068, "uuid": "55250520-6f61-4434-a764-d14555c91f2f", "comment": "Malware payload (Mirai)", "value": "2bedc2a752a6a0f40fc4afdfd5b94dee8e24f3b47434f24d80f1c854c637c6ee8294c233019a3d58c1ad46012c53c905", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350068, "uuid": "297de7c6-0dcd-4c23-80ff-a7f3a0847ef7", "value": "T16D23F17EF346DF3ECB73D570A10D0690FCB2126A8136AE19A7D156FCA876B511822F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350068, "uuid": "4930bc25-8d1d-439a-91b3-1a2992b60bd3", "value": "768:9/LCY1ScQ5D9FTs2SZX2kp6am0dHUd7fHrZWKm+CzNI2yHV1K+OcDlPGz0zyJQdn:BLCYW5hFTs2teQZ7PGI2y11ZND9dnoTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763350068, "uuid": "0cd66f4f-0497-4f1d-8749-60498fb7d0f1", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763350068, "uuid": "1934ae8b-08d4-46a4-a907-5305f4fc637a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350068, "uuid": "8f3f9b47-4c8b-4857-8054-2fbd8e50662a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3c8aa0-c39e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763374483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374483, "uuid": "296c3e44-d09f-4959-ab14-e0bdedb34d41", "comment": "Malware payload (AsyncRAT)", "value": "c524962469ef7a471c55dffca9307642", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374483, "uuid": "330b19a2-aba0-4ca9-9376-3f4b5c0a4918", "comment": "Malware payload (AsyncRAT)", "value": "1343042d33c90838d40d4c631272359db5f4154523590242400c7f6eba2cc27b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374483, "uuid": "0d615683-34f7-455d-bf59-0634fb80522f", "comment": "Malware payload (AsyncRAT)", "value": "f38b8ec6b351a5189e2c9f5b6659fba23be2f4aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374483, "uuid": "dc6e0a8d-4a75-487e-ad9e-4d6175a4dd21", "comment": "Malware payload (AsyncRAT)", "value": "540e2060a6156ee4941abb22cb9afd590acb975abeb1f88ba8f9e2c25a57b4081b0233bf5fddb83eec9e93983b59c778", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374483, "uuid": "6218674b-75e4-4529-80e6-72736dbe41cf", "value": "T1A1254294BECE4C5E9F181788927120087CA6AE42D49611ED9CB1EC3E3B4515339E7BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374483, "uuid": "3ddd82cd-4b91-4c44-afe5-8c5e992a2bcd", "value": "12288:UO8+dDFanIfcHdhE/1fsqTLKIl9Hh/0Vn/KZy9tCV223uLQPpp1uwH1KrGSl+W7t:UGa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374483, "uuid": "67d94d79-6d50-4d48-b816-407db1b343d1", "value": 971267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374483, "uuid": "5128b4f9-ac2a-4b4a-ba2c-4dcac002c8ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374483, "uuid": "0646329c-bf85-40d6-8519-6cad720d5308", "value": "forxdxd.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998c50fe-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763366479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366479, "uuid": "cb31214f-c4df-4ef0-8fbb-2ef9a3d48b58", "comment": "Malware payload (ConnectWise)", "value": "d6e8adba41457be218b3a65fd238910c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366479, "uuid": "7d66efe6-3dab-4d52-9ebf-f4e68f63a073", "comment": "Malware payload (ConnectWise)", "value": "14872d510a715a028e1520cc3ed9c758df17e3e38d5b6bd378641d5a380e19cf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366479, "uuid": "100a7acd-e961-4501-8fe8-34447c73d663", "comment": "Malware payload (ConnectWise)", "value": "06ad3dd6612423efd02ca692348a4223f7de5724", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366479, "uuid": "ab8addd1-67aa-4bef-a57a-a5999569f674", "comment": "Malware payload (ConnectWise)", "value": "017d4318554da461e8a969320e36fa6b6b8428c7d80b994b71b3459903f6099c317319bf6d0e4ccd434a7664c17ba59a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366479, "uuid": "17977cbc-cd7e-4ed2-9b43-d32dd74dcca8", "value": "T167D6231123FC0815F5B35B35ED7A92A1D83A7E65BE22D04E1760F81E2EB1D809E62773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366479, "uuid": "c605f8db-6872-41d1-ac35-b037d8a0e85d", "value": "393216:rxIQzck0xIQznxIQzlxIQzrxIQzLxIQz2xIQzP:JzGzVzjzJzpzIzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366479, "uuid": "7a468835-0170-4180-9a71-82270146274b", "value": 13447168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366479, "uuid": "39311e6c-7144-4738-b675-177657288d4f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366479, "uuid": "89eb7dda-d93b-4c50-abec-4d3ec783dd79", "value": "SecuriteInfo.com.Heur.15372.16091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d186fa4-c409-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420440, "uuid": "4ccb817f-0467-4d83-997c-e23d74a879f0", "comment": "Malware payload (Mirai)", "value": "1a949a189223f8a6463260358b07f002", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420440, "uuid": "87e13c65-0055-43c9-b36c-264a9c1c9bf7", "comment": "Malware payload (Mirai)", "value": "14bb590ff06dffc7d96389b8bbfbfcf7c197584dd0d1d8b1fc13a1512c483c68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420440, "uuid": "448f8be3-e3ef-421d-baa5-7abbc48a16c2", "comment": "Malware payload (Mirai)", "value": "b07b9c4b26a7d79adc20045d4d792e0d77e5cd81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420440, "uuid": "ef860ca4-9959-4edc-9529-44b522924fcb", "comment": "Malware payload (Mirai)", "value": "981327b1665e4a674961815ff06c010465aa7334b7723e3e8fce5404a8c0b07aa1c20351e85e72f2c042f81874fd50cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420440, "uuid": "4eb68b45-beec-449d-85d8-6d04e3a187c5", "value": "T19E231A85B981AA13CAD01677FF0E439D7B26679CE2ED3303D926AF50378B92B0D67111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420440, "uuid": "33f56fa7-b8c4-4401-8059-b6f846588069", "value": "768:pGNi8eWvZosIIS6h+scSeNtzCp2+QMyPnoHhSlwyafqa1sXcKI:18eWvZpIITcR/z4Fy/oomyaSaqcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420440, "uuid": "8d3f6fb2-8873-4c47-a6da-4e6ac7421559", "value": 47380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420440, "uuid": "0d0a6aaa-5297-4164-ade1-f6897bc2767a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420440, "uuid": "bc4ae34a-7a25-4851-9689-d766a5f113a7", "value": "wewe5.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abbb3bb-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763372869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372869, "uuid": "4aadebf2-aee1-4348-a775-2404921d6eb9", "comment": "Malware payload (QuasarRAT)", "value": "0d471895f808b9d3005ec6e06dc177d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372869, "uuid": "a5592531-7287-4a3e-91b3-0a1ffdbf1fdc", "comment": "Malware payload (QuasarRAT)", "value": "15119331f58db1c391df927fa73723c1d7ba66d46fe2aecf1526a117c5b59d05", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372869, "uuid": "4927bc09-0267-4996-a238-a1cc8a4b5625", "comment": "Malware payload (QuasarRAT)", "value": "0185472aaf6f6eb36b1617256a1e88104b19af9e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372869, "uuid": "6ce0f561-b87e-4aee-845d-11abc37c5140", "comment": "Malware payload (QuasarRAT)", "value": "6bdf7b18f001c36a908ad89a486c0419212649e54794a346bd058945cb76bb7a79be1c1d15c589c7ee8455800584a269", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372869, "uuid": "8a54de49-8021-487a-90f0-4c1fcb9f350e", "value": "T1E376F12AA14B123BE06F4D39156B55807C7B9F305C8A49E795B42988CF393D02D7FEA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372869, "uuid": "83a5a024-a4c2-4c5e-af7b-65b885a03a52", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372869, "uuid": "ef4fa069-8c27-47e3-bdca-ee5c5a494ca8", "value": "98304:qDb0R+0m+qA+6qoD3kg+rQwrHoerooyCG+TiOprd+uhWX4Yl:qDb08T+qA+tozk3rQwsxoE+i+ral", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372869, "uuid": "e581804e-dba7-4358-975d-5f2b09738c8c", "value": 7640393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372869, "uuid": "54bfbc12-8df9-48b1-aa6f-0dd8826bc457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372869, "uuid": "f1a40cc1-7829-4d5c-80d6-f3af82aeb315", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c309b7-c396-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763371069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371069, "uuid": "53abcd8e-e3c2-4aab-a109-659de33d02ad", "comment": "Malware payload (Mirai)", "value": "0802544a12d4c5698e159bfa842c0bbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371069, "uuid": "27748e38-b421-47ab-93b7-f4471a011222", "comment": "Malware payload (Mirai)", "value": "1535023b07365bd7319f4926aaa0e9d44d99ddb8967685030580058c3e14b3ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371069, "uuid": "5c616791-0b0f-4d15-b32c-a13c3aefd1cc", "comment": "Malware payload (Mirai)", "value": "3e8e96576eb032cb5824075727967b1c002a1098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371069, "uuid": "847374d0-1d90-46c3-8c69-2a777b104731", "comment": "Malware payload (Mirai)", "value": "a148164acfda2d2c13bc97b80fc4076ca5f9fa351e00e698b5846df8e62695885eb73c3df802b535be73ce607e4fc06e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371069, "uuid": "8ffe95c2-eda0-4bdd-8c6f-a1048a73b84f", "value": "T1671302E35EFF5608D92200F2BCAA3EFA31AA99AC5940369B778C607B5D1539513DC8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371069, "uuid": "de433985-99d7-40ed-b4d4-3fd63c71f3bd", "value": "768:Fc6VulOR90jHLUCNBwqw/CYrseFOBjIP6GNrGwj7vIXvFWQDV2nbcuyD7UoQRjk:FA4RuXEVseFOBjIPVNrGwXAFWQDMnouc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371069, "uuid": "5f2c83b7-c64c-484f-811e-95a9ee6c1d77", "value": 45096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371069, "uuid": "5826ca25-0343-452e-abda-347c4f5d8463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371069, "uuid": "15fabb3c-76a0-498f-ae1a-0efd7be44c13", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf8048f-c3d2-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763397006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397006, "uuid": "3e1d7251-039f-414d-a8c2-742171f42534", "comment": "Malware payload (RemcosRAT)", "value": "9de9be8df7cbcd89f03916ed816af789", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397006, "uuid": "5ec60a6e-ae9a-432b-8868-85a970b75027", "comment": "Malware payload (RemcosRAT)", "value": "163222800e8dcf38c0d10b89ba54f3bb566ddc0ea0063020d51b757585b14612", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397006, "uuid": "c8daaf71-195f-45f5-8ace-289a7beabf2a", "comment": "Malware payload (RemcosRAT)", "value": "3e998931f7f5a3c2786fea22cc88c75ee1873db7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397006, "uuid": "b5e3e0fb-ae96-4628-abd6-e1e7188ba2c7", "comment": "Malware payload (RemcosRAT)", "value": "0484092aa70d290fd6204fdc8896b18ffb7c2d1e12bae0b3be616b7531b641d3ce6e8054f055a48c4c54fee53975af18", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397006, "uuid": "d4252d53-7412-4a7d-8da7-1e167808fcc7", "value": "T1B1936BA0DEE52A394E4387E9BCD485728AFC8105552694FCFA89139D30039ECD7FE62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397006, "uuid": "a9793fad-d4b8-4cae-8db8-ed780d5edfc6", "value": "1536:sKyFWxZjaXxc39EHimRw5rdUspldP54r3EyX0V5676Wfh2MS:sKwWxZjaX239ECmR6dU+lFo3EI0GuWvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763397006, "uuid": "c50a99f1-f188-4b74-8aa4-1167a8da5140", "value": 90211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763397006, "uuid": "7589da1f-fa52-4203-a3c8-3265070750e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397006, "uuid": "6f0c9974-942a-4bf5-b914-52ae01bd7ff1", "value": "rPOTECNOVA-OLFAR145KVGIS-BAR29-REG_63826.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b34dfd0-c366-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763350510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350510, "uuid": "b7a273e5-91ca-424a-b513-b734b0fef3a3", "comment": "Malware payload (RedLineStealer)", "value": "7cd5bb42973c5fc4af34d55e6f07bd53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350510, "uuid": "0a284de5-c27c-4556-98cc-c06b54481c18", "comment": "Malware payload (RedLineStealer)", "value": "165dda92f3a40906d825fa4015280a0fbcea571a62614dbf8058951f2d8ef602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350510, "uuid": "0b14f46d-03da-4e3a-9812-7b088020afb4", "comment": "Malware payload (RedLineStealer)", "value": "8e9525a704e00c25ea346ab2b540f0f04416e331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350510, "uuid": "52d9b6e6-ff13-496e-a9c4-5867eece5b2a", "comment": "Malware payload (RedLineStealer)", "value": "90c3e2440ec73dcfc5c385524ba70cfbb6b2f21f6ab24ee49c70909f9e453dd3564eec4d0607cfb341e5f41cfc9c596e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350510, "uuid": "2f9993b1-6baf-4f56-a830-07f9b6c7ea6e", "value": "T1F055AE1273DD8260C6729233BA25B703AE7F7DA506E1F45F2FD4393DAA30161825E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350510, "uuid": "34dbad6a-85db-48a9-aa4b-5afe00ccda78", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350510, "uuid": "da149c79-a2d7-4f6c-9122-5262e95c8a57", "value": "24576:btb20pkaCqT5TBWgNQ7a6uNsDy+jbWZ4EGV6A:YVg5tQ7a6uNO/CZC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763350510, "uuid": "1364153a-a94c-4a4f-acf0-fb108b582e6c", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763350510, "uuid": "5bca176f-b71a-48fb-8a7d-021d45c9f146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350510, "uuid": "431383af-2d3a-42aa-9e59-88980c2b82ad", "value": "7492000953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1048da42-c3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763395884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395884, "uuid": "1e7fc3dd-9268-4b1c-bb79-315017c5c711", "comment": "Malware payload (Mirai)", "value": "740012e638c7dedad1d340792586ee7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395884, "uuid": "e1fb6b9d-0bc8-4789-add2-b6b43d1d1115", "comment": "Malware payload (Mirai)", "value": "166ce2f911f31b507297b11e4db601c8074b36e5f0f181bd9b3fd6e90b12cd11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395884, "uuid": "8fd2231b-5820-4bfb-96f5-87c993755317", "comment": "Malware payload (Mirai)", "value": "8778b40f20aeea066541f95e6a7f275b714f77ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395884, "uuid": "ea0fbcca-442d-482b-862c-5274e15f276c", "comment": "Malware payload (Mirai)", "value": "2cab104a1db4e9f6249d198a43a3c225c3d60be79e63fbe6d82be2647e099999d30241728fa364a2d019b77bdb831bc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763395884, "uuid": "4b0a38f8-6bfc-45ff-8845-3cc475f7c8da", "value": "T141636BC2E647D4B4F96602BD5137AB374632E6790228CB46CB3DBE359C23A02B75635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763395884, "uuid": "a371e093-c13a-466f-99ca-224140302cec", "value": "1536:7QpBpLgdpgpqpij7BcO4aP3jtmVtO6JFM01EoHxK76Fxk30S3iB6:7QpBpLmpgpqpWBcaQzOAp11HQeF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763395884, "uuid": "43cb1c1a-4a41-4892-941c-1b9419b4b348", "value": 69076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763395884, "uuid": "baa5f025-d2b8-4b32-916a-45fd154fdb99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763395884, "uuid": "0bb80fd4-3ca0-4ea9-9b96-9738cbe5993f", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c5f91a-c401-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763417212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417212, "uuid": "ea7a9a1d-0b34-4368-854c-3246b5f644c3", "comment": "Malware payload", "value": "70c86f2bcdd12ea4408c077383e711e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417212, "uuid": "94379e32-571a-4f78-8cac-3be0f441187f", "comment": "Malware payload", "value": "16d8dc0bb359acb95207e3f6678f86e7a88a9b9a27bddafb426b81e93f9db91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417212, "uuid": "c9dd9ca4-b075-4417-abbe-f4116d2066ae", "comment": "Malware payload", "value": "99fb92f6a0518d2bf32149534c3a3df22d682cf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417212, "uuid": "99baf757-9f14-4fa1-8dfe-6e2639974d53", "comment": "Malware payload", "value": "9b7752e6298ca183da2333754afa11fa3a591ad7e96ebd812b04af975debde4a41baffddcbff734a3866ee26095c7494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417212, "uuid": "69583d62-d9ea-4f41-bcec-c1793d47abf4", "value": "T14DB2E03066E225BDD635093DEA37DA8EB5D30B2030F67237193406A87B9147896B9282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417212, "uuid": "ae93e139-cc7f-4aae-8147-aa0bd5a68cd3", "value": "768:moWh8S0fMnBjuwhpgCelClNe2Y+JONASPYSs3Uoz8:mT6IB6wlw2Y+Jyuz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417212, "uuid": "6445487d-d36e-44dd-872f-f96f13d85354", "value": 25704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417212, "uuid": "e8f131c6-392c-4b4f-96f0-8f924e6ead7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417212, "uuid": "ed3b2545-eaba-49c3-875d-a2e5d5d6dae2", "value": "wewe4.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca36902-c3fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763415957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415957, "uuid": "370cc8a3-976a-4c69-9cd4-b39e89957616", "comment": "Malware payload (Mirai)", "value": "537d26d972639bc66fa50d36058bb3e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415957, "uuid": "18ec46fa-a2c9-43b7-a78e-bc2c27b11923", "comment": "Malware payload (Mirai)", "value": "1722e1c45b9505351948ded6293528b5baeeba06c892f13ba028e49fb0611797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415957, "uuid": "4ef63819-3c24-48c8-b99b-3df70cb2dc36", "comment": "Malware payload (Mirai)", "value": "4133094cdcd6e6ac697b594e96b52b5c15c0a2ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415957, "uuid": "56cf3208-83db-4d06-aaf1-6242009ec19a", "comment": "Malware payload (Mirai)", "value": "177fbc0699a3b54f5012210c67b3017acd4d1d80e85243f7b9eb168691b12d007b5d161f3d83ad4c07d0f9c26add8383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415957, "uuid": "a5636550-464a-4f72-86ea-8aa1b2fb0890", "value": "T1E0246386BFA03FFFD85ECD374295CB05129C890A1294BFB62A74D518B68B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415957, "uuid": "2d3d2568-b62f-4ae9-a60a-ea31a51fcf7d", "value": "1536:7BarQZskjlvuw1Sx6BTk3mhO4A5bDrnRtfQcL6xRen7hgWsEldNn5anPrQ:7B5ZsclvuheO4stfyRen7hRn58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763415957, "uuid": "a5974a12-8b2b-4f06-a82a-1bb6e193fae2", "value": 216696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763415957, "uuid": "5221163b-c543-48b1-a5ec-8173f9e7f1d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415957, "uuid": "4f0fac6d-252b-48dc-989b-139a64238fd8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceab05d7-c3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763393626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393626, "uuid": "3f912922-4589-4a0d-b2bf-41d5316c87a9", "comment": "Malware payload (MaskGramStealer)", "value": "97c764ac677d2c54a9a5b882bd4b39ed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393626, "uuid": "43a0bd8d-10f0-42ef-a4cc-a4ac4cb7048c", "comment": "Malware payload (MaskGramStealer)", "value": "17fb07ccb48466c67c97e5687fa753ec7d21be55f71bfe7bdba056c5972890dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393626, "uuid": "68232430-8c85-43a3-8c82-a5d25df1a677", "comment": "Malware payload (MaskGramStealer)", "value": "07f31abd0a375ab250726201016c880ec55f7752", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393626, "uuid": "63393ad2-ead9-4a7b-aff3-020be93cabbd", "comment": "Malware payload (MaskGramStealer)", "value": "bc769eb53d8dcd4b6875749f347739eba99e8d8e913ebdcb0463898ce94b169af2e89a893e2d94ca4cabb38f4ec92bc5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393626, "uuid": "6936b87c-8d10-499e-99d8-832a773dbd61", "value": "T1E1E533C3E5190233C9F06730A523A79507669DE1F222724E72FCBCED6BF73629612658", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393626, "uuid": "da00bfe6-660e-44e4-b700-f91e2e7a71e6", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393626, "uuid": "6d5d5036-64d6-4fea-a47f-8d426157699e", "value": "49152:8MYfeQb95uefqJscVDHg+ElFKoTRwugB00Q33QBllkfmfh9:wfHb9o7Jsgg3KCwB0NwXyOfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763393626, "uuid": "41b2e343-4382-4615-8718-8ac4e68ea5f9", "value": 3056720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763393626, "uuid": "44c28375-fb37-4611-a1b1-b59159403b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393626, "uuid": "7905ec40-3d7c-4601-ac89-280dac04083e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec8f6c2-c408-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420336, "uuid": "b6c57d92-20ac-4c51-8bd7-a199ab821d70", "comment": "Malware payload (Mirai)", "value": "2bd27d1c03dc0c62b9b434bfb528d2ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420336, "uuid": "7a427a9d-0704-46a0-ba45-e152be6b5f00", "comment": "Malware payload (Mirai)", "value": "1848310a2a8620ce9061d6a5dd4b8b47ae5c478a4bfc8ce236812c7a77598f3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420336, "uuid": "0d247718-9524-42fc-b984-805c49347a73", "comment": "Malware payload (Mirai)", "value": "f7063f7c669743037949f31b7c4ef0cd41d8e7b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420336, "uuid": "192bd01b-d59a-41ab-a3b5-4e950c7d66ae", "comment": "Malware payload (Mirai)", "value": "529448472ea62695e0925a37aac72f9b18f17c37259535a5eace51014645db409f6b9e313de6db9a8619870b999c31c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420336, "uuid": "06898d9d-fb56-4cfa-9ca8-0b053c6acd1c", "value": "T15D53F1664852A7FBDA24BDF1FB24C8CA093DEF3FF24A7C337221024D1D512251D986A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420336, "uuid": "5537914c-4f46-4934-bbdf-425f23c0f606", "value": "1536:6+5FZm0LvyBuMImif+L2MkNaRcuhufctAhZMyLTj6WZcN+uD7QNfYqTL7:6y7aujs2MkNRuhictweyLTmWZctD7Swc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420336, "uuid": "705fedfe-bf61-4cdc-8c5b-aa252a11b71f", "value": 62764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420336, "uuid": "6900ece6-4c1e-4d66-9d72-3ed73cabea9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420336, "uuid": "9c719342-ab36-4918-bb97-ae2193d063ee", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b36c512-c3f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763412652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412652, "uuid": "230d488b-8c11-490a-8d80-ccd4d7b93915", "comment": "Malware payload (Mirai)", "value": "9baf817a8c519d97dc13a16c3ccb3560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412652, "uuid": "3aa69c34-911a-4ccb-9d59-eefec11605ef", "comment": "Malware payload (Mirai)", "value": "186c6815d14dec2e9281bc4bb1aac9f7fc3c46f711fdad86c910dc3d6bfb1caa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412652, "uuid": "e22838bb-c66e-4d69-ba49-842202f66d52", "comment": "Malware payload (Mirai)", "value": "9ed9d2a33c943243f7ffbbe714a44965682b68bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412652, "uuid": "d16593e9-b9c6-45c3-a32e-31619ffa0ebb", "comment": "Malware payload (Mirai)", "value": "5b242b8e52f6b9acef3c1bc5c52ebe6d0885b3eaa749f50c748c046f86055a383c1e08d2480f2d76dbf7ac453a4330c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763412652, "uuid": "e4ceb8a4-a5d5-4ad5-be19-31c98b681e19", "value": "T12EC2E0ADE5602C6ACC4D1C7F91CC8BA45B4570B17147AE5CE39B48CBE4A896FF90D0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763412652, "uuid": "12ba26e9-d41d-428f-b802-3dda8748224e", "value": "384:ro9CADrIb2amwi2yDM3tYUAshSaJoG0mA09cSdfTtRWGVCz0Nv4A:ro9RrASDM3tYTIf8rSdfT7W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763412652, "uuid": "35d3c732-6a4e-42ce-b523-6cb0b018e29c", "value": 27504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763412652, "uuid": "22f5bedb-c7b3-470b-bbb6-470e3fec475e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763412652, "uuid": "8eced5ad-197d-4869-9abf-9ef71d7bd8f3", "value": "nigger", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f553e3-c40a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763420905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420905, "uuid": "3f8de2fb-0bcb-4459-8825-4f6e1ac5bda6", "comment": "Malware payload", "value": "86e39dda900f409feff1e07332593831", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420905, "uuid": "496ae844-9f79-4263-a717-25e140536b13", "comment": "Malware payload", "value": "18a5dd0c5419e04e4144062651b1d26fed402ba3df0d5f10e3f49f4bbf5842ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420905, "uuid": "cfb8fcfb-f7ef-4060-a629-86b20938bc42", "comment": "Malware payload", "value": "555db736b39da5b3d2fbb55632d5162798eb09b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420905, "uuid": "1264ac4e-4671-4b94-a9a5-fbd78967e4c8", "comment": "Malware payload", "value": "81d0160ffceee900c4336f623c7b5d6a7e91b90bd83731a4e916d6ea77e2ee431324196a2f1463b8639c050290d1f152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420905, "uuid": "d7b91565-2435-466e-821d-069b7c7dfbf9", "value": "T16D135B85AA83C4B1FC5220B2203797634A76E479593CFF26C7396935FC13A10A71B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420905, "uuid": "45b8a73f-c51a-4601-950f-3e0dbf3af815", "value": "768:wVFh0IjJAsa+tz9Hb1NR1hR/bio1NonED3VTlv8WaSpaIqE:e0IjJAsa+tzlL916ED5l3aSpaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420905, "uuid": "ba18daad-b058-46f0-8ca0-9b983438a2fa", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420905, "uuid": "249c41c3-b6dd-45e3-a827-dbff2c1dab79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420905, "uuid": "ec6e5400-3499-4c11-8280-01b78f09dd0c", "value": "wewe1.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2216aa68-c36a-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763352105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352105, "uuid": "a084bf25-d091-4a97-b832-3bb601b59961", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc5c369d1843c696324a760f5b5bdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352105, "uuid": "ea6e3c7c-616e-4564-96bd-387c834143ff", "comment": "Malware payload (SnakeKeylogger)", "value": "19256c68a35cd1da0d114ae05f2f126dcd118fcc05a9388b1e9d554e510d8e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352105, "uuid": "5919c460-5df3-485d-9f56-9d5e81f75474", "comment": "Malware payload (SnakeKeylogger)", "value": "2d1651929bf106082a45f68af14931275e6df20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352105, "uuid": "f5140501-7fe5-40f5-97bf-e294a92280a1", "comment": "Malware payload (SnakeKeylogger)", "value": "a3e34af37ae71bccf3a32a3cd3768fd8e387ba85d064d3c1e243264a46ba3579745d4e93b945d492335cfe37aba921e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352105, "uuid": "e308f157-fa35-49ea-8306-a7330f0b0243", "value": "T1CB76AE1893A500B5E82BD738CA65C333DAB0BDA24675D20F095DF6461F73A628F2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352105, "uuid": "b0efcbd9-94eb-48d6-922b-62bc0f6242c1", "value": "bf7449ae0b053c3629fa1a1b4b3b77cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352105, "uuid": "f3322e19-253a-4798-915b-dc0660d6cb9a", "value": "98304:Y76NmhMRO72SN3BPxX4yD3K3CC+Ki1/r69RU:Y76NmGRO72SVBPqyTK3lR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763352105, "uuid": "585eab0d-e4df-4141-9b12-689775703220", "value": 7256576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763352105, "uuid": "ee3f5217-f975-4b7d-bc7b-22248e11ee9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352105, "uuid": "af2987e1-58e5-42db-9d07-6b7697fbf129", "value": "MT SEA LADY 1 VSL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fff3bb-c3eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763407679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407679, "uuid": "b22ec1bc-1bed-4ab2-9fcd-b9be48d22b70", "comment": "Malware payload", "value": "020af94fb45abb8f50b8a9167ab408c3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407679, "uuid": "447720c0-c93b-4deb-8fe8-9fda677cdfad", "comment": "Malware payload", "value": "1a2c595d6107450c9bcb1f204b2791dc610565399511f9fb34975222fb53570a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407679, "uuid": "1523ac8e-8e7a-4cd4-a20e-964c7e739205", "comment": "Malware payload", "value": "716372e9b04acb364f615df4c796b7e8886cf414", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407679, "uuid": "0a22964a-9c5c-4baf-a97c-0a7dc20c827d", "comment": "Malware payload", "value": "086ac61bb90e2302ecb1a320c9acb98e3aeb597c133b922d025ebc56e67b0589aaa78cb0dbf74ca547015b77dd0788b3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763407679, "uuid": "65678667-ab43-4233-bda3-4b9ce3f5edc1", "value": "T14581CC1117EA021DE9B3AA366DFAB5519673FC26B9318A9E11CD020D0B33500EE21F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763407679, "uuid": "4cd06673-0b3e-4056-b102-45bce222483a", "value": "48:8gK461qZHiVXzQ1+xIG7avIKQjqW0OHALKl21tmw2fMIpfvU3Nx:8gl61qBgEtGVWW0OHALKl2+w2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763407679, "uuid": "376edebd-5892-42b5-82ee-98a5de62eaba", "value": 3939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763407679, "uuid": "7e734b29-9ceb-4706-8a84-ea8f050c26b8", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763407679, "uuid": "0647949f-5808-4ec8-9074-bb647922b69f", "value": "Mandatory Compliance Notice.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623a0380-c36c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763353072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353072, "uuid": "0695ed74-b457-41af-b54a-fa4cee917848", "comment": "Malware payload (Mirai)", "value": "f364b968dffd42f027e84619021a2e73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353072, "uuid": "0865b6e7-df90-4f9f-b1d7-1ce42b0fec9a", "comment": "Malware payload (Mirai)", "value": "1ac6df4215399c5924b037c22356f3120645e6e12b6b0b69908982e3cc364a56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353072, "uuid": "d85ded5e-4835-4fc7-81d9-7a88a0301808", "comment": "Malware payload (Mirai)", "value": "f4e6d8c65341431b0363fd05ce77787108b015fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353072, "uuid": "f303902b-1409-4f68-a36f-b288608c6b65", "comment": "Malware payload (Mirai)", "value": "e4e8b012f51b4604ab6748d47288c7a9097f9834cf154f85bbcb6a1569c0f8ed0262e376bd5d09a502fe390458ff1afc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353072, "uuid": "6aded55b-03db-4bf7-bc3c-086aadaaa1fc", "value": "T19133F1A8F1667946DDCC28736EDC4762EF403A81268F18351729E8887FB19C954DE83D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353072, "uuid": "4d038908-7352-4521-a839-91448163e6c3", "value": "1536:/YnbJZBHNddyaCdt4+/q5I8Ak02V8t2pHSC53:abLBHbydt3/ierF2IC53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763353072, "uuid": "4aea95c0-b2ec-4d45-84ca-027ddd9b61d2", "value": 50372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763353072, "uuid": "399d0c01-b74e-46d7-95bf-91d9d6141a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353072, "uuid": "5d188e44-b50b-41cc-b2d1-1c403ec08203", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda086d5-c38a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763366217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366217, "uuid": "c713557e-80e9-4c7b-83fd-7ed00fc97329", "comment": "Malware payload (QuasarRAT)", "value": "ddca881daa4af6f38e4a2e8894834369", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366217, "uuid": "5f2d5f1d-4bc9-4807-9e8f-f3a9ce2f77c3", "comment": "Malware payload (QuasarRAT)", "value": "1bba1bf5a4366bb6110c876c5b7747edf409b1cb6ac6e3b7dfadf98778d7a7fc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366217, "uuid": "0762f3c3-53b0-43b4-a2fe-2681e5cf6130", "comment": "Malware payload (QuasarRAT)", "value": "2e33bba05ed8628a08aad9fa635a10632a96e69d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366217, "uuid": "7841dad6-0691-4031-ad01-05b4fe280817", "comment": "Malware payload (QuasarRAT)", "value": "2af2937b393baf2ef63633873377de190242474a904ded8d763f775e068a92f9e842732dc6e5069e70261e328c99ead6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366217, "uuid": "4baead26-77f9-467a-ac09-1408153784b8", "value": "T1BFA5014F84021376266FA339E119C187B55E0FF25AEBFED618B6B3D9715891E80838DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366217, "uuid": "7db92307-bea2-47fc-b0d9-8870b44e9d8c", "value": "24576:rbSj7ETyhLL4c99IrbYeCFwi3caFscA581/7BiSeW1HBTSFC/N/mrEHSU3XbfWSc:KjmPrbYui3ZAWx9xGsNUk3lHLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366217, "uuid": "07c6a3d5-73a6-48fd-9814-9a07079dcb4a", "value": 2162413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366217, "uuid": "07cbf8fd-e2ae-4d0c-a6c0-deb456840f29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366217, "uuid": "2c52095a-1542-4ced-b717-073f512e8947", "value": "RuntimeBroker.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e6e344-c3f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763410286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410286, "uuid": "72e03fd2-d3cd-4ace-b031-3ce2ba508ba4", "comment": "Malware payload (Mirai)", "value": "f3612aff4da892b4ce5c6bd121d8e7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410286, "uuid": "d6239fee-b09f-43e4-9701-8614bd396508", "comment": "Malware payload (Mirai)", "value": "1dd78c6c21fc6c9362630d9934b680f6ab2bb230985b7a8f286be2a015cb4a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410286, "uuid": "86efc3c2-fb49-4081-8d66-548b858b539f", "comment": "Malware payload (Mirai)", "value": "6cf456bc1deb55c75ed13d2173a88521d041929a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410286, "uuid": "07de2266-4dfd-4b50-9fe0-775641ee355b", "comment": "Malware payload (Mirai)", "value": "02245a4c4610cc6d7547a4473690b7abdf7ebd70df81493774ff4a4d7c7e6d6c49edfa306ff2c4139d316b3a80039504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410286, "uuid": "1b4bcc16-2755-4112-8d82-77aaf9f7e4db", "value": "T1197349C5F643D4F0E8970470217BFB375B32E2BA0129EA47D7A9DA32EC62701A5066DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410286, "uuid": "d52882de-81b8-4827-a102-9902879167a6", "value": "1536:683XLx+fKMJTjenHtkuimdRIEMSYQGE7gYeX1MfrE19D/z1S7OA3jhGj:6SXLx+CMFjenHKuRdi5ZOheXOfY3xmlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763410286, "uuid": "e4f6cacc-0de6-41e4-bc68-8b316ae478d2", "value": 75412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763410286, "uuid": "bdc0d466-6765-4584-9256-f0c7522c3ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410286, "uuid": "309303b0-fb06-42fa-8aec-1a38f453cec1", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e719127-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763372929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372929, "uuid": "18a3cef7-aad4-47f7-8c8a-c5424ebf31bb", "comment": "Malware payload (SnakeKeylogger)", "value": "8e26ff6546b23c540db4b9afdf76fad2", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372929, "uuid": "6e3ca8b2-afce-4aca-823d-aa9040d07538", "comment": "Malware payload (SnakeKeylogger)", "value": "1e1efaf9a95e3f10ae880c4befbbacde3f7a78c68f19220ae068235aa5a9a598", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372929, "uuid": "233b1e00-afc2-40a0-8ac6-855f4298673c", "comment": "Malware payload (SnakeKeylogger)", "value": "d2067f1a600e01e24a8ef6e4dfcda91cc8102e61", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372929, "uuid": "1674684f-ac8d-48f2-92fa-a08c91562e8c", "comment": "Malware payload (SnakeKeylogger)", "value": "cf7c65de07349b03ddefd3962eed2405bde79c64092bc4c5e1f1df4dd27934cf3ca27cf8ecaa3f11bb7c27866b47183b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372929, "uuid": "21daa247-ceb3-440a-a992-b18ef0ac22a7", "value": "T17FC42361338CB95C872FDE24E3E614E5057980C5663E9F5EB8C36C437A60CAE5E106BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372929, "uuid": "f4f85238-5ede-4126-80e0-e4beeb529e65", "value": "12288:SLdrhpb69jrPKakMuSrp3woj8rZFbr6dlm6xI02S7V2xX8s84Alh:StQriakMu4j8rZRAlD32S7omr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372929, "uuid": "b16369a6-b0d5-467b-a5de-ff327446e685", "value": 575796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372929, "uuid": "c9c91299-56f5-4782-b648-1424283d913a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372929, "uuid": "aa8e9aed-2a3b-4429-a9e5-d89ece9ba15c", "value": "NEW ORDER-SUNNY 1000591600.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf0b250-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763387553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387553, "uuid": "f7bce664-9f87-47a4-b662-9400e5c0a645", "comment": "Malware payload (ValleyRAT)", "value": "f097c38f98cf668ef4c590edb672f453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387553, "uuid": "30215ee4-e143-4bb5-a4d6-df819264403f", "comment": "Malware payload (ValleyRAT)", "value": "1f8cdb119164550161cddba78f7d30f36cd3304dc4c127c37b15d3030b743b4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387553, "uuid": "ea147d91-51be-47bc-8dfd-1d3fe939d1b1", "comment": "Malware payload (ValleyRAT)", "value": "b263091bcc483c608ce0b69e61d488efe083e2bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387553, "uuid": "627a7b7b-980a-48c6-b703-6b5d0374aa3c", "comment": "Malware payload (ValleyRAT)", "value": "a01955f74a7d1d24276a89941d122613be39031e13d124553d6c03f82735a91f885209ebf700f7ec3ab81a269bb9aba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387553, "uuid": "313e2dd6-6e5e-48a1-b1ba-98f8329bda22", "value": "T18665AE591BA742A6DB557779C8A6A6A419190F431F28C0B21E304D1EBD2334FFC23EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387553, "uuid": "e8ee138a-9bdf-4443-80f5-e8b62d095273", "value": "fefd821843ecf2ad403b7097d109c058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387553, "uuid": "10835336-02a5-44b4-9643-fe65542f5bf2", "value": "24576:n39WkOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:39qHPkVOBTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387553, "uuid": "b60d225f-1b02-4dbf-8f3c-7b0d7507cdf9", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387553, "uuid": "bbec9df1-d87a-4d39-80c0-507c782dc548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387553, "uuid": "1d694a3e-0d17-432f-9464-ad34aacb6815", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0002a272-c39e-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763374382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374382, "uuid": "381affba-e151-41ca-b96c-2d9052b15812", "comment": "Malware payload (SnakeKeylogger)", "value": "1ead0476db433d1443fe34a7da951612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374382, "uuid": "7071e0dd-ecb4-4c86-bc64-41a956f98b41", "comment": "Malware payload (SnakeKeylogger)", "value": "20eee095c8bb6da31dedc339781c22b93df958f531f7f6f5793c2992d5f91376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374382, "uuid": "e0a764be-3ac2-4962-954f-ab2e145c7c01", "comment": "Malware payload (SnakeKeylogger)", "value": "7c7293b754c8ff0423b6dd97b8cc0f72bfd8ec44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374382, "uuid": "77ff0cab-2c4a-4d40-affc-1bf3c058a65d", "comment": "Malware payload (SnakeKeylogger)", "value": "595d5fa61a05263669b837616ff8855547b8ae590f4d871daf75a1176e05333f7332c492eab18587ffafd0ac6e8c1759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374382, "uuid": "1666302b-4d8c-4d97-9f41-d0dd8383b765", "value": "T12576AE1893A804B5E82BD738CA65C333CAB0BE965635D10F055DF6461F73EA28B2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374382, "uuid": "36fc88f9-768b-42b0-b62a-67e1bc8a0cbe", "value": "ca2ca158def4417eca14aca89ac6bdd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374382, "uuid": "4d9b5c21-8aee-4398-816c-bad0fd3c912d", "value": "49152:mHV/4pFCiPPWH33GOkGRPb98Zn582QPSIPm0I01HIMO8bStTEuMb5wekSkuuv8il:IMvPA1+ZQPSoi8bSlE3AEiD8+deWosp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374382, "uuid": "3295bb60-6833-4721-a427-f3f49fe90813", "value": 7260160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374382, "uuid": "0d43171c-bf5e-4a53-97ca-df0151de4ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374382, "uuid": "418dbf07-f06c-4df3-b155-b3db85f9102e", "value": "MT MARINE TIGER VSL INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551076d7-c362-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763348754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348754, "uuid": "13f364d2-8089-4aa4-98b1-5b0cf578f3dd", "comment": "Malware payload (Mirai)", "value": "e3896da17a3046db298069d42a60b0b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348754, "uuid": "1f6eafeb-7910-4dda-9bc8-6d2479e23345", "comment": "Malware payload (Mirai)", "value": "21fa41b3959064b5c7a96ee9b835b0425cb6aa7e1cc1ccc238914d6f1464f012", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348754, "uuid": "617922f7-9e2c-458c-bca7-14bf10868b56", "comment": "Malware payload (Mirai)", "value": "608afec48a844b0f0b7a05fa9288244814aecafe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348754, "uuid": "7365e9b8-053c-4f5d-84b5-45dd3956d613", "comment": "Malware payload (Mirai)", "value": "2dc07f8e1614f41e9c914a36980d4c81dd218e4b8480922598e1d575736dc04cededa7d69300bb2fffb350d092b5220a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763348754, "uuid": "4f83d16a-ee10-4784-94ae-1de5e438bd89", "value": "T1E22302D578D0AAD9ADE0487BE82CD2CFD392FDAC85FA3B074502C17442D9500E9BADD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763348754, "uuid": "7629ab91-04de-4878-9063-d9d7685adbca", "value": "768:RWc/UVZ8BQR79bHThxMjri5huBE1FRSCLvXAASiNeYdbMx/Gpb5xd/M2Xss3UozA:RH/UvYQvHThx2rimCRS0vmrpGpb5xW2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763348754, "uuid": "c581277d-bc68-4f76-81e1-ab6e45d1d5f1", "value": 47332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763348754, "uuid": "1048eee6-fe56-4fab-95e6-3395b28e43c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763348754, "uuid": "46f03da3-0578-42e8-b3ba-311402d691bb", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f933b4d4-c39d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763374370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374370, "uuid": "f65aaa96-129b-41a5-ab37-81353934752c", "comment": "Malware payload (AsyncRAT)", "value": "134bd2cef4b88fd28319a0c971165774", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374370, "uuid": "741dfa33-9b5a-427a-9620-4fb746bb8757", "comment": "Malware payload (AsyncRAT)", "value": "23a52dc9d245a74c08e21114079a39ceb9b583ca6f1a4bb58121dcbc799f0dee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374370, "uuid": "a2c9c318-4a46-4ed9-9bd5-300f763d10eb", "comment": "Malware payload (AsyncRAT)", "value": "812821d3084ffdf7930704c6af6eb2e0b321c598", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374370, "uuid": "d4234de4-9397-410d-9062-2e8b5fc512de", "comment": "Malware payload (AsyncRAT)", "value": "1519d2de5b930cc5fe7c001124e2f8b013164b303f695f7515eea1549656da114efd017019e6b51f8012ac3340ac71de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374370, "uuid": "7821ff20-03b1-448a-9f8f-2d980c25de21", "value": "T146156394BECE4C5E9F1516889271201C7CA5AE42C8AA01EE9C71EC3E37851523DE7BFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374370, "uuid": "b8f506bd-5502-49a3-a59d-2c32fa085f81", "value": "12288:NdydWED3tLONLcoucdSJ8Oc0mI/2f3GWYX7vBhUogqlNtH2hUdfWE5dWVXlZtgpc:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374370, "uuid": "dc92a126-6a7d-49ea-8714-c6794aacb3a7", "value": 878387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374370, "uuid": "24350de1-8486-4d19-a896-c9a0ed890050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374370, "uuid": "27209166-0904-448e-ad8b-feb664dee84c", "value": "forxdxdxdxdx.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962af5c7-c39c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763373775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373775, "uuid": "48954468-daea-4b61-bc93-b12e7b8289a0", "comment": "Malware payload (Mirai)", "value": "77f7737512c01110c77aebc555f62409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373775, "uuid": "12da3104-25c6-4323-9c80-dde814c8fb93", "comment": "Malware payload (Mirai)", "value": "23fa8bb9355902b0b4bf345280251729a4faa78dd926aabe18d32c2663e19c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373775, "uuid": "5037031e-144f-4f86-a95d-fb548b6c57ac", "comment": "Malware payload (Mirai)", "value": "bde901515988c14300b94e96eaf1b1f4fb65926b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373775, "uuid": "5e021ce5-f9f5-4938-babb-f17f508a1d35", "comment": "Malware payload (Mirai)", "value": "263a511579d413b1cdaa9b2046b704410a54e7cfa2b517bd97be48a55986d18bc9373384b01f33dbfeb23841478e54dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763373775, "uuid": "853cc18c-4875-4e08-98ce-60f5eb2692ed", "value": "T17FD2F146871F60B3D6229CBBC77CC947929D0730E1FCB6724529B4B0F4DE5467DA620A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763373775, "uuid": "d5a67099-3135-4d7a-9e52-6ffcb9170d02", "value": "768:Y9WDM7wKEl5K/ZF1epkEh0iCB1UIYs3Uozw:Y9W0bD1+0XUezw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763373775, "uuid": "cf3f31de-1d1e-4239-a011-df1867c94e26", "value": 31116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763373775, "uuid": "36ca6324-f721-4f77-b3c1-acf0f7bce4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763373775, "uuid": "7f426ae5-2506-45b5-a255-cc9772b4b516", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92705d06-c3b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763382358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382358, "uuid": "48702884-d03d-42b8-82e3-cb5194fc9452", "comment": "Malware payload (Formbook)", "value": "f9a86f729ab987e2122a456bcd1557fd", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382358, "uuid": "2396ffff-4217-4252-96c2-1a4222ae8844", "comment": "Malware payload (Formbook)", "value": "24faef9b4b18a915294b20b24c0929b2de083b44e01676ba0f6302462729f023", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382358, "uuid": "25a1d5e8-96a7-408c-9d77-0236265ec6f6", "comment": "Malware payload (Formbook)", "value": "2d250a1b099a38a19a2c288296f7ac4a874e2298", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382358, "uuid": "004fefdb-cde0-48b3-ba07-9462dd2f4f0a", "comment": "Malware payload (Formbook)", "value": "ec929b3bb9f07e5787b50be24161460a8594ec590e4d49664c36cae47ca9ee004522d9986d294d5d7d4e056948c58f90", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382358, "uuid": "eeea8c3a-a3e5-418c-9b06-84bef2f60c77", "value": "T12AF41286B67EEB13E0762FF059A0D27107B06E9EA421C6035EE62DCB74357504A82787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382358, "uuid": "c618a697-99ca-40d4-8be6-fc71d6050925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382358, "uuid": "5aef9da3-01c4-46ed-b5db-24d168823fab", "value": "12288:p11Qt2+PZF7Nb+HZDJZa3y+XOumwUtMcXhpSUE8RjIrBmIhdByhamtf/1P1ss+Jy:P2sdJk34tMmh8UECy9ByhLTsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763382358, "uuid": "7ce39922-1a49-4b34-b788-e23ae0a698c3", "value": 758792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763382358, "uuid": "a0bb7212-c553-4086-8406-806b23432b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382358, "uuid": "0e5b9c9c-439b-450d-b404-fc0d2c0e9935", "value": "TT COPY.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1cbe31-c373-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763356069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356069, "uuid": "84535936-c8a4-47a5-a490-f882dde16d0b", "comment": "Malware payload (Mirai)", "value": "1f25a5e7eab4eb198fdf0bc979940e45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356069, "uuid": "305602de-9fcc-437a-9461-4a3a16ca9d83", "comment": "Malware payload (Mirai)", "value": "25b7ec1b2927604b6943d5167b0d4518ee4ac8407d55c8b814bda4b7fbb8ccb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356069, "uuid": "ecf84af2-e9d3-49b0-8901-85ec248a8862", "comment": "Malware payload (Mirai)", "value": "9ca20384bc7925aca4ea85bc326cef11cab7c0c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356069, "uuid": "5d9cbdd6-e8f7-4192-ae2e-40044ac20fe7", "comment": "Malware payload (Mirai)", "value": "cc6a5267e9e2dadd99649920cd6e263c7f9619c7477a39f682819f52e6c3b5c0c61920438146a17e05aa3cd051fdda0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763356069, "uuid": "587e64a5-ec7a-40f2-89d4-9f6142c13e4b", "value": "T1DB23027AA20342FED5BDD6F8DFB4AF0207361A7B36868C57058DD193DD404A1C8AA933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763356069, "uuid": "2c27f3f8-78b4-435e-bdfe-86509b1ca503", "value": "768:PJleAAqyXWo2JUBBLszd4hrOJ89B95cInyQB0twAYiB3JXv5p1psNJgGlzDpbuRk:neRDpJszU/P5cIB0tNbpIVJua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763356069, "uuid": "1ebb71a3-dcb2-41e8-9266-f3c4a79e2250", "value": 48544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763356069, "uuid": "0c3bdf08-f38a-4c82-b521-db72311cbe85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763356069, "uuid": "3780d3ec-17fe-4640-a16e-5fcd0acae924", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87ccbbb-c397-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763371685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371685, "uuid": "8d48a901-55fa-4a4d-87d2-bc6631038e52", "comment": "Malware payload", "value": "da3003a742c7fb6a3808328955e0baa6", "object_relation": "md5", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "cryp", "colour": "#444930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "teddy", "colour": "#EAC105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371685, "uuid": "155b33e6-6de6-492b-9715-cec57d9da50a", "comment": "Malware payload", "value": "26dd39bf7a4927eb31c4c48f54822f5910a4604164c150fdf86b3bb9e7deada6", "object_relation": "sha256", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "cryp", "colour": "#444930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "teddy", "colour": "#EAC105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371685, "uuid": "837f1784-c34c-44f4-8160-f1f2480ecd9b", "comment": "Malware payload", "value": "8bfa1aba0ce6c77421bbe1bd1474080c41121615", "object_relation": "sha1", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "cryp", "colour": "#444930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "teddy", "colour": "#EAC105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371685, "uuid": "8e88aa19-de5b-4eda-8c05-4046e3a6ce5a", "comment": "Malware payload", "value": "5c854181523e123e3f4087195abe55aa7c2a1aff8ca61bfd228eba208f56e895be12d7171243776cce82a61ee8b4d365", "object_relation": "sha3-384", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "cryp", "colour": "#444930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spreader", "colour": "#BD03CD", "exportable": true, "hide_tag": false }, { "name": "teddy", "colour": "#EAC105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371685, "uuid": "fc43038b-d663-4f8b-a446-824c158777f0", "value": "T1F4359D9D726072DFC85BD472DEA81CA8FB5078BB831F5217902716AD9A4D89BCF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371685, "uuid": "bfa58fab-c60e-413c-bdf4-8facf0d53670", "value": "24576:UKojbM5WuEpqO+s0QxVXH9AXxTpRL5DpVfB:c451ET0QzgxTvLDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371685, "uuid": "5a5184c4-76ee-4ea5-b929-d47ff66bf7a2", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371685, "uuid": "7fc5bd28-6c01-4014-ab73-97af7f52f986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371685, "uuid": "c42c06b8-f5b1-4b48-99cd-4f73291c2e58", "value": "d4gubu.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd5f1a8-c393-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1763369679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369679, "uuid": "33d427eb-99ae-4429-b024-882b12a6e89c", "comment": "Malware payload (DCRat)", "value": "8ec24ffcddfd138c513450ded64bc919", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369679, "uuid": "10885aeb-d0a5-4a09-8ece-8f72ca56d653", "comment": "Malware payload (DCRat)", "value": "26e54c0973cd4de1ff00a250344618416034042479a306a337d5f9587cafaf4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369679, "uuid": "661642c2-2815-47b7-972a-8c6803505dd6", "comment": "Malware payload (DCRat)", "value": "0bf556e60f2b2fddbdf0ad36bf5ec1f0a49decea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369679, "uuid": "14247240-b06b-4c38-ae5e-ac734ddeb7cb", "comment": "Malware payload (DCRat)", "value": "106d155081b2211fe8f47ae0d8a97c772789f88a8376855f99befaa0ebfa92e8e12ccf3e32be1e61bcf068f6048c57bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369679, "uuid": "9a6ee100-1c78-451f-8f7c-7370de86bf7c", "value": "T1CC1485292B698E8EE5E94E37400AFE105A71FCC3DA737BC2178215D65B1AC0E5611FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369679, "uuid": "d5dbd0af-d29e-453a-992a-22a5617e0e49", "value": "3072:/cZwTWKh4xHCPIf4IlHZQ9bwJPNOAMABz6UlDRvz4tGlaq:Qtf4IpZQ9b6PNOAMArxDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763369679, "uuid": "869934c5-68c5-4b87-9e00-31b8016cb31e", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763369679, "uuid": "e5d77403-f70f-4996-9907-10c045d268f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369679, "uuid": "8addf89c-2faf-4050-a402-e6fbd7a3e035", "value": "svchost.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3897ad1a-c399-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763372329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372329, "uuid": "c1483e88-cae8-410a-b646-e24c1cd181fa", "comment": "Malware payload (Mirai)", "value": "4fc9482c83603cebe178300185baeb1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372329, "uuid": "7ee62b7f-63c2-4fcc-90a3-e34b20ce2195", "comment": "Malware payload (Mirai)", "value": "2b3d09d90f90ee2d4d159504811c43b26940aa95a3836f7131e07460089f31d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372329, "uuid": "fb31d56a-8959-48a9-b008-4cf07eace470", "comment": "Malware payload (Mirai)", "value": "026a0df9ed4171a53abd55aafcc9bf9a75bedce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372329, "uuid": "8cb40049-2f55-4ede-ab64-fcd313182057", "comment": "Malware payload (Mirai)", "value": "2ba0ef0ea2ab06e448db2363b4d9d72d9bb31342c6e7ea4484eb505c628a4790be0ad8e935959b753e7a7a4de9422e20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372329, "uuid": "bca4de9e-9b3e-4bb7-b846-53469f58d9eb", "value": "T1AC13F174D46B1E6DDEA9A9E01CDAC1F533221B8EEBB2AED500606F505380E38B65DCC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372329, "uuid": "dcd35618-4bc3-4b78-b006-b88fda619f6e", "value": "768:xFYfqSkXQDP7IBKkRVogBb6YLS0BLUp7SzTuw5PvR2slIXJlY24uVcqgw09b:xuYcP7wglzSUp7SV5PvYslmX4u+qgw0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372329, "uuid": "9dd3a154-7169-432b-8999-5f46320c63da", "value": 45220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372329, "uuid": "b692d1c7-6169-4d7d-b70f-bba160181ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372329, "uuid": "77e9bfef-33e1-446e-9873-33ce2b22974a", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cfbe35-c397-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763371486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371486, "uuid": "53ad371b-6e11-442c-bfdd-8d8eb3e8f5a8", "comment": "Malware payload", "value": "da82505206aa004fec24b5a53ec45737", "object_relation": "md5", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371486, "uuid": "370011b3-4ac7-4f2a-8751-eed6de851c4a", "comment": "Malware payload", "value": "2d02b3ac86bfc2db0e273ef22a7dada3ac24d1d33c71fe16b6f9734af02aff60", "object_relation": "sha256", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371486, "uuid": "d7cd9ffb-ba1f-4373-bf31-761b9deb7667", "comment": "Malware payload", "value": "88808d6a5237b91ffd79a504ca6771dcca895940", "object_relation": "sha1", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371486, "uuid": "810944d4-8069-4367-a0bc-e9f88e56a428", "comment": "Malware payload", "value": "ab5968b27d24da9a14ba67fa23240494b8a7c574777a7aee6ad47d2988733f3641cd721e5871c0605527ac1a2469c0a9", "object_relation": "sha3-384", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371486, "uuid": "7108cabd-d839-4d5c-8109-78be91e0cee0", "value": "T171130E9D726072DFC857C4729EA81DA8EA6174BB931F4207D41716AEEE4C897CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371486, "uuid": "6b9b500f-98c3-4b16-8e95-946e973d9d38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371486, "uuid": "34aae412-99c9-46cd-be8b-0a5087bae4ea", "value": "768:T12T811g8rrMAiqMgQu3hVb8KDpEuMfbOyllbxW:T1Oeg8rhiKhVb1Dp+fbOolI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371486, "uuid": "dea5e183-ee5c-4808-a328-c6f69d76c185", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371486, "uuid": "eb1e96c4-0a0c-40bc-8a1e-2d8b46b2ac76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371486, "uuid": "4b01777a-0c10-4b8a-a729-e853024b9a71", "value": "5atpvt.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656e5cb4-c3fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763415354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415354, "uuid": "922441ef-9267-40d2-9586-1fbda6a87b43", "comment": "Malware payload (Mirai)", "value": "5deb5d9dc725cf7d83dbac16bbf3cf87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415354, "uuid": "ca05ecca-2cf4-4e69-a10a-75fb8975bddf", "comment": "Malware payload (Mirai)", "value": "2d5cf936f86fdb1e9e349ed32dabae5d3c03b2c850133308bb3306199438c6c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415354, "uuid": "c5ca52f3-49ee-4561-b1a0-33005977f3c6", "comment": "Malware payload (Mirai)", "value": "39a4222fab43df16860c31410e57b7c206f18f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415354, "uuid": "482eeb9c-f65a-48fa-b50b-e078eb4a2761", "comment": "Malware payload (Mirai)", "value": "da1c97adb4b1a6ce8e6e37e031c1e47a81f668c94a28e6efe8ac65114c62858d3885183f089ba820c6a2e1f0aa452253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415354, "uuid": "a0c19917-b5a6-4bfa-b548-e7cb91b14242", "value": "T14D834B22FA361E27C0D0947631F74725B6F247DA22E8891A7D720E5EFF616402553EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415354, "uuid": "06e2c8ce-5dee-4bde-b381-efa869bb3a34", "value": "1536:RISph2dxjwOCl1rnkpD7YDD7D5gr0Yk53rKtN0d:RNqdV797YH80YU3rm0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763415354, "uuid": "c5fd1f90-7886-4998-b7d7-bccbe1984de9", "value": 83352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763415354, "uuid": "644c113a-8b0c-4dcf-8aae-6289d531f513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415354, "uuid": "c7dbd544-ec79-4add-801c-d2666210091f", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65862914-c362-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763348782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348782, "uuid": "591d0a2f-e518-4807-ae0f-b5314b87a975", "comment": "Malware payload (Mirai)", "value": "c81d041d7bafad45fca747b212bcff08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348782, "uuid": "26f59f6b-4f12-4cda-ab0d-afd0521b63a6", "comment": "Malware payload (Mirai)", "value": "2e8294c273ef3439dca626d5cbdd3d41061d7f79c9a727a5b013e893afd54241", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348782, "uuid": "9f897a99-3094-4da5-86c0-63b317ea71ca", "comment": "Malware payload (Mirai)", "value": "143df2d1c0afe587e35d2d3f4564f398ee7d7ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763348782, "uuid": "138d3d0c-5790-420e-b341-c66fc2db1508", "comment": "Malware payload (Mirai)", "value": "7699bb05ce568ff38cd41768dc6975ed340480a2967ce3d6a8628afb35f9a4bbb4bfb908c0877ef2e9ace98b9254c2d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763348782, "uuid": "ff775977-11d1-4ba6-9b2c-e73d9bf6db53", "value": "T1B7C33A81FCC28A62D6D722BAFA6E128E332163E4D3DE7203DE255F12378651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763348782, "uuid": "ea6a2689-23f0-4871-94d2-e40e2611f9f2", "value": "1536:AwOCsAPGyuaxMPZBuNYuLBPQYXzbbYFxe32swDbbXRB1yiihs//v2TI:AnCHGyuVZ3zFLrXRqpA2TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763348782, "uuid": "2dfda385-252b-4a0c-9dde-339bc56278bd", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763348782, "uuid": "0290b52e-ee9c-4740-8c2d-83e9cd052146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763348782, "uuid": "4383a1a4-9d06-4c73-8692-98e953c2e207", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8bcf44-c3ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763408870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763408870, "uuid": "e7fa8511-191e-4fcb-8e6b-babdb5ff5e62", "comment": "Malware payload (Formbook)", "value": "e42b2aa5c3b6070c7c08c77582bbae6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763408870, "uuid": "f96706ab-2b3a-4919-87bc-e759b1823217", "comment": "Malware payload (Formbook)", "value": "2f8abd167d4b6d610aa2b081e71309f312059ee7b7495cc847512be7b52f7c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763408870, "uuid": "3d18e892-049f-49c4-a157-d0c66f56c529", "comment": "Malware payload (Formbook)", "value": "b72d7d15885869dcb5f6cb2db697bbe852090bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763408870, "uuid": "c4e1e49f-0f8c-473d-ae93-0a94f8871eec", "comment": "Malware payload (Formbook)", "value": "811993d235e8b9ae5fc869df1cca59c30d30f0c6fdb24900503215ac1a1a1f8a66561def450a50756cbc90bfda1e4c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763408870, "uuid": "4b295f15-1526-4ea4-8155-fa2e4df4a37f", "value": "T12545CF1373DD8361C7B25273BA25B741AE7F782506A5F86B2FD8093DB820122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763408870, "uuid": "413f1bbe-56c8-479f-af3f-b31f4be0225d", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763408870, "uuid": "baea5a36-00c6-49e1-b88c-bf81236e0857", "value": "24576:3tb20pkaCqT5TBWgNQ7aEmQtH/srDtKXlA6A:0Vg5tQ7aEmQtHUsX+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763408870, "uuid": "c5901399-51c2-4057-93fd-323617e59633", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763408870, "uuid": "12798080-2e3a-41a1-97ea-7b0989b1b624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763408870, "uuid": "1645d5e2-e5e5-45b6-aa74-84220116180b", "value": "PURCHASE ORDER #998854777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17aec06b-c373-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763355953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763355953, "uuid": "6897d4f0-0f52-45c0-85ed-8945326e4701", "comment": "Malware payload (Mirai)", "value": "f572e074052b41e6923a9d2d52dba1d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763355953, "uuid": "d48c757a-69c4-4f90-ae8c-eccc1a5ae1dc", "comment": "Malware payload (Mirai)", "value": "2f8e94daf85fa0648f86d3fe078069a8ea53c41fb76f117068741d7680e0c5c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763355953, "uuid": "b6b40079-8a1c-41c8-ae1b-3288ecb045c5", "comment": "Malware payload (Mirai)", "value": "a52746d99a5b28b8165065747b2301a805708e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763355953, "uuid": "0a532577-f792-4ea1-bcb9-d84223e97f83", "comment": "Malware payload (Mirai)", "value": "4c8c693461431ca723b9a8a06d615a9397b5bc9a6e6efcfef1bc4b5d121bd166435d72191b3ef446487e16b69c515a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763355953, "uuid": "26cd5c51-0e23-41f1-8a0d-4fbc3ed4715c", "value": "T14E831A86BC819A17C6D452BBFB5E42CC332653E8D2DE3203DD156F157B8A82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763355953, "uuid": "df87f504-599d-490f-8d7c-941282a72e5c", "value": "1536:5El9QOy11xIe9dYuj3bMAlz5n9NFXy+gUTMPYopZBtN5EuybVR0k:5El9uoO3Nn3FXy+gUTMlBCuysk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763355953, "uuid": "4c6cbd00-f224-4c8e-8495-ebf6cd0bcba5", "value": 83108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763355953, "uuid": "3e920d05-fcc3-4b41-ba5e-dca1000b4a77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763355953, "uuid": "707c508d-3dc7-430c-b9f1-8d6c318d28bb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9278a36-c3b9-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1763386289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386289, "uuid": "14b09d26-783e-4057-82f9-cf8bb2d6a6a4", "comment": "Malware payload (GuLoader)", "value": "a79e4a1bf2a30a376d4402a2ace42b03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386289, "uuid": "e1cfacab-45a1-47c0-a297-334f9260f3f4", "comment": "Malware payload (GuLoader)", "value": "30029f21161015e2d21d53f3c62f19c46a8abd24fd72304ad97e50ce54d95efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386289, "uuid": "e45fd86f-2902-488f-b1d2-a34e54512467", "comment": "Malware payload (GuLoader)", "value": "2dbf0fef914464923a07463f62631625a90fd57b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386289, "uuid": "1757280e-76ea-4022-b540-4c8b47dd4145", "comment": "Malware payload (GuLoader)", "value": "b4bb81fb180e6957179dbc87f948025d9ab7e12c09201416aa93cfa2179a2d498a10e11b3676b673dcec96b29f9ff63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386289, "uuid": "682eb4e3-108e-4973-a64a-86f2ffd3a6e5", "value": "T1B8E406C2684087D5DC6BF2F2A4DA54380AD62CED91E51189AEF5725D04F1AFBCC2E93C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386289, "uuid": "59e7bf26-dd1f-47a1-a1f4-cfcecfad7822", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386289, "uuid": "73c25e19-2581-4a33-8300-4024fcbc6430", "value": "12288:UobLq6yJj7QvQPgYi4utsT+iC8a2BPzL5:fbLPyJj7QvQPgYi4utsTpJH7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386289, "uuid": "b2b039e8-614f-467d-a4b6-1f3b286220a9", "value": 683560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386289, "uuid": "dfb3c58a-2c0c-4e4e-85ac-dd6644ded9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386289, "uuid": "a5a7f950-d9d5-4566-b8ad-f0d26d1fef79", "value": "Opinionsdannere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58857583-c3f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763413614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413614, "uuid": "503c0992-ad4d-4412-a4f6-8c1e605f79f4", "comment": "Malware payload (Mirai)", "value": "458ba377d05a4bd6e9b4c710abc0713e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413614, "uuid": "2f605547-65c6-47bf-bee2-35dc04225ca7", "comment": "Malware payload (Mirai)", "value": "3102940043b8fe3ba6a2d04bdb8cf74fcbec4afbf334f5c31b423bf36e791f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413614, "uuid": "5be81505-4651-4505-b3f7-0ac15e871a62", "comment": "Malware payload (Mirai)", "value": "03badc572a5214e74f3cc1a006f73d283d7ccfaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413614, "uuid": "c25f3c42-2d0d-45f1-a08e-92a4853b1265", "comment": "Malware payload (Mirai)", "value": "b51691e9a278863b80d7f30bcc337950440104f73ef1642a85919e5299f65c6292e84c20fb93abbd1f89e3b6e079401c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763413614, "uuid": "3ee82488-1a33-45fb-ba0f-473600cd7f9f", "value": "T117F2F1A02ADE427AED5923B413CFA9FC84BD3C6A1E41EB939E17115ADDD31005431A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763413614, "uuid": "73122618-c58a-418c-aa64-27c2d1d078bb", "value": "768:daO5Dw3N33BkHUDXgDsFaQSxTtc4ixdbJzd/VvsENfrZWvjDDKzGjHwjJYZv:da8M3xaWg1ZxTtc4e7RJr0D0GMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763413614, "uuid": "00c3592c-6adb-4f07-9ba8-ae05278bb1aa", "value": 35128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763413614, "uuid": "ff8a0300-a54b-411a-b937-36308a88466e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763413614, "uuid": "af2ca981-742d-40b6-a85c-8c292fc03939", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58dbedd-c409-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420669, "uuid": "34072e7f-c552-499d-8fd5-9d67697fb910", "comment": "Malware payload (Mirai)", "value": "407d457d291aa4850dbc745939dfb2f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420669, "uuid": "2f7f3920-d95d-4bfd-8cf4-1dfeebfd48e2", "comment": "Malware payload (Mirai)", "value": "31d01aeb5912deb4909293f8869ce297ae4d9647c6afe7c2a02239db57062b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420669, "uuid": "71cbc76f-0699-4418-a091-cba10a020c0f", "comment": "Malware payload (Mirai)", "value": "edb6042a5f987154faac20aa015cbf06fb725c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420669, "uuid": "60276d91-2e53-4fba-bfaf-3cfd8befb274", "comment": "Malware payload (Mirai)", "value": "ea57a169acb57d2bbc520ed237fe0ba8b66300ef67d36a8bca6cfc8c4be129265eaf6892ace197bcd0b622305b559bce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420669, "uuid": "5c87b6d0-8fa8-4365-8e4f-48a53977d06a", "value": "T13FA3C61E6E219FBDF769863447B78F21975833D627E1C581E2ACD6001E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420669, "uuid": "31d39943-6a09-42a2-840b-75e91ec2a3f6", "value": "1536:9qo2S25LKp/ia6tZ3faZ9WzceaYC/LW/GEeFqufYoR:785Lg/iXfabWFaYC/LW+Iuf3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420669, "uuid": "efda6ea6-320b-40dd-a2fe-1d0f262d1194", "value": 101104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420669, "uuid": "b7599e0b-778e-46d3-8a19-a04aa8aaa023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420669, "uuid": "e620236a-33e6-4a72-9c66-740f0abb7eaa", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd186e8-c407-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763419794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419794, "uuid": "fe263d3a-e095-47e0-ab58-009ef5bcb48c", "comment": "Malware payload", "value": "623a6b5bc94001b8d7a27634a236201e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419794, "uuid": "5fdc4914-8a28-41b0-8c3a-681ab01c47c5", "comment": "Malware payload", "value": "31e262cb37dc0062209877ca7cc18fa53d5d4e131528b5645752259ef6a7b206", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419794, "uuid": "1a552220-3cf6-477e-85cd-873926de76f8", "comment": "Malware payload", "value": "b1fd1fcf1492e36b94fd7d39e606a81d1735cd10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419794, "uuid": "751bbe54-7bbc-45d5-b998-4a3fe3bc43c7", "comment": "Malware payload", "value": "7f3aef9875825b08ed9930e6e21195c27b184632c5a876521d6353609f4968a051873421cdc94b77d9c9570e4016de9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419794, "uuid": "c6388401-9ee7-4c10-a381-02f41e562d35", "value": "T12101A7FD93998A5305B9C9C5B2B18145C491506751EDA7E3F38E492A6F20ECE2C5320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419794, "uuid": "d6005873-b13c-48cc-b757-ee2fb5fb9688", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+tjRjk4DTjlk4DxTKRuOZhG+E6:FH8j/wWi2jzNGWSUKc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763419794, "uuid": "9e532fd8-4839-4cc1-bcfe-6a8e1335862f", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763419794, "uuid": "8902ba94-da13-4c88-97fa-2601274484a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419794, "uuid": "a52d9395-a030-4ac2-9e7c-dfc1aee5d723", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e0bdc2-c38e-11f0-a129-42010a9c0007", "comment": "Malware payload (HVNC)", "timestamp": 1763367734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "cf15f6ad-160e-4055-a0f7-84cc7ec39a2b", "comment": "Malware payload (HVNC)", "value": "22d8a4c1412c97cf8c88f1502ab31604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "d4dc9399-6380-4a1e-a4cd-84a191d0dc1d", "comment": "Malware payload (HVNC)", "value": "34abba43c4d6a7d81ae9d2f73f02d9483fd353b5a787fc90bdacba8e05e6f2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "62296f29-5c82-4bf2-a28d-ff66561ae2da", "comment": "Malware payload (HVNC)", "value": "a9424c2982834ca1a6258050e980c20e948f4128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "1bb5b241-a4d6-49ca-bf2d-c767c20bb88a", "comment": "Malware payload (HVNC)", "value": "935f18da5f0f8d660862636a238ec1f017925f6849e762da3ca71e3958379c878e295215711e0dfdf3bf679de5fb3bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "49ec4579-0df2-4c2b-85a7-1efbc0fd45e5", "value": "T176048C0A67E520A6E4B6577084F202935A35BCB36BB582FF57C0D57E0E236C4A931F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "1e090fe0-db70-47f5-bb36-da2c2a0c22e7", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "68ca3fe4-2949-4c13-aac6-eb7b7f776914", "value": "3072:qI+AGhAB2ubU41425GWp1icKAArDZz4N9GhbkrNEk1OT:8AGhAFQ3Qp0yN90QEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763367734, "uuid": "5daab09a-0220-4883-8bdb-52e9c5669728", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763367734, "uuid": "1194db6c-fea6-4cac-89d5-cdd2306d0024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "e775f754-6a03-4057-8ccd-3091b91a6e99", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c94f2d-c40c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763421938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421938, "uuid": "bfa850ef-2999-4ca4-bea1-743678444794", "comment": "Malware payload", "value": "cce0160662617b6fa13052c003fbf9b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421938, "uuid": "8456a891-4a39-4c9a-b6ef-75ff9093adc0", "comment": "Malware payload", "value": "34ef41ac4d4c6f5065e95e59afe2698604fccab401a67b49ca181e3265f526b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421938, "uuid": "d7b644e0-2d17-43d2-b4d9-329cba709772", "comment": "Malware payload", "value": "6b5cac7f23d7eb14791785015ce1cb4426083767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421938, "uuid": "4042dc5a-29ba-4637-b064-81f9aa87303f", "comment": "Malware payload", "value": "b373337215f55240a5fd33d460297b462fa1c5b0661a2ddce735d3658ae35930512d0324b10977a348635b101405eb29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421938, "uuid": "d278d9e1-7972-4700-86c8-59464e076fb4", "value": "T17CD45C7AB490D142F918C4B414E1AB2DF921B07286752AFF099091A3D95BAF08FD53FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421938, "uuid": "3e9e7b6e-b807-4723-af12-2ee722d893e0", "value": "006748064ae2ea0b7d198ab8c4d5aaa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421938, "uuid": "1bf42d16-bb33-459b-98d2-d22b623a9d8e", "value": "12288:E3QMO9+az7+lw7uEcj2s7NUbQaR4Zl5re/I/Bu48CXTq:4ZO9+az7+lw7uqs7NUb09q/c8GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763421938, "uuid": "dfdb1b0f-484e-4295-bc64-2271d84aaa58", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763421938, "uuid": "1f17aeb6-d9f7-4835-bc86-a19d9ad5d006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421938, "uuid": "32bfbe28-7a90-424b-b305-612d060fe7f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fa9e3b-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1763366360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366360, "uuid": "47784cce-1ba7-471b-a6a3-41405da63cdd", "comment": "Malware payload (a310Logger)", "value": "1bab866faef5beef81680fa51eac5f1b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366360, "uuid": "a9a5e927-d012-455a-8c34-80b1789deac0", "comment": "Malware payload (a310Logger)", "value": "360383e02bafafa7d8b9d0bdfaa23e0660fed9dbbce85587253f7ab82359897e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366360, "uuid": "1aead366-f46f-4e4f-b4c6-8df75bffb683", "comment": "Malware payload (a310Logger)", "value": "35c147207d7c4eee98dec001c85b08e1079ba972", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366360, "uuid": "8704600f-3cba-4e7d-b258-4f902c3000e9", "comment": "Malware payload (a310Logger)", "value": "c4d943cf5f52f2afaa98eee50ea926d254587fce25f544478620d5f7b50e64ec6109eb8e44b62657444a8d65ecec3e9d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366360, "uuid": "0573c16f-aa35-4697-9549-7df6b1c00e6e", "value": "T1B875CF12B2E04572C13769355C16A39E5529FEB02D74E8453AEC2F488FFB6603C2ADB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366360, "uuid": "5ab993ba-8e46-4477-bb46-e120bb0bbe99", "value": "825b81cbf84889d1f9a947979d8d2e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366360, "uuid": "25165a7b-19b4-466d-9143-fa86ad0cc585", "value": "24576:is2HDXNkMW1w+cVmtncbV4KhdRPt15BZFXU+fei3m/egnFvUIBrImtsKqGtzL:idM1q+m1DTeiYegDIqsSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366360, "uuid": "933e32df-bc5e-4381-a79e-5160495aa6b9", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366360, "uuid": "dcd2cc50-ae5c-4302-a773-5071e33aebc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366360, "uuid": "98c627ad-bb08-4fd0-8e5e-8e8f316f50f3", "value": "Mrsexjyvoxgxixd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b0a477-c40b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763421535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421535, "uuid": "864ef546-532d-4f3b-a489-6aa97e28ae8e", "comment": "Malware payload", "value": "b9bd23d39157efd96538db58b3d2e5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421535, "uuid": "5adc2997-668e-4403-a842-5810f2f5f9b3", "comment": "Malware payload", "value": "3706416743a4399ade7e22737f3731f034dceb422c0fc5138bfb9e578e0f9fd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421535, "uuid": "706343ab-2f73-4ae2-b8df-b5d0ff4d6958", "comment": "Malware payload", "value": "4a22eb67837a805a19f7a6022cf0dd7dcde11a68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421535, "uuid": "b5cd9553-a963-4c93-93c6-e899db339d18", "comment": "Malware payload", "value": "9022b496e93399e388c0622953399a44937b09d92b54c46faa28e8d52b15cffaf8cf15a9a487f6f84010d5802ba962f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421535, "uuid": "6ac7088c-e5b9-4e63-9c56-f34524eff3f5", "value": "T16AD2CFAEF5A09AD5CC8C5CFA818D3AF6175025A4358F0F64D3119880B868DEFF51E2F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421535, "uuid": "f78077ec-bcf6-4da1-84c2-97999d62d590", "value": "768:/3eW8ebuWxSZk4FCoyYF5PPx842dCl2PsEWbv:/OW8/Wx2F6A52gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763421535, "uuid": "20bd7d1f-0b18-477a-a47a-2c6a9fef11f8", "value": 28880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763421535, "uuid": "263697e9-f56a-4296-8368-5ade8e55aa84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421535, "uuid": "ae0de8dd-46ad-4806-94a5-058500fd8a36", "value": "hidden", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52b2f79-c3ee-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763409099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763409099, "uuid": "840d6475-10e5-454e-a360-66bf43940cb3", "comment": "Malware payload (GoToResolve)", "value": "3a2f824c6481550f68622c36308a03db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763409099, "uuid": "7cd21ae2-85fe-40c4-9d60-480d74ba9aeb", "comment": "Malware payload (GoToResolve)", "value": "372acaa219ae0f6582b9afa94ac62cd5db7e3ad0af34399c195fe8daf5893250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763409099, "uuid": "4cc4e7ad-1352-452b-a1fe-fdd64470bd9e", "comment": "Malware payload (GoToResolve)", "value": "39306e9aba18923ca5f2525013c316aeba15dad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763409099, "uuid": "a68c2a3a-013d-49f9-b6d4-452e7f8724d5", "comment": "Malware payload (GoToResolve)", "value": "459411e9ebe3498c7f1f3feb27a9d9e3c27f38179c3cda9edd141366ff705ca7d9f433f68a4580c8077c034f6472e813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763409099, "uuid": "0005c383-2c51-4f1e-a845-b076ea42c33c", "value": "T1743733317156C171D48711F1AD28AFFAC2ACAD35877948CB73D85F2A9B709C26B32A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763409099, "uuid": "9cc3dea4-0965-4e70-beb1-8dbeed94f133", "value": "5077e3f17a4376dcf6421ee6917bf4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763409099, "uuid": "4984579d-a457-45a5-9761-6e0cbbf6faf2", "value": "393216:YAwoMOd/9DYp3Q7xwvcqMcfuIp6HIaW947I3Xon91m/FHVP+zTLy3qOZXMdtW6ho:4oN/98pg7x62In947T8ZkHe3q6F6hljC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763409099, "uuid": "5fbcae19-380d-48fe-81f0-7d1b020ffc30", "value": 24473624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763409099, "uuid": "652359d0-5612-4665-8cee-a88ef8d4d0a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763409099, "uuid": "c4cdee6b-d766-48e6-b7c4-5e8a2294b52d", "value": "958587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d31b83-c403-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418118, "uuid": "6ddbc2bc-ca00-4d56-95c5-f66f88783347", "comment": "Malware payload (Mirai)", "value": "4fd141cde7846a04064e1a464b01b609", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418118, "uuid": "46b55c42-f9e1-4639-b137-9b6b45d0bfad", "comment": "Malware payload (Mirai)", "value": "37630084dd10bbd25b42984dd63fbc1cd05714615a31f1b1dd90a86b8e7100d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418118, "uuid": "a96bdb0f-579a-4b2b-93ef-e84bf62c4577", "comment": "Malware payload (Mirai)", "value": "5bf4eb4e32f21366e2261459b4016a636df7a635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418118, "uuid": "e702bb7d-86fe-4654-adc9-ab16fe4e8355", "comment": "Malware payload (Mirai)", "value": "39938f51b7180176602f3f08d25f792a155590bd4a06ba93c85a6e3f16844a192ccfa29e4adeb4265c1f28a001509887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418118, "uuid": "e505c04c-25e9-4c23-b47c-4cdf84fedd8c", "value": "T1D2C3E796B8819F22C5D156BEFE1E52DD33231BB8E3DE3203DD146B2437CA95A0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418118, "uuid": "c8114d4f-db0d-484a-b83f-27e8a8d83866", "value": "3072:+oP5nt0fyUtcH1CX0hEEySWGrAcewEAa0SI+3ipiYp1fn5Y:+oxntkyUtcVm0hdrK5XiSR3iV1RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418118, "uuid": "7b74b2be-85d1-4847-b6a4-cba5dde0b641", "value": 119784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418118, "uuid": "f97c8116-163b-423d-b05f-5dec23ae031a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418118, "uuid": "37af4f82-ff2d-4105-ab8d-5676c1232595", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fc37c3-c385-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763363741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363741, "uuid": "6aa213e9-ad3b-4046-b1e8-989ef39108b3", "comment": "Malware payload (RemcosRAT)", "value": "da84a1063c7578b4be39174e7c8ae51c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363741, "uuid": "e7f5e545-c30a-4139-a0ee-38573065ff08", "comment": "Malware payload (RemcosRAT)", "value": "392e729b28d037014cdd3f76d81c04d2a6eb877b38b10b6422b98c9bdf1fc437", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363741, "uuid": "cac3a4ed-a0a4-4d5d-8ba8-50da80cc6700", "comment": "Malware payload (RemcosRAT)", "value": "fb58be988eb987ae1c96ce2e9d25ac605fbe2554", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363741, "uuid": "91667499-88bd-4842-89f3-65195aba4141", "comment": "Malware payload (RemcosRAT)", "value": "46f21066be220b4d54934169c1ed2888c23910f4368e02a7a9261715c5bf5677d9944b42dee2a36adc5ad52b282b5a9e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363741, "uuid": "0f52ce27-799e-4717-bec1-40da4589ba1c", "value": "T1AB25013D8E689CD6C7EA3352BC2AEF1900B85952D023C769F1D458EA4D39344EE2DD4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363741, "uuid": "f1e0cfcc-6e87-45cb-a63d-166b1584b29f", "value": "12288:a0GVvXr6AV1LodmTkkJMZAztq4NI2hQuzagiGzResQoGR5nJjuHlibeE4tWMpD+c:8JXa1YMiZOd2RQoAJKqhbMFrZ8uZ3S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363741, "uuid": "fbea4d4d-a564-49b2-adce-04e59dcb7d5b", "value": 977931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363741, "uuid": "30623f30-418a-42b3-9de7-e350e94e5986", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363741, "uuid": "38feb9e5-33bc-4af4-af57-2550dd67772e", "value": "Invoice_FedEx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd685b1f-c39f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763375236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375236, "uuid": "6cb13dc0-8199-4265-ab6b-3b98d85a25a5", "comment": "Malware payload", "value": "c51108b9528f890e095ffba96341a113", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375236, "uuid": "0f4bbed2-ba6b-4f5a-a9d6-4e263cc7676f", "comment": "Malware payload", "value": "3c1b4405a7937ea23ecb2030021cd76d89ecbbe8a8445833d6082386d6fda493", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375236, "uuid": "84181564-948a-4226-87cb-bcd5eceab0db", "comment": "Malware payload", "value": "f6bd0f8f5f6ed883602c7b8830a91ba0004605ea", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375236, "uuid": "09e01e05-bc61-4350-a767-85a61c5ee978", "comment": "Malware payload", "value": "a483d2868abb7fdb34f03544cde20669ef561f3536c5d1082efe14cfeb55e440c99489a974ce521a194afbef786f8e58", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763375236, "uuid": "c34a27d2-b06e-4b7d-8d6b-cef2e671e18f", "value": "T18FD012348241C14DD6513A39ACE0BD15640DBDA78CC3BB8C1496D86A05904AAB55439A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763375236, "uuid": "e41ecd75-50eb-461d-9877-ee830efc07e8", "value": "6:HRYFVmyCTcnJ5mDsKLDBBArSDxDXtKznGE54vVG/4xHy:HRYFVm0DW3BBArSlXtHfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763375236, "uuid": "ff433d48-b7f8-4fee-8d20-f1ebecfb138f", "value": 284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763375236, "uuid": "98eb17e4-bde4-4be7-8f47-e2a86b778e28", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763375236, "uuid": "861959fa-177b-450e-8bcb-a170eaee0557", "value": "Invoice.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a525f4db-c40c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763421903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421903, "uuid": "892ea3e5-075c-40b6-912e-eb62e6256758", "comment": "Malware payload", "value": "76a08b2d2fcfb7cad7762dec8bcb6eca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421903, "uuid": "fc6b7adc-0a2d-46ce-b32a-4a885e79565b", "comment": "Malware payload", "value": "3cf45a1de26bc155cef0e97902b4c68809608d3df67e5abd4afa720d02e60ad3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421903, "uuid": "31415dbb-045c-448c-8fde-7fbdf9468431", "comment": "Malware payload", "value": "d694dc492cf2f8a335fcb1c098fbc9bca238ae38", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421903, "uuid": "405ea47e-9002-4c6a-9d9e-15310640261c", "comment": "Malware payload", "value": "815ee6e7158fe2a2ea207254528e1badd43a5bef4979bc5f1d83c42b103f6a21463a2bf1efa2573b3f50e9e6e7d841f8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421903, "uuid": "87180ccc-c23e-4de7-9499-739e8344fe0f", "value": "T11444235A90C41F61DBE006F1265A0924DDF93B6E22B3E93A437D0F76D728BA4FD48053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421903, "uuid": "25a4211c-4219-4ab3-a275-60970872af05", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421903, "uuid": "dfcf020c-4355-4d87-942e-de1fcd2502f2", "value": "6144:E1No6VDwZyeImnX18UkcfAbUbZ+J3mBF9LA0eVuWVtdrwV6N:E1NfVfeImnvkCAbUbZ+J32LA75Vthc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763421903, "uuid": "6168c7bb-8d5b-4096-8683-67830ca0127d", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763421903, "uuid": "b8259445-ece1-463f-a53c-801d81214de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421903, "uuid": "3c64127c-7b11-4ee8-a874-69f300afaca7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac661b5-c3d4-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763397619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397619, "uuid": "a5e89788-973c-411f-82bd-4786c2b725c3", "comment": "Malware payload (PureLogsStealer)", "value": "e18728d041017faf1761d6e2c50334ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397619, "uuid": "e6b123db-4568-4e0c-acbc-fc798400d527", "comment": "Malware payload (PureLogsStealer)", "value": "3d71d379cd6ae2f310790df0437da79892156c4f7daf026cd83acadc45127373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397619, "uuid": "847e41a4-0a6b-4e81-aabb-b185b5e3875e", "comment": "Malware payload (PureLogsStealer)", "value": "2304c96154b0ea3e60f4643606b9153a67dfc03c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397619, "uuid": "8acb431d-06c1-43aa-abb0-63bf8a54bda7", "comment": "Malware payload (PureLogsStealer)", "value": "902c1a0aac73bf03d2fea79413edb83436b9aa7ca8b045a5875bf61bfb65df94ee6af271095493f050ab964d0e9db70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397619, "uuid": "ad67e2f8-8de8-4ff1-8cfd-9e6fc29234d7", "value": "T1DCC4235073F9AAE0CEE0C6B9C8EB58056771EE271D2FD67D48CE5B4858B1BE640C9220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397619, "uuid": "83da4c4b-a78c-4465-a030-806f418e0be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397619, "uuid": "598e226d-5a3b-4e80-8804-686d317262b9", "value": "12288:+hVK1TSlKkyINHYiiHNcu0RsTwfmspIU5WgW1QS1ORCu0ee+YT:4VTlhte0aTw958QS4Rhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763397619, "uuid": "db1672dd-cfe5-4f09-8e9c-f8dea0934754", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763397619, "uuid": "56fa935d-f670-483e-bb04-9303c00eca8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397619, "uuid": "4722f050-d139-4755-a2e7-36d5720c1c62", "value": "3d71d379cd6ae2f310790df0437da79892156c4f7daf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4523b9a0-c3df-11f0-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1763402415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763402415, "uuid": "bae9734f-b930-4f55-85f0-24b9661d22a7", "comment": "Malware payload (Loki)", "value": "19cb5bdef2eff47500c1bd70526cc4c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763402415, "uuid": "03feeea9-e7ec-4a8d-99cc-38854703a835", "comment": "Malware payload (Loki)", "value": "3e295cdf4bd41a5988a8d9bc1c92ee66940a7f90d05046a4a52e2ca174523aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763402415, "uuid": "09605b2c-7873-4e23-8407-b5506cc1b4c7", "comment": "Malware payload (Loki)", "value": "3e5c49701be871032cf1305b704abd79fd6bb7e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763402415, "uuid": "099001df-dd2f-4c81-9404-ae1d6bc9375c", "comment": "Malware payload (Loki)", "value": "d1f19591b8cb9bb802c73d21d79a611fbdbf543037446acf93668f9d1ce12120b0e9dcfa7f43477e21c02dada22508aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763402415, "uuid": "be3f6daa-c23d-43bb-b76f-7033f90296ff", "value": "T1E9A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763402415, "uuid": "47f5eb4b-ab28-4d0b-be5d-299cf288d724", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763402415, "uuid": "1fc32803-28b1-4e69-94b1-7a0a40d803ee", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763402415, "uuid": "70cca848-cf71-40b2-a084-e7a2bfc95e33", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763402415, "uuid": "1b676e53-1f87-4a30-94e8-ff6896f962e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763402415, "uuid": "f86c7e93-752b-4b82-b9b7-3b3553669dfe", "value": "19cb5bdef2eff47500c1bd70526cc4c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5adb5c-c3d5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763398055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398055, "uuid": "9f27ebb5-71fc-4b70-b179-417ada7a0ce7", "comment": "Malware payload", "value": "688058cac1d0a39ece56063d0ee3fe5b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398055, "uuid": "b11e0479-c192-4d88-acf1-50d61d80e9e2", "comment": "Malware payload", "value": "3ee21a8ef618dbfbf3e7d5053db7cb260edd78cfe8efa21a7f6bc5619921f503", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398055, "uuid": "c9f71e13-ea0f-46b4-b3ae-eff4dcdff65e", "comment": "Malware payload", "value": "d604ea1ca74607515a0b6c8e91c01b3afa9982d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398055, "uuid": "9ad27c69-4214-43c7-bdee-c81dc4f42a0f", "comment": "Malware payload", "value": "7801d60682d6b6ba4bbc9aee04e85cf9a163c9dd573112ecf45a825164c7a4106685e8c435ba2441ea48814c1b918285", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398055, "uuid": "66260daa-27df-4d83-bf03-b9233c12235b", "value": "T100629D74E4911829F219107780A13519EBB8FE0EE1716548AF28F98F4CF70E71B9BE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398055, "uuid": "758a7301-a803-4807-a31f-747c0ba2a6e6", "value": "192:ieT9kXnsvyMtWNsY0mqQTnhr5OqQT1QDP55czbFTB8GoA6a8kWCmi:ieTmsvyMtis6LOqQT1QDDctdg8mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763398055, "uuid": "f48bef02-7c19-4b22-be40-39fe6730b49f", "value": 15481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763398055, "uuid": "35066824-958e-445a-aad2-be8462333034", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398055, "uuid": "6dc3146b-01c6-425d-9233-9ea312193998", "value": "Specifications.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480d4b88-c398-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763371925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371925, "uuid": "e5d14dc8-a7da-488c-8d1b-238d9dfe7a07", "comment": "Malware payload", "value": "76a21ca78f2ecada23e745a7c22c69ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fak", "colour": "#0975AA", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371925, "uuid": "166bc0a6-583d-433e-bee5-e9f2a9be29f1", "comment": "Malware payload", "value": "41a485c3bbf7a3f02e0bd79f63aa53db79ff163638ae9e236bd7caea08e06fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fak", "colour": "#0975AA", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371925, "uuid": "a0b84399-e9db-4b42-8518-ec3419196496", "comment": "Malware payload", "value": "becfb30d4987d9e886563fe17288a831dda3e2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fak", "colour": "#0975AA", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371925, "uuid": "f206a962-8753-4133-93b1-c1b1269f0e2e", "comment": "Malware payload", "value": "c7950d0a09904d5945e0bfc381cc32e42733426c544610f655545480ade5caec6390ce3229cf1d3c8a53f884ae5a462c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fak", "colour": "#0975AA", "exportable": true, "hide_tag": false }, { "name": "fakesysapp", "colour": "#8F8EFD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371925, "uuid": "fe63442e-f84b-48c8-9af2-c4e50d9962b2", "value": "T1DB03439D97C7EF21C824197111E31B9803B4D9997AA39B6F4F0CBD510EE32982E471AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371925, "uuid": "46ae15b7-db3d-49e0-b118-303c79c4d277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371925, "uuid": "8c960315-e505-44b2-b7dc-ef5c1193fbff", "value": "384:SYQvUrkeN/H11YIr43FmLwdIivAdio+Gk+yDPyUgj0Zx4qpyW3vSrFHtmg2qcixT:uUYeBQ7dZpUr9ZnxbHbt5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371925, "uuid": "5e7a1d03-b31e-44f5-a226-4479cbdf6289", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371925, "uuid": "00a1d156-37ad-4031-95be-1960d0917795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371925, "uuid": "98c87039-5e9e-4a20-8991-fdcb3caa4150", "value": "rzyk91.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814f3cf0-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763387483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387483, "uuid": "de4733cd-2a0b-4ee3-8ee9-76ff2a79e633", "comment": "Malware payload (GoToResolve)", "value": "226f1e5ddde17695ef503ca70586980e", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387483, "uuid": "f1043795-a4eb-4ede-b1e1-68e1e598ba2d", "comment": "Malware payload (GoToResolve)", "value": "44af2b54eba8e63decd05d3e8f492687656875122d66b26f87e23bdf2fb7aa09", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387483, "uuid": "12731a73-58cc-4968-8404-3d290389369a", "comment": "Malware payload (GoToResolve)", "value": "aaa25f6c230a50eb8561028d914bc7c7a3bd0da5", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387483, "uuid": "acc26373-6ec0-41d4-a76a-4bcdd68481cb", "comment": "Malware payload (GoToResolve)", "value": "30c8ddd14aa753c142d0200783771a6aff9e908c968f49de31e82a4ebf9e7f0d2c36b32a54b775df92c174f5605fd0a8", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387483, "uuid": "a2fb85a4-ebca-41b3-bb61-b6c94813dab6", "value": "T18137333239858672D89A01B1942D9BFA557D6E104FB180D7BBECBB794F302C12B36367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387483, "uuid": "34fdddc7-6e64-4422-b191-2681a4afeb6b", "value": "393216:ojE4ZQiKqSFIwkzCwuMERat2VwTPoJYh7V07MuCAZ52WKV00VW+tR:aGSwkzwm2yfBIHNZ52WKVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387483, "uuid": "03f79e34-76ad-4b5c-9f0e-c3a35995614f", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387483, "uuid": "8c207dd6-b783-42f1-b6cc-1c44c459d6ae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387483, "uuid": "37b72362-eab5-4892-8199-5a4003ada57e", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8806c8fc-c381-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763362154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362154, "uuid": "e48c38cd-a2f6-495d-a746-c4943bbb8d79", "comment": "Malware payload (RemcosRAT)", "value": "d1f98b41a39cf71a9d392a04df5be96f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362154, "uuid": "263b50c5-1a9c-4e16-acfb-733aa915a77f", "comment": "Malware payload (RemcosRAT)", "value": "44f70441a3c3e50100115a9e42eb8c59f68d9ed72dca4f896e4c351e3b9898b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362154, "uuid": "f97e7173-7ece-4343-a846-75615445b7ff", "comment": "Malware payload (RemcosRAT)", "value": "2c4223a9bac8567fe2fc5c7b4067ed0e75d9118f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362154, "uuid": "ee981158-bb37-4084-9be0-f6d8dd6ec2ae", "comment": "Malware payload (RemcosRAT)", "value": "7db1e072ee5de00099966544f7a6fde8854509713af9e802d926679f43e08fbab759b33bd2f530a084655dd4ca8ca933", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362154, "uuid": "48292537-cf79-48f3-a822-dc114fe71c1a", "value": "T10465F762596FEC7FEE1DAF9782E5B81001E41631A0DD9B0FC865609E2EB05885F0F9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362154, "uuid": "0b788cdb-7f3a-4f52-923d-b28e8a7ed223", "value": "12288:p/dBQHqpLAK4bP5A8UyAx/jyPjWFEa/cAJ+88BfpEh1HepCE5b13F7paV:ZQHWLATbm8WVOPjW1/1SB+TeM2bvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362154, "uuid": "8e4db17f-512b-4d48-a354-b1d8d602d41b", "value": 1417442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362154, "uuid": "1256a0ab-ea7f-4502-a706-4a0ac181b449", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362154, "uuid": "71714506-b952-4a0c-b26d-7e60d50ee597", "value": "PO P104673514 RFQ R01379007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aefb706-c38c-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763366723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366723, "uuid": "07e423de-d3c6-470e-98ee-0d126cde134b", "comment": "Malware payload (RedLineStealer)", "value": "86bde676ac49cd98d624ba1c1a8169cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366723, "uuid": "1137d26e-b5a9-4493-8ee5-1a464b22f99d", "comment": "Malware payload (RedLineStealer)", "value": "4617d135c1d169971def5a3d99dd55a2f00669007ba6d8c844062bf13ef434d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366723, "uuid": "19707352-b256-4d79-b68c-eb4867cb5b4d", "comment": "Malware payload (RedLineStealer)", "value": "3cf949f46f9c4f2fb1596a4e23fe6f74804bdcd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366723, "uuid": "2f8aeb34-b7fb-43a7-8049-b5c635603c6c", "comment": "Malware payload (RedLineStealer)", "value": "b8c09396df2c2bcb732194ab8bee42aa7137fc8d2e0a5773f5f307328c118dfede16c203aad69a1073d15a9dc991d66f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366723, "uuid": "a1e504af-348f-4324-a8fe-e01190a66df8", "value": "T1E3E4AD1DB12C4A86C7E97BFCCAF1DCB502236C996420857269D9F9ABF4B2E514342F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366723, "uuid": "a9ef60cc-306e-42e3-b1ad-5185c6b031d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366723, "uuid": "032bf713-f9db-439b-b53e-0ba1ebb282f7", "value": "12288:rf/1P1sed7A9jb6X3Z5nfoNyCFNKIm5SzZZQysZDLgdXy89h6S9f6CCCCCCCCCC5:rTsed7+3g3jfoRFtPZSXZDMdi8h6cf6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366723, "uuid": "cd3b4ccb-b532-4c77-bc0a-301a3ccfba3b", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366723, "uuid": "a648a878-35ab-4910-b05c-c30130443f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366723, "uuid": "10765c7c-d358-475e-b6c3-893cd58f328c", "value": "Specification.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e994b46b-c3c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763390665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390665, "uuid": "dd8cdb68-0975-46af-bb14-e53b47a85de0", "comment": "Malware payload", "value": "20d3139b0bf01f3c216cda6278cf97ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390665, "uuid": "be594964-db3b-4e3f-b1bc-952d5bf65bcd", "comment": "Malware payload", "value": "4631309051a5943e92656a421a01f79132f47b0367462ee1b9c50f56ab38e04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390665, "uuid": "0d6e9e1f-df00-4a55-ba37-da8654f5043d", "comment": "Malware payload", "value": "e717872f0611e84481d7e262e17bbd78e4d116f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763390665, "uuid": "55efb028-2550-4e16-a39b-b463f7ec4baa", "comment": "Malware payload", "value": "4b69b600f4de5a04455dfb072ec615ec2678f7af999c0bc5bf2b79f403056cc5e26d9d37a2e516501092b098703186b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390665, "uuid": "6adf001b-0572-4a23-bbaa-f49475be99fe", "value": "T1B07429226EB98415F173C13D3693EB23E13BFC0867E8B5EB85ACDA0B1385546B56C712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390665, "uuid": "cb5641fe-4520-4d05-9012-d247635e79a9", "value": "fb95ededa584f3bbd9996e0ee545b077", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390665, "uuid": "35961263-de39-4995-844e-911a91357681", "value": "6144:1OXRP3zLYoxeSrI9UvUj39Ciy8PtfbKI1QpVW96zhprgPGGoF:oBHESrsjtCRqGIeVW9QhpjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763390665, "uuid": "2a777298-915b-413d-8e58-dd7b0cfc4b9b", "value": 346864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763390665, "uuid": "02421ab7-75c8-41d6-ac4b-82e408f66e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763390665, "uuid": "fa06a52d-7112-4ef1-b3ed-6bfb088bf59a", "value": "j2pj1twew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e44cc3-c366-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763350668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350668, "uuid": "c0832a97-f92a-43c3-89dd-5765e5baca0f", "comment": "Malware payload (Mirai)", "value": "31b19c609b6aa0a4ac3cc09c26301495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350668, "uuid": "84f8ef0d-e64b-452f-a20c-9a850809630c", "comment": "Malware payload (Mirai)", "value": "471b007f208f48c864610fa410cddef87d52f6623dc5241bbece66866043ac8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350668, "uuid": "fc0d3a1a-2299-4d8d-825b-f6b8a2a7bba9", "comment": "Malware payload (Mirai)", "value": "9d3664fd04088d78c62b3011e126d27873293ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350668, "uuid": "b1a6cb45-9d49-4483-b6f3-eba3496f7e7f", "comment": "Malware payload (Mirai)", "value": "fb80ea23e9e55765599c1fc838f5488385839757a5acf602fcbdb71ff8c637e68519253e69c2a2bf2863019812329245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350668, "uuid": "329cd099-8c85-40b9-addd-f7cbb07ad3b1", "value": "T14093184EF9829B02D9D515BBBE2E515A33076BB8E3EA3213DD14172033DAA1F0F67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350668, "uuid": "fe3d1434-ac41-4f46-8490-6773111cc996", "value": "1536:DPn9n4/Vcj5FMpido9iZhrAUkFW88RLv5dll26inv1hZiU7Et1:a/VcTMpido9iLEFW88ROjv34U7Et1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763350668, "uuid": "df79aa15-825f-4943-a65c-6ec61d36416c", "value": 96104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763350668, "uuid": "9bbc1c5c-a2b8-4934-9d7d-d8e0941c737c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350668, "uuid": "add907dc-8976-495a-89cf-61d5947a9ba5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8de512-c3d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763397439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397439, "uuid": "a794e8a9-cc17-44fe-84e3-695d280fcd6e", "comment": "Malware payload (Mirai)", "value": "9d5361f8de08c4f80ffc9c70643dc726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397439, "uuid": "ac7a0800-18b0-4db3-adb0-e4ee65a8f712", "comment": "Malware payload (Mirai)", "value": "47fe13793e0ce3f90a57bd9147a192832d95d61f0799068b763bc874db1ccf77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397439, "uuid": "fc0c90a3-630a-42a1-80a3-d490107c7c2c", "comment": "Malware payload (Mirai)", "value": "32ef94f0bfd183d0bd5aee2d6ced80250846f2e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397439, "uuid": "1e1ee425-cf68-46fa-b514-6a8080312f7b", "comment": "Malware payload (Mirai)", "value": "f4fa2c0a69aecce2429c91bc431319160c531442715da5b71422256cc7949a1e4433f7eca9e9573c28a72aaf3e7541e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397439, "uuid": "f42bce77-a110-4d70-a524-1fc49da6d08b", "value": "T164A33A56B9419B01D5D235FAFB9F80493313AFB8D3FA71119D209FA023CA59B0FBA502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397439, "uuid": "500a1606-8031-4807-b951-4036e38c3475", "value": "1536:+YnLiqbeLosWZj3tvaDoHafGXaRyP7dl31iamfCahz5KZJYHcg+emzwT:cLosW5tvacHafGT3HmfCahz5KHTFwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763397439, "uuid": "a8484849-41ba-44dd-b2a4-1048cd2e6bd9", "value": 107280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763397439, "uuid": "8fe8934b-f473-498f-833a-c6aa5b6ac9be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397439, "uuid": "5f422d82-78d9-4979-ad9a-0f76e2e0dbe9", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f97ea1-c3fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763414930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414930, "uuid": "334d90f2-0e44-4b96-ac1d-39103bf386c8", "comment": "Malware payload (Mirai)", "value": "3cc6d69787d203a9fe178439a3279e9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414930, "uuid": "06ed8f4a-785c-406c-813f-3c95af1dafd1", "comment": "Malware payload (Mirai)", "value": "480ffbda04efa8e4fb532797b1c40b24e2208facd2563d007ab03f283ea5ca07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414930, "uuid": "0e0e3b90-2f54-4ce8-a9ba-b01e0c0a1386", "comment": "Malware payload (Mirai)", "value": "9b80c77705675c9108fc1e8cb33adcb1aa17d56c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414930, "uuid": "e7556970-d1cf-4df8-992b-db756cde9cf0", "comment": "Malware payload (Mirai)", "value": "6308c144bafffa350fc9ed6ac0bd60d76f39b926e595bca3614c18fd428391c818ef5264fa83940872752c2f85b75e30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414930, "uuid": "cce53376-3467-4a4b-8333-eb989f593e75", "value": "T1EF03E1AD964A2957D16A5CBDFAED53BA8C80F15833F5DF1B63104C8CFB2412BBC88854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414930, "uuid": "a103a155-a04a-4f4b-a3d0-643fb80165ca", "value": "768:4+4gdP6+u8XPO7PDI5d9G9oT6gbReA+L3SEHZMRlN+g06mqWR:jddm7P49OYIA+DBo26O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763414930, "uuid": "39f67f50-5b54-4c69-bec7-d47aa3802806", "value": 40380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763414930, "uuid": "9cccedfc-6d00-485f-bf7e-695ceff301cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414930, "uuid": "e0fe74f7-c4f2-4ea5-b03d-8c237c3afbc2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fc3e4d-c390-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763368458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368458, "uuid": "cbc51fec-30ed-48b3-81bc-04f1cc1f7cde", "comment": "Malware payload", "value": "d6e1fcf8a2fb0fdebb73c4c7df8839b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368458, "uuid": "d103ac04-a490-413f-a34f-4929080f4aec", "comment": "Malware payload", "value": "498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368458, "uuid": "f127e78c-d807-47de-9c5d-81ee820d6811", "comment": "Malware payload", "value": "b970c1c48b5f4f8bae754c68fa543898158da392", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368458, "uuid": "2817968b-a5af-404c-8c39-61c7af25d732", "comment": "Malware payload", "value": "1f0642554d27ffe47b70bee64221ab05f9f1402d1d9efe8bc57dd25af449559a4cb9c42ecd2463ff78e4c211f29783e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368458, "uuid": "149b5b2d-5117-43e0-bb30-afce695d2396", "value": "T15302EB0E686046A9E168CA73B454C62B930BC26F0262F418B5DCD33D6F58F559AF2BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368458, "uuid": "15787bbd-159f-49ff-88a3-d5cd961fae29", "value": "192:N9Pocfk2Ezw5sMt5jzU5FeHHkzw5sMN5WzU5XUpMpgCEpGeLExRFn:awrMQORpMpMp78R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763368458, "uuid": "c79d89f5-4ed0-4593-8847-dacb9be40999", "value": 8478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763368458, "uuid": "3eb7b51b-3738-4e51-badc-52e9118d1d54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368458, "uuid": "f9c65a56-3c58-4a3a-8627-2c69c6b05a74", "value": "498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6205c568-c3e7-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763405899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405899, "uuid": "daa22653-8e10-4293-944a-1c14a7d96ead", "comment": "Malware payload (ConnectWise)", "value": "f4ab734a545bedacf177435e56da26af", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405899, "uuid": "9dbfd2a2-4899-4dc5-a63c-2609eadbcfb4", "comment": "Malware payload (ConnectWise)", "value": "4d30c23cda73fba03adee098643bd4cd65068dd323559763fa68a4cb52c8d292", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405899, "uuid": "f8fc9434-f117-46de-a989-3d5af8532df6", "comment": "Malware payload (ConnectWise)", "value": "93f88af515a098d7c1bd478b736cc10a2dee4504", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405899, "uuid": "3b641a26-0e2d-48c1-b762-7e0086e311ec", "comment": "Malware payload (ConnectWise)", "value": "974842c6223dc987aa2fe84f9de21bcbb7b1daa6336b059746cdd77fb5d474d028d10cf46dd9c54d2ea0e0fd564aad69", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405899, "uuid": "1e468297-b4b3-48ce-8087-08040c97aeb6", "value": "T1CEF5E021B3E4C136D0BF0639D8B94561A7B5BC099266C75F53A47D6D3E73B808A223B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405899, "uuid": "ceab2cca-3c49-4e98-9411-3c8b92786653", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405899, "uuid": "c885966d-2b8d-4780-aa8b-de24033980c9", "value": "49152:XZwPTPFIST0+TL3Z0Mi963PSugQeccp6EsToWTn1Yt+fLbXGundZRT4T1gH:XZkyZ16MAEsToWT18+vGWkTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763405899, "uuid": "ea8b57c9-2d95-41a6-9539-cbe7e0bcbb92", "value": 3323024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763405899, "uuid": "b25d2b81-0dc5-4a12-b90a-16b8eeb8a38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405899, "uuid": "428a6323-ff1a-484f-994b-198e6cdac6a9", "value": "AppPack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fa0697-c3ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763393395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393395, "uuid": "4f65a8bf-cea2-45a8-b4ac-64fee1c969c9", "comment": "Malware payload", "value": "f9e73c254d7d66e8a99daeb4462e8827", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393395, "uuid": "55f33805-3ac4-4c8d-a233-572c0cdb1778", "comment": "Malware payload", "value": "4d751dd363298589cb436d78cd302f9d794ae1e3670722a464884be908671a9c", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393395, "uuid": "0dbfbad3-4afe-4db7-b587-6fee2a86155c", "comment": "Malware payload", "value": "7af49619f362f676bff0d780c702d91fba53aa35", "object_relation": "sha1", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393395, "uuid": "4a2c7bc2-d1ee-4c4a-a423-d250018dc05a", "comment": "Malware payload", "value": "06e26a3b79c948be05e8a72206434e43ffc29ec50884756e91ede5a09eca571e1f5fcdd4e2b7f4333584f17d1d6a8217", "object_relation": "sha3-384", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393395, "uuid": "9cf4c0a5-155b-4574-9a6c-5ac1da40e955", "value": "T11ED3E7276708044BC44D11B692F907C2A27AFF6416F0932F0148B59C5FFA7EB51AEAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393395, "uuid": "cae9bb90-7120-4f36-abd8-02187cbea74a", "value": "768:0Dbj6tc6QUZuZgDGAX2D2PPnZgyXGMS+CAP6nxc:GQcatDGP2PPnOE3S+CRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763393395, "uuid": "729c4db1-2c49-422b-92fe-bd4782e4bb08", "value": 136032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763393395, "uuid": "8b901b82-0185-4561-8b77-6dbb238fe546", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393395, "uuid": "8cc8c7bc-f1ab-4116-b160-e54870fa6b06", "value": "Zoom", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba9fef4-c40b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763421565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421565, "uuid": "bfb86635-548f-4193-95b5-76d7da09ff42", "comment": "Malware payload", "value": "9ffcc82e9c9403955306a7123dfca99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421565, "uuid": "76333e9b-97cd-42ac-ab6a-2a1864edaa6d", "comment": "Malware payload", "value": "4f687fd182ced75bc5b7a3dbfb0f5657f283e4f083f6c761a57f96fe7dce9bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421565, "uuid": "a9f0052c-983c-4856-932e-748fadb4c21b", "comment": "Malware payload", "value": "493c51491d38878030320f2b5a9a9a95c5b6bd64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421565, "uuid": "c53f9ef3-9d9f-404d-aa69-17d615a58b37", "comment": "Malware payload", "value": "b87d21ff87d27e156f14eee08f414b09f3ed5acfdc7948acec58558f44cafeaf8007cd90c5257dfd050789a21659d887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421565, "uuid": "9d1bf902-ce6a-45ac-898f-7063b70ae699", "value": "T1EC63A60AEF654EBBDC6FCD3705A9070534CCA51B11A93B3A3974C828F65B51B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421565, "uuid": "fce660ec-8aaa-46f2-9c54-fffa9db09d6f", "value": "1536:I/kEubZVpDximOnxrU4fiV4MZ1EbSB+IOEuFkeWAD:I/kE6VpQo4fhMHOvFke3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763421565, "uuid": "99ab6dd2-63cf-4f50-bc63-4f6f75dd5334", "value": 72492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763421565, "uuid": "1a43e65e-d8b6-44b4-8e6e-46071d9e282a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421565, "uuid": "d92605b4-6572-40f7-bb88-c5a17c0a7290", "value": "hidden", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a413cc-c393-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763369964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369964, "uuid": "32c6babe-4f73-4550-a8d3-a5b4e82d5181", "comment": "Malware payload", "value": "b518981543effbfc47f027ce69fb0306", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369964, "uuid": "cab97bdb-6a35-4ccc-a100-66737d50f508", "comment": "Malware payload", "value": "5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369964, "uuid": "eff2ab26-4319-410f-9207-0fa51b944bb3", "comment": "Malware payload", "value": "591b2c3ea1ae3e50699445bcece5fb1b255d0f73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369964, "uuid": "03b68d3b-64f3-4747-98e8-88fd1657a412", "comment": "Malware payload", "value": "dae9ce01d0bd204625f4939516a06048b36d1f9dc102e7d2d6f8b6c1fc96d85fd0583b317b2f5f61bcbf7e09eca0cb3d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369964, "uuid": "a565f581-c782-49df-8a2b-0ce6fd267faa", "value": "T12D01899019F4D56E0CC14D030794D12A1A82F28B6C7248F9B9EE7C448B5779671E75A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369964, "uuid": "0634b7f9-136a-465e-8a40-fc86848b09c4", "value": "12:szKCFR32SF0QckxMHdgo+tJVEdQiCXFG4wDAvFpKP42EZq4Wj5Mcf7QckL:YJ7FodfyiwY4m6PKkZ7A5Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763369964, "uuid": "6f54f533-5b4d-448b-b76d-52372aa08204", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763369964, "uuid": "da404851-fb99-4a2f-8efd-d036916475d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369964, "uuid": "f0b974f5-f95c-4636-8f78-925cd004d5bb", "value": "5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcc9dac-c409-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420653, "uuid": "ffed1c13-281a-4d92-a617-843b48de61f2", "comment": "Malware payload (Mirai)", "value": "cccbacfa06a354ccb47aa4ff649e57c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420653, "uuid": "c2d46d7f-5b20-447b-8ac6-17e12b700f30", "comment": "Malware payload (Mirai)", "value": "55808f545a36fef83ce85a2b1af1aefb406190ecb8b099eca87ebbd6129d2725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420653, "uuid": "6a5af561-bce4-4645-940d-7f7da9275228", "comment": "Malware payload (Mirai)", "value": "7420192aa9a3ee043efda83c7588627edbcd653d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420653, "uuid": "595c1c79-4a01-469c-b203-9c419a644270", "comment": "Malware payload (Mirai)", "value": "448f2e9c6db67e865e1afd6d263b6a1445f85c17b401da8741dfef81053082da18708bfd9f2e4cda5f4e375069540314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420653, "uuid": "3b429f13-4506-4981-8dbc-b836903b935c", "value": "T1F503E12D2854448CD63DE1B91DC64FC6AC531AD9D033FE66AAA2DF43A10927E3CD36D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420653, "uuid": "e3fc63ee-f283-4c27-b910-707aa716f01b", "value": "768:1qOuuLFnpgvAiPInG3R7vSl/EwuBYSNoDLbVsiSdsKmRJgGlzDpbuR1JD:1jrFpgvxtvsOpNeLbVsimL2VJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420653, "uuid": "14d0875b-f9a9-4252-9687-b17693de6a10", "value": 39092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420653, "uuid": "c533ab43-93aa-42eb-9a70-2067477c9ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420653, "uuid": "400f54bc-50bc-4d73-8499-39156d0a7f6f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721b5e12-c373-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763356105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356105, "uuid": "5a34d7c4-b986-4373-b6cf-09f0ccc49555", "comment": "Malware payload (Mirai)", "value": "a98d9ed8b42cb0db498acbc9e0418628", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356105, "uuid": "bf5f3db2-3276-45b6-b67c-049925f472fa", "comment": "Malware payload (Mirai)", "value": "5592a262807e499c4fe0edf104da7aa70c8e07d8d2a8e401c0150a15a3b4c554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356105, "uuid": "268b6117-5365-4733-a862-aebf1ffe4215", "comment": "Malware payload (Mirai)", "value": "3c86e2af2831d1c3e7736117ac982e0810066609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763356105, "uuid": "7b86e39a-9423-48b9-911b-417af0f73cc0", "comment": "Malware payload (Mirai)", "value": "0e6a079c568b1577df5e7e11f60cb6ff30afd7cf7ce03bd2d09bc0a71a7ea972cca0a55e28f40de37323c05e30c3bee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763356105, "uuid": "b4181b96-5c8b-40eb-a45e-119ae9c16e9a", "value": "T15CE3D80E7E219F3DFBA9C23447B78E16965923C637E1C586D2ACD6111E2064F241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763356105, "uuid": "a17ce7c7-6f6a-421a-9480-de429724c08b", "value": "3072:xId3VGohtQoEecJ/9nz6JCLY85besDy3sPLVc2EilnGncTXcqkr0LYEXw6+nN34C:ad3VGohtQoEecJ/9nz6JCLY85besD/PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763356105, "uuid": "03c9bdb0-27ea-4516-b176-95c2af5809df", "value": 144800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763356105, "uuid": "6431b794-79a1-4d29-a7c4-0f01baa91784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763356105, "uuid": "1ae71b9c-c3e7-4c76-8c84-3aeb3475d345", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928b0350-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363890, "uuid": "de5bd852-b995-43d8-8a97-3f2758c46f79", "comment": "Malware payload", "value": "36ff7c774354446a5c6db0862016b91e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363890, "uuid": "2f85225e-4da2-4cd0-b99b-1f6be06e7f8b", "comment": "Malware payload", "value": "55fe4f5c26339f7732d696f87757ed471c63dbff35f82d0e95358684140cb77a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363890, "uuid": "1f66e89c-91a1-40e4-9a55-99e89c8c85bc", "comment": "Malware payload", "value": "0fe8132df092b7276d8f4051ba3831fd89fa1f28", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363890, "uuid": "1df13a62-ed84-41af-80a8-32923cc7d612", "comment": "Malware payload", "value": "4e4dfef4881ec04c8fb9c045db2e6d17c46f150cfa2bd56bbd48b46db32419b0d61dfc0931ec51dbadc31a4ce58e99ca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363890, "uuid": "791cf45e-ef21-4c05-be5c-7e2032fea8ca", "value": "T15E27234BEE58CC69ECF6627AFE32032334225DAC0703C57B55A9BA3D7E731C68691590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363890, "uuid": "4fd049e2-9196-48bf-b66f-8e8f85a602c1", "value": "393216:oef/zuHt3+uGdRj3VOGkre05Zgy7GVFhWTWd5QHPVhbq89pOTfzRWBpc:ON3Fa3VlsX6d0WoHPVhbq89pkfzRWBpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363890, "uuid": "cae8be87-3426-4888-8664-983d9bc40adf", "value": 21041973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363890, "uuid": "1f463617-bf20-4587-a60c-c0faa0e92c91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363890, "uuid": "cb4deb69-6013-4e07-b258-d7057a7b5ae5", "value": "PornTube_Ver_12.01.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b6a995-c3a4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763377027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377027, "uuid": "22270a0d-be79-46c0-aa5b-66d21fcaf13b", "comment": "Malware payload", "value": "1f015ac12e104112c1405489e883b03f", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377027, "uuid": "67bba7bf-31ae-4a18-947b-fa611126ca56", "comment": "Malware payload", "value": "5c77852d3b6432f99903a5718d9d5d34dd51dca63cd77bcfd05cf0bba84dd7a9", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377027, "uuid": "faf053e9-26e1-4eed-93c3-dbc1240744ee", "comment": "Malware payload", "value": "9a91a65ee253d95534e74d6e831294b1c1af65bd", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377027, "uuid": "ecaa8e6b-6c46-4b0a-870e-a482c78191e2", "comment": "Malware payload", "value": "ad46a0989a00a1b4ab63146a84cded8c3fe2681c0bcbf56617158b1298eba4236e6fd01bd22382f106a3496d591060ed", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377027, "uuid": "24f65be2-0f8f-48af-8315-35c59c1ceb5e", "value": "T18B714AA2B025326BDF67616462DB38A824A206DCA67673078DB9571886AC8F95723C0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377027, "uuid": "7dab8c06-0dc6-4b8a-a4f7-034352a4fa1e", "value": "96:j36wm8jUrgeQNOrSlTb9CyDDgLy/K8WuQBioCVMqq:ja8jdFY+pCywLy/3QBioCVVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377027, "uuid": "6d933652-3d52-4c80-87cb-83ec3cb30993", "value": 3754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377027, "uuid": "d90daf76-be83-4bcc-9941-f1f07087dc7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377027, "uuid": "84428743-8575-4022-aac7-f0dc960d50a8", "value": "October_SOA_Payment_Confirmation.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c76e5d-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363887, "uuid": "36c66676-3229-47e5-9029-d6d46c691bfb", "comment": "Malware payload", "value": "73184f78f6380a7d73496c0122d064fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363887, "uuid": "b57c761d-465a-4989-bea4-7c14b97167d9", "comment": "Malware payload", "value": "5c9f0295246648725cf6c9d05de63fc823978ef73baf78c6193803f76d90f0d3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363887, "uuid": "7836563d-4c85-4dc5-aff2-c57ebb5f9c87", "comment": "Malware payload", "value": "80329b21ab4843aa38ba7f5808b8a7290d5e9434", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363887, "uuid": "de93b794-3b8b-4da4-8103-86fe8bfa7e51", "comment": "Malware payload", "value": "d654b144c5be1d76b5da0ca5b0e5a17df4dac32d345c2e98986da28dbb39bde39f51000df56b3234d77148a8116ed4b9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363887, "uuid": "926a05fa-26f4-4497-a752-f46673ca3331", "value": "T139A533166B2C44A1EB2E303E1E4FC5147F2D8E829514A3179558F4DA6FFA4EC874ABC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363887, "uuid": "c420f6ff-2a84-4fc2-a233-4be7ae651cd2", "value": "49152:aplwlbFr8DqfxDakysGXbToqhSeYyDUEXvzc3k:apCr82fokvGXPoqh8yYEfg3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363887, "uuid": "faba949f-4adf-410f-bcca-6957835fe6d0", "value": 2214252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363887, "uuid": "3e727f25-0c1c-4053-bd82-8cc92a8f4313", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363887, "uuid": "d9aa363c-c7f8-4060-a582-4d090cb1305c", "value": "HumoCard.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2368ef04-c36a-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763352107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352107, "uuid": "73af5634-a0bb-493e-a8a1-a5f9b7bb9cc7", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6fa57329191020b054d12c379deb4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352107, "uuid": "36839f2b-e3c2-4e81-8b88-ac27d55bf337", "comment": "Malware payload (SnakeKeylogger)", "value": "5da0d4f3ca01a025c326099b5e41d72ccb73ba8f3534aa3875501fa4ae1ca9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352107, "uuid": "2b3a9dcc-36db-4a12-bda4-78f35916a95e", "comment": "Malware payload (SnakeKeylogger)", "value": "4e8d5019c8067b1ee4e150d4af17b0771f267690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763352107, "uuid": "58b36c40-442f-4890-a338-e3792d13bad2", "comment": "Malware payload (SnakeKeylogger)", "value": "46ad29eafa846c02bffa7fce024a2c3085dcd9841242838b944f99a5bad440a8cdc387b577ff5c9b0c38eb6ec39262d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352107, "uuid": "d77b12a8-3a9a-466c-8dbf-85926344c4b2", "value": "T1B676AE1993A904B5E82BC638CA65C333CAB0BD929635D10F095DF6461F73E628F2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352107, "uuid": "c5f1b853-980a-4378-8152-8acb5aa5b616", "value": "bf7449ae0b053c3629fa1a1b4b3b77cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352107, "uuid": "495b3798-16c1-4cea-bd58-da13161df21d", "value": "49152:g4a7oJBeYKytqlsKF8uwObSn+nLf6GYnQXWCry5P0mOSSTf/i2FjrfVdQDZWsfk0:IvYKXF06MdKQ1ON62SkjZJf/pf94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763352107, "uuid": "743db87e-8844-466c-a3d3-96dd0429edf8", "value": 7256576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763352107, "uuid": "362c425a-c2fd-46f3-8bb7-c5ac10a5c62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763352107, "uuid": "71d09e4b-4b51-4a06-9ebb-c71b04f8946a", "value": "MT MARINE TIGER VSL INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abcfefc-c365-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763350106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350106, "uuid": "1377ff60-fdaf-4a4a-9eec-6380e18136a9", "comment": "Malware payload (Mirai)", "value": "b835e098994333e8b42829dff16bef3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350106, "uuid": "62f04a30-5bf9-4f9a-84b0-044f911fc5f3", "comment": "Malware payload (Mirai)", "value": "5e554a3af322c2d09d94022a196e3616c58bec8b26f52b3a0843a410b5f0b214", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350106, "uuid": "3c77ce98-e338-4a1f-a1e3-2ad8945590b3", "comment": "Malware payload (Mirai)", "value": "b7b4039546e8dc7e185d02cc45c977ffa71bec3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350106, "uuid": "7acb4d45-560b-4943-b519-36e4c6290058", "comment": "Malware payload (Mirai)", "value": "3a3e519ea9866da948eb43d9984c59693c5c02ac6a48cb1b7af9a5d849091d7327e8e1105c289381204a8a2aad08b578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350106, "uuid": "5ceee189-0fee-4881-8089-25d2aad0b42b", "value": "T1E1B34B07B9C28CFDC049C034037FB936DD26F0EE1638B29B67E5AE266D0EE611A1D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350106, "uuid": "e0ff4870-7c76-48b9-99ad-c7425ea56862", "value": "3072:fKUHWXGmwgyrJcXcrx4E7XtfP4n5pWcbVDIQIG4IG/:fKeWWmVyrJcXcrx4E1u/WZviS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763350106, "uuid": "361be70d-5f62-4373-9678-6bd179b5a0d5", "value": 109968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763350106, "uuid": "645efa86-245a-4c8b-acc5-81a619a777d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350106, "uuid": "0554d164-b01a-4273-af30-63718647948c", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee89d27-c3c6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763391613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391613, "uuid": "d0bbc9b4-8783-4d48-b4c8-0b69f460cd40", "comment": "Malware payload (AgentTesla)", "value": "ea980016662be1e1440c7cedfa16436a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391613, "uuid": "392e9f8e-b7cc-467e-ac80-66bbd34b9496", "comment": "Malware payload (AgentTesla)", "value": "601fae907ab3defa23b5266dafb038c2ab56ffead7f63add3940d2f07928a2f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391613, "uuid": "49ae18c4-7cd5-48de-b800-9b0fc35a3617", "comment": "Malware payload (AgentTesla)", "value": "243592a19c155946f5f1ad406f048121b75d6c0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391613, "uuid": "f9f94554-0725-4769-992a-355eaa2575e9", "comment": "Malware payload (AgentTesla)", "value": "049e8ccc5d43c10fcb4913bb5035f0c3a6825037fc8108053b74ffecdf471efa577e194e8a41f0e00afe6fb1c7675d53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763391613, "uuid": "64cd2088-ef12-4f53-9bd4-c5239c592f27", "value": "T19045F2158DC82FB9CFAC9A1890BE151E93E0479F8126754EFB2BBD47AFF7644410B089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763391613, "uuid": "b1e49378-9c75-41df-b468-f5e0c2f0ca7b", "value": "24576:H+XXON+6UY7LXBjBnLZQDosgi5l0gzrRtsmiC+rdQ:HmXa86LxjBLZjubzwCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763391613, "uuid": "84968a53-2130-42d4-b4b5-3377d7161c27", "value": 1241752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763391613, "uuid": "1b277962-162d-4e7a-baa2-b7abf23c519a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763391613, "uuid": "bb7774b8-8687-47c9-8c2e-72c7f110242d", "value": "z39PO08252025_PDF.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1668d6e-c392-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763369498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369498, "uuid": "41aa43c8-35e9-43c9-818a-13f95f8df495", "comment": "Malware payload (Arechclient2)", "value": "deb872b8839287880f4325ac2fd2f7ee", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369498, "uuid": "7cce7437-e727-4f33-9892-ed0497103b16", "comment": "Malware payload (Arechclient2)", "value": "605573bb6ca5ff1331a45f5250d74f1c620cc7101d7d89a958278065092c6f4a", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369498, "uuid": "f9afe750-425f-430b-b50d-5b9230a3a575", "comment": "Malware payload (Arechclient2)", "value": "01ea5246557010f9e2d0f5fab010e44f54c2c562", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369498, "uuid": "e6eb09de-f088-4ce4-9845-ca59092e3734", "comment": "Malware payload (Arechclient2)", "value": "628ac0ae55ddb12ed2da029100ee6133f9ef3c512e654f6d93487c41b7e7576952e17c1c1f1ceeec27ed1448210d9920", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369498, "uuid": "174ac6fe-9199-4177-bdaf-664218d2d3ab", "value": "T106472331B64BC62BC57205B11A6CCB9F60697BB61F7254C763D81D6E19B08C2A331E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369498, "uuid": "8a4e26e9-d221-44cd-9113-89f3d70939c8", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369498, "uuid": "bc393c75-9574-4d37-b82b-a02acda612a9", "value": "786432:7U+Af9ZH8dQd1vh1Z8wtwap+ZelwzGw3a6:fvi1ZcwR+ZxqB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763369498, "uuid": "dd0c5537-4df8-4ca1-86ea-24d16feb3a21", "value": 26605360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763369498, "uuid": "1fbcea1c-7d3b-489f-ba40-a318a9a3a686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369498, "uuid": "d6c94f24-1bd1-4afa-b6ed-ea6d94e14c07", "value": "WalletFinder V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bda1d3a-c3a4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763377032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377032, "uuid": "de369819-85dd-44b4-bbd0-8cdc13a72103", "comment": "Malware payload", "value": "33f75454ee0a8f0733788f0ba9af26c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377032, "uuid": "b6b688bd-5943-4cab-b120-59c824b4262e", "comment": "Malware payload", "value": "61a285b25e9263ad4969c6626a8b9f93d12ec8bdcd8c7ed0e803e592133b448b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377032, "uuid": "62b08a7b-5043-41ce-a87d-680f935e2f0c", "comment": "Malware payload", "value": "122453018b8280020864e14a84ed255d4e051b3c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377032, "uuid": "5f5dca57-b502-469d-b3db-faf982f73abb", "comment": "Malware payload", "value": "949afb2d0747566228ec8fed839a8b482b83770083737848d42de707369e89b2bcb69bc51e2781a675004afb45ea1dda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377032, "uuid": "56a1cccb-9b62-4047-8fa8-0e9cb207e570", "value": "T1F80274887EC6B1BC0B765037184B70AA95A61C80F50DCD25C364EDF0A8D5E1DD7B79E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377032, "uuid": "1961b007-4d32-40ab-a2fe-0ecdc79d8b1c", "value": "192:hSrlyY3HyIISqX1MBcpkC2mLfTcf4Eyd6j+midjNCru:ylyCHyXSqfpkCdLfTcf4EyMj0dIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377032, "uuid": "1fd2b996-1461-4e21-83fa-8590e397c2ca", "value": 8797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377032, "uuid": "7f94f413-48ca-4fce-a5c0-f1756b16f32f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377032, "uuid": "c7978652-9684-4970-b173-6316163503e1", "value": "October_SOA_Payment_Confirmation.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4d7b3f-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1763366542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366542, "uuid": "a5bd012f-e12f-4cbe-b759-8575045b77bd", "comment": "Malware payload (DBatLoader)", "value": "4b226d614295fd81004102bf289a64e0", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366542, "uuid": "65b6b51c-c2e0-4785-add4-1bb3e6edd787", "comment": "Malware payload (DBatLoader)", "value": "628538d0f0ae72ea2f9151a36d547ca2c5a3cae513c0bb226c8491aa2ce90c81", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366542, "uuid": "d398c831-b313-45ba-b9b6-f231952ca1bd", "comment": "Malware payload (DBatLoader)", "value": "478bd54cdb4370278ed03cd00e1909888c44aaf6", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366542, "uuid": "6da61a84-4487-4662-abf0-5af2be1cb6a5", "comment": "Malware payload (DBatLoader)", "value": "410afa188f98db2cac71a29ed8f18bccb37da216cb6aa56c456f3d3a6fd2b64a6a984ef21d6b53c33b2db2c662e1e210", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366542, "uuid": "bc229ff8-4be0-476a-bd66-dfd64a69f654", "value": "T141759F62B1904576D13329349C16F3B96529FE202E38F8467ADC3D4C8FFB681781AE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366542, "uuid": "5863f5bf-9570-4421-9bed-7a9041f36383", "value": "f543c8e275975dcad6c8fc287d2c8819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366542, "uuid": "bef9c3d5-3a63-40cc-af93-3b85e65873ba", "value": "12288:H4egPJNRgbJSik63q7iiYcQKxXLEXY9QSPubm3HBKKhdRPtP9Ry:Y5PtWJSN63Pii+LEoa24KhdRPtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366542, "uuid": "29ac0329-b8c6-4f28-8c6a-a238ef4441b6", "value": 1595904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366542, "uuid": "48fdac97-1847-4e31-8618-2e50f42cbc30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366542, "uuid": "b887fb7d-4a4f-4330-bb43-85d8ce7452e4", "value": "BBQ 11-2025 IMPORT MATERIALS SDQ89488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de0767b-c3fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763415771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415771, "uuid": "cd62bff2-c807-40cb-9992-62d61ca46e62", "comment": "Malware payload (Mirai)", "value": "bc297cd0a956318094f5c6a9b4e5a01d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415771, "uuid": "287b65e5-cedc-4f8e-8898-849c2c3a9635", "comment": "Malware payload (Mirai)", "value": "63917b67ce6fc74a4461e6d748d6b189f2fdb12bbcc7f75eb692be4ad9eb2a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415771, "uuid": "6911a560-f866-464c-b50b-696c1ed3b9b8", "comment": "Malware payload (Mirai)", "value": "3d0ca13547b9d99926d12a66aad141bd4d28c9e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415771, "uuid": "1f4adf77-401d-4bec-a68f-d26fa960acc3", "comment": "Malware payload (Mirai)", "value": "eb3aafea259087fcb9c03f29db5bbf616eca86c7a366df602ee5e2cb6c7513e2bdbd3d704d1f7d405bf40e9c84317791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415771, "uuid": "dc061373-9aab-4dcc-91f5-9ce7a29f29c4", "value": "T10BB2CFE1A11B1770E6D1CC33EF5D4E83A3A68EF491EA3174766192B867502192A7CCCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415771, "uuid": "1762c199-9792-4126-8c9b-3389fe4c46ba", "value": "384:UoXhI1hkJLXXh8RXvuZoJsoutTHWnSUWKL+EvafyrSaSDbImhymdGUop5hx4y:UoXh2ALXx69JspLU467vHrStD/s3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763415771, "uuid": "94d18aa1-e3a7-48a4-839d-a4548efcbdb7", "value": 24360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763415771, "uuid": "dceabf48-847c-460e-9166-88544e78f1ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415771, "uuid": "71db986b-3521-4533-a29c-50c34fa40748", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9ee404-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363882, "uuid": "84ca90d6-0896-4b2a-ac94-0fac73aca178", "comment": "Malware payload", "value": "47a8d100ae656a64d191df34de871331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363882, "uuid": "dfefc57f-1524-4112-9480-387af4a5399c", "comment": "Malware payload", "value": "645afa537dda54bd9f2a7213eb9fccbe7d80eacf895aeccb605b8009a87b26f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363882, "uuid": "43a44cfe-bd88-4c37-9467-468841ef7eb1", "comment": "Malware payload", "value": "c3485b698947305df3d76b998e4828c0cc6de75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363882, "uuid": "bce5b79c-3887-48e1-906f-1d6b89f99411", "comment": "Malware payload", "value": "9a79be484732c42f55b3287b43d44e78003d2d2bbe1b43b29473d9176580cac0e70465ee6bef02fed41d4a25eb22bf66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363882, "uuid": "fb9474d0-3611-4cd1-b09c-00c345b3301b", "value": "T1CD92070C668D862BCA9D073F44B396C502BA9B53A483EF4F9CD0A1996A137C1145B7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363882, "uuid": "8760f7bc-a573-4cfa-928f-2324315a6416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363882, "uuid": "bb373e11-cb03-466f-a124-f4f777f27597", "value": "384:xKBSOOUnv+PBVlSTqbSz5Q+okJgTP7sk+vE:xKDOUvM4T9Q+eIFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363882, "uuid": "22d2bb63-86da-4e41-be93-f3c45a3aea92", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363882, "uuid": "b7027f27-af0d-4d6e-bd5c-d0c72a134059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363882, "uuid": "bc7f07ce-2e5d-4304-b6ed-56ab71a91fab", "value": "Auo1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281493fe-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763366288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366288, "uuid": "1052efc3-5fc4-4bcb-8bee-83052ae731d5", "comment": "Malware payload (Arechclient2)", "value": "eb43410aa249a8bf9db72a7a6dc255b8", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366288, "uuid": "1a21141e-185b-4a74-a49e-bfb37d89c116", "comment": "Malware payload (Arechclient2)", "value": "650b40d6f24227ee104f892659c90d04dcae0dd9b0ddcfe111f3d75fea1395eb", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366288, "uuid": "6971d98f-1ef8-45ff-b784-443daed6677a", "comment": "Malware payload (Arechclient2)", "value": "4184bd19f47c8adf5af7da0fd985ef0da799564e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366288, "uuid": "5ef417d9-ee30-46b6-8852-939c5ca2857e", "comment": "Malware payload (Arechclient2)", "value": "575a5e5cad6202d993e67b51f0ea8c7712f2e44e28290c890a0c8585b6111e78e7b1b769ba8395c18b37f80d4ad5c057", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366288, "uuid": "60460628-b304-4eec-a721-77c087b369d4", "value": "T19B35590772AC9B1DE2BA4BB57530C23013B9AF972815E609BCD6ECDF3961B4809167D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366288, "uuid": "ca66a21d-3c7f-45d2-9f83-afd61e9e58f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366288, "uuid": "e3ccb2a3-0c14-439e-9e9c-171b7c1daf76", "value": "12288:pih96OjpCCM5x/lYEithuihqKU4a8uaE9jj65nLTnIRvMs/g1JbB:pWou6iLvahaEon3IvY1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366288, "uuid": "c0e2b6d9-c7c7-48bb-b52e-ba3d6d447b00", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366288, "uuid": "474cad9f-27a4-43db-8214-7be5f1b73ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366288, "uuid": "ddf30ed3-e925-4222-ac82-2f9870538f4f", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ce5acc-c3b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763383646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383646, "uuid": "6d8c328c-8f40-45e4-b18d-49dde55de3e9", "comment": "Malware payload", "value": "f8cc9a7aefe295ef290b57ab043fd378", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383646, "uuid": "e34ba768-84b9-44e2-91a5-7699ff7cac35", "comment": "Malware payload", "value": "66b60afe1c94156fb8662720e965a5c3e08ff829f595b9dfd9aec5e5b8e5c03a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383646, "uuid": "4456d519-ad2f-492a-a019-83a7068254d0", "comment": "Malware payload", "value": "ccb7b349f5961a29abfa22998b42453f5aa7e4a2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383646, "uuid": "2619f5df-e042-4575-af7e-183b66da6644", "comment": "Malware payload", "value": "9a70bb07396fa9ea098c17eff644f41944099a7b6bb90def0c7c0466bb091733f022b5c870d703b0fc5c349ca4db404f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383646, "uuid": "5b1efe1e-3e24-40d3-b182-e01de3a8ed75", "value": "T16446F1CAFBD8992FC8771432C9BA52F166474D128E83DF436958360C68775E80F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383646, "uuid": "9e57b6d1-3694-4e76-b3b6-c91a268bc6fc", "value": "98304:9KdOR2nNkioEafu5ijGeBnw5ZSJXiZcmZjwQpKnu4iDXyx4bAhe1H+o/KrJ35v:ggydx3rSIZcm5wQpFT44bl1W5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763383646, "uuid": "3a76b1c8-3930-4f50-88b9-a239fcc2df61", "value": 5553230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763383646, "uuid": "8f92a59d-6f35-46f4-9cf9-3f57398c7c52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383646, "uuid": "45fd3524-3295-4c67-8a51-60c5870b39d1", "value": "Sara777.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d6525b-c409-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420394, "uuid": "6e438c6f-166b-4179-8d95-fae4dfc0e5b4", "comment": "Malware payload (Mirai)", "value": "e2358629d6b835a59f0de12c88f0ce93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420394, "uuid": "335f7323-755c-4675-828b-827d20e09b27", "comment": "Malware payload (Mirai)", "value": "670251565543d34305ec08e0a2199387b61a79ed28d159c570c6d2ab3bf0a6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420394, "uuid": "17b53a22-1125-4629-b703-642ac32f578a", "comment": "Malware payload (Mirai)", "value": "f84bd9027265f9a8f29bc1ad0d22b5efcd2e6690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420394, "uuid": "0ea7586b-624d-4f01-81d7-ea37084889cc", "comment": "Malware payload (Mirai)", "value": "ff45731d9e2749a3945c14bed7b51be1880e67ca3cb79b285858c6388b4813263d48d1e8f2e792c4c5f706e4ea125dd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420394, "uuid": "dbee67aa-59ab-4979-8fd5-f8302c08a297", "value": "T117B2E18A67DEA84ECC31CE39F478C303DD620AF971E375AB29101AB5E34F50621AE457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420394, "uuid": "d2c6fc48-c4b7-4638-84f5-75a712605eba", "value": "384:LD3OiPDuWLpUwt4UiSr9qHOFsrBpXS/Uq4wWeO3VmVZoIn4WR+WjbCPhymdGUopN:LD3O0Dd9Uwt4UiSr9dFoBS/UzwWeOFmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420394, "uuid": "9b2d7a39-e351-49cf-9a77-d199d28cd094", "value": 24216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420394, "uuid": "b1f2e128-0374-4b3d-a1c5-57868b771822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420394, "uuid": "af679661-38ca-4580-a878-b40111936f8c", "value": "wewe5.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813c406c-c381-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763362143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362143, "uuid": "eae8b6a6-976c-422b-abe9-cbf3ad2cdb76", "comment": "Malware payload (RemcosRAT)", "value": "797f6646baf063518966322aa4fd0a15", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362143, "uuid": "b624b6d3-e933-4732-9032-6e49206db9d4", "comment": "Malware payload (RemcosRAT)", "value": "68795ba7b18e443a1f26a9f903b455397c4e3f3d9e4673aa5bd90cc702c37704", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362143, "uuid": "8479b214-16f8-475e-ba68-d0889d4f979a", "comment": "Malware payload (RemcosRAT)", "value": "d524c19000f1c9c3c4a822b8b2336660082a8101", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362143, "uuid": "7db515f0-9934-4787-9b7b-028265528859", "comment": "Malware payload (RemcosRAT)", "value": "b07c49d335dedbd21d601c1264a5010e613fdb5b32cbfbb813e2688d9dcfbd8a5dd45acff664db9614c61c50ac25b3d3", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362143, "uuid": "49f9b133-0261-40e2-ad6c-4b127edb4b66", "value": "T1C1B6E87337C6E59639ABDD1A27609A609C873E33384DC818F1E5231721F5E25EA30D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362143, "uuid": "decd4c26-c155-4b42-871d-ac4d183ad160", "value": "24576:soIxbQYUGt0AOnej/O7Ll8+QCCNoO1M9IOYOMxtyLtgyL5QOAZ0c8deNPjFVJsnk:soLC2Mi9uqexFVJG82v6vB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362143, "uuid": "c5b2d5a6-b934-41ac-b56b-01606f032b96", "value": 10955756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362143, "uuid": "98f409dd-fa54-4a09-8f1b-6854f99ef1c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362143, "uuid": "a4d54690-db24-461e-b4f9-7e438a68cef6", "value": "hsbc_swift_54398 & 64111.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969b2e85-c395-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763370769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763370769, "uuid": "0fe5146c-9965-41f5-85f9-ff7e6eefd945", "comment": "Malware payload", "value": "f51ebc15fba278a065f9b796452ba5ad", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763370769, "uuid": "5e748185-9c04-4527-8464-d3b5a67291aa", "comment": "Malware payload", "value": "68eb36390a8598290ed9e84449ac74ee8eb0070dda1ccab95656dd8f8c89bc07", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763370769, "uuid": "4d88afac-f0a3-4d1e-8667-3b0c77154a78", "comment": "Malware payload", "value": "bb7dfdbd7341c46890b9c57156a24d71d3558371", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763370769, "uuid": "ce2b4df9-b5d9-41ed-84c9-1827e1c285eb", "comment": "Malware payload", "value": "f3cfef2c2c964676f21bf153becb6d579ca9bdb146fff2dc5f32b5cd38013f6e0b112dfa4867d507dd5dfd3ea0e5b06d", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763370769, "uuid": "8edafab8-1f37-49d0-b20c-a6274e5fc6ec", "value": "T14101D6BDA1A88A5205B5C5C7B2F14546C490908BA2EE57E6F38D09276F28CDE3C5320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763370769, "uuid": "7e86b716-ba60-4bb9-aa74-e0df5fddc046", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+MjRCk4DClk4DoBjZhG+E6:FH8j/wWi2jz8PFSzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763370769, "uuid": "10efc095-2265-4ee1-80bd-4d7a82ca3fb7", "value": 740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763370769, "uuid": "3a6952f5-afef-497d-9813-cf151ccd661c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763370769, "uuid": "33b609ba-ae5d-42cc-ac0d-0a045fd5f16a", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e795254-c399-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763372500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372500, "uuid": "8cdd00e9-3aa9-4276-ba04-9fc3a35f1b4d", "comment": "Malware payload", "value": "36a6e5e94f9523b1b1e16fa57e8874e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372500, "uuid": "a75ad107-2c40-4732-801d-9e5471b0565c", "comment": "Malware payload", "value": "6c918da3c47f951816b455e43dd161e490e7fedfd1960d605428a16d5bfce88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372500, "uuid": "58f938f8-8fad-4a72-90a9-805f4976b4e6", "comment": "Malware payload", "value": "4c651d9d13f9b5d8dc8d3f93b53491e9a8f4cdba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372500, "uuid": "8d1f97d1-cd1c-406d-a9c2-d9dec68b96fc", "comment": "Malware payload", "value": "26d5ce57b5d52c3c4b6980d3b192990bcb178bdeabdbded8876653bf54295c193ebb92209076c931b692ca8ddbab7c8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372500, "uuid": "9c69eca0-6430-4cfd-b77b-3afd1f2e157c", "value": "T1A0647D15F7A454B6E1A7813CCD638905EBB27C424760AACF23A04AAA3F37FE0563D751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372500, "uuid": "f0da1efe-6182-4b4c-90ca-f664b27f1d5b", "value": "3105c4e5313f95ee82c69a108d83ad92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372500, "uuid": "bc68a320-a80a-45d9-8251-25814b345c58", "value": "6144:7ImYhAEoC2gf+fs5SPrjhWZ4Vx5K4aPz2MLX3:sLYlP3hRVea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372500, "uuid": "e65a0d19-0866-47ee-9256-563ac0924acb", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372500, "uuid": "a5bed966-9403-4d80-8615-167e81e86bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372500, "uuid": "293e55dc-1042-4980-8836-854607daa8d3", "value": "6c918da3c47f951816b455e43dd161e490e7fedfd1960d605428a16d5bfce88d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae10a87-c38f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763368333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368333, "uuid": "4bbdc229-8810-4f83-905d-b5ab5ab15354", "comment": "Malware payload", "value": "2e21e823314ff4f78c64b51da3cca7d6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368333, "uuid": "0889d332-f06b-4f16-bbb2-8f038da1ef18", "comment": "Malware payload", "value": "6d92af465b691a086df68c5eb456af62ee899ca02b3753be7ce14add7d9979a8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368333, "uuid": "5fc6845d-eaad-4621-a54c-04b49afef2ec", "comment": "Malware payload", "value": "2166d28e8f9ee059115879216e662d1388c79653", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368333, "uuid": "3679c38e-aa37-4168-8cf6-f9823908a43d", "comment": "Malware payload", "value": "8f50456076818052769aff29aa9e2562f1e58fa98b7432d39e2fa43873b95d1dd7f51056e7e5161d6ffd957964271f22", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368333, "uuid": "e0fc4ba1-30c2-4aed-9f0b-b2e88220d1fa", "value": "T1EF21F36427D48320E7F74D3B587BD3108E66F88AEE678B5E0955428D4960210ECF5F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368333, "uuid": "bf8b09d4-af53-4336-9aca-0ee8b55cd759", "value": "24:8DhJHnoiZepABPZn+/xK6rCiycGfhH24I0W5SGWGSpoT:8r8qLMNAcEHJICvno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763368333, "uuid": "1ccfa1dd-fa1a-4629-99ef-55842c32c072", "value": 1278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763368333, "uuid": "07b97c5c-dfe9-42fd-b25a-f5696db5599a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368333, "uuid": "4c7fc98c-638a-44bf-af59-b88ec01ae273", "value": "Reconciliation details.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6807b6ed-c3e7-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763405909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405909, "uuid": "776aa839-98b3-4464-bc8b-c5c24718b6d6", "comment": "Malware payload (ConnectWise)", "value": "0467569df237ca43c0cf01abc98e778d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405909, "uuid": "56f45943-d311-499a-b6eb-64b8657bb820", "comment": "Malware payload (ConnectWise)", "value": "6e9bae783e08efe7aeaa5af54e7affc4c8161476ea4b367a87a0ecb3ebae1f71", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405909, "uuid": "e1209f37-4eda-4027-85d9-156155821edc", "comment": "Malware payload (ConnectWise)", "value": "b5d97d08f0112e040e679b9d421602bd182d118f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405909, "uuid": "10610886-ea36-4182-b5f8-1d803339f51d", "comment": "Malware payload (ConnectWise)", "value": "f48426a9eb75386cc02949de1680508c6e4d1ccbf77ad4d96c3107c0049e1a0b365b9ca3ba2f0862bf0dfbd6d9aad1a1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405909, "uuid": "909f3511-059b-45eb-8ae8-bcc503a975af", "value": "T107E5E021A3E4C136C0BF0639D8B95561A7B4BC099366C75F57A47D6D3E73B808A223B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405909, "uuid": "02f2d7ac-3a7c-4614-9f33-7d40e76e7fc7", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405909, "uuid": "f9e2217a-bc16-4fdc-8f5e-4bdb25ef3f4c", "value": "49152:iZwPTPFIST0+TL3Z0Mi963PSugQeccp6EsToWTn1Yt+fLbXGundZRT4T1g9:iZkyZ16MAEsToWT18+vGWkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763405909, "uuid": "e9fc845f-33c8-4ea4-a998-200efd2d7e3c", "value": 3282064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763405909, "uuid": "96a5b483-0981-4fed-80bb-eeb8bda0a98e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405909, "uuid": "fc34f21e-a2d0-458e-a71f-f457bfb91987", "value": "Social_Security_Statement_583024_exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ddf6ab-c3a6-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763377831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377831, "uuid": "141dd0c9-4609-4af1-87bd-419fd29e32ff", "comment": "Malware payload (SnakeKeylogger)", "value": "0b820907d26827567fe93630b1349a31", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377831, "uuid": "13a1a60f-6001-44fb-a6c6-f3f647fc25d4", "comment": "Malware payload (SnakeKeylogger)", "value": "700a9d5bd0b258df28ae39c19e2df55d90b9e81e867cbadc1370c299ced910c6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377831, "uuid": "697cfe45-97bf-4f06-b984-8d260935ab98", "comment": "Malware payload (SnakeKeylogger)", "value": "711c71d02d1c274ffbd86975f44913658c9a8a6f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377831, "uuid": "f73d68e7-19af-45af-9c00-0d782b2c03d0", "comment": "Malware payload (SnakeKeylogger)", "value": "1476e3283ad063ad45fc30e207f3586bcec84b836c6f81ee436c5442a90619de388612dccb2c21054dce60153c7c2b18", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377831, "uuid": "c2a61307-5b29-4042-a834-50a7a954d94f", "value": "T1A5B4230A25043B2CB20D1197B7A68A7E49CC45DFF47EC42BDB5ED06165A23CBAA47F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377831, "uuid": "2aacb394-5273-4c87-99d6-1286ae327736", "value": "12288:ZIN8wnFaDiJNK5MNGwtHvb6lrndHhV0skdXPpchri:uN8sFaUNpWjdH/fkdXPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377831, "uuid": "f5371fe2-1f19-4737-935e-3423db82de0f", "value": 504347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377831, "uuid": "cf0a39e7-8864-497b-8082-fbfca470d062", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377831, "uuid": "b29cc2d2-44f8-48e0-ba84-8750e4309a68", "value": "5310748200.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c815b1aa-c3b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763386314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386314, "uuid": "a8ca963c-0e7c-4f30-a30f-334a20c1f0d0", "comment": "Malware payload (Formbook)", "value": "2b81f023a59f82542ea89ab485b4efbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386314, "uuid": "3df16052-3b9b-44bb-8a58-0c5239bb57c5", "comment": "Malware payload (Formbook)", "value": "7051251ec9dccbd7571cb7b3c30e5f64ecf1feb7f3694b38a8307e24a3ba56ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386314, "uuid": "00d2d25e-eb06-44cd-a8af-cf6eb3c84175", "comment": "Malware payload (Formbook)", "value": "ec6862b8250157309722224dec4e517b29fc9089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386314, "uuid": "ac6beb51-09c7-496f-93dc-cc7143a0de8c", "comment": "Malware payload (Formbook)", "value": "217ed8c2662da32d7ea5f8082de56298a252417e385acb6cb299f0f8a32eeebcae9bbbd6dacc8c7b5f1b6fbf3a1966d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386314, "uuid": "2e9f661b-56fa-418b-95cd-4a61a625b43c", "value": "T17245C01373DE8361C3B25273BA567701BEBF782506A1F96B2FD4093DE920162521EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386314, "uuid": "fe3f48f2-02bb-43e1-8b9e-3bc12cf68f29", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386314, "uuid": "5a6f4b62-0312-4c29-aef2-adee15fa10f1", "value": "24576:Ytb20pkaCqT5TBWgNQ7a0crfDnSWjxXW2BvEuZ576A:hVg5tQ7a0wfLSWV7EuZ15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386314, "uuid": "b4b34caa-8d35-4afd-b4d7-0849e0033a8e", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386314, "uuid": "ffc11838-ce40-4ed7-bb51-f554bcd44286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386314, "uuid": "49c97336-0920-4b3e-9a48-dd24c3bb30c8", "value": "DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907cee16-c398-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763372047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372047, "uuid": "b6092966-25cb-400e-81fd-5f3d413ee952", "comment": "Malware payload", "value": "301db43099dd7d340b274789616f126c", "object_relation": "md5", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372047, "uuid": "7a5d0b8c-9dd9-4250-b33c-c65f3b7b667a", "comment": "Malware payload", "value": "7144fa6258d7efb3a5f97443d77add4bc0a0afe9e67a3ba8c3f5a036cd6e6226", "object_relation": "sha256", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372047, "uuid": "cbc01d2f-d333-432f-bbb2-7d67d048b372", "comment": "Malware payload", "value": "ce61fd25cd447f1002693b881fb5ce71b5dea95c", "object_relation": "sha1", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372047, "uuid": "c227c59f-a663-43ac-bca1-039e60be66a0", "comment": "Malware payload", "value": "6569c68ef7333b50bb3b7d8f735dceff36e25a35438898cf28afb9e0d5c94fa95b3d509a26657756641e17a40887fbb5", "object_relation": "sha3-384", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372047, "uuid": "ca5d9e5f-1214-4c36-9a8c-633c84be0c2b", "value": "T18F259DDD726072DFC85BD472DEA82CA4FB51787B831B5213902716ADAA4D89BCF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372047, "uuid": "d6cc1dd6-8ad0-4153-8566-8f792670d048", "value": "24576:DHB25WuEpqO+s0QxVXH9AXxTpRL5DpVfB:jM51ET0QzgxTvLDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372047, "uuid": "446f22f7-9081-4a78-99c9-48331fe01d44", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372047, "uuid": "0040ed82-1cf1-4af2-b559-1ddc3b6b7220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372047, "uuid": "2ab9398d-6aed-4ee8-bc1d-c63af2009fa8", "value": "x4brv3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f706e0ed-c39d-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763374367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374367, "uuid": "8838375d-8c0c-46ff-9f7a-58a046a9c74d", "comment": "Malware payload (SnakeKeylogger)", "value": "630fa7b5bec2b88d3634425beb9b5876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374367, "uuid": "b62e6d7b-21cb-4fdc-bcd9-44fa1952a1ab", "comment": "Malware payload (SnakeKeylogger)", "value": "71ea8ae52ce63114bdc746b32bab4848279e27979fbb9814cf600bfd4b6e7623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374367, "uuid": "da3f9b46-889d-4f16-9cd3-14e7424e0c97", "comment": "Malware payload (SnakeKeylogger)", "value": "e006d15f26b3ed8b2187eeb69d98d76dd07d47ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374367, "uuid": "6e5362cc-c80d-4328-afbf-9a5c02f2700d", "comment": "Malware payload (SnakeKeylogger)", "value": "a8fbf44dbc9b99e0884a3deb6b657efa9149dddd5442d86928a02701528eeb6f746fbc64240fdffadd4f61c78f2a2381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374367, "uuid": "0efec4ea-356f-4c5b-852c-40f3356fa2a8", "value": "T12A76AE1993A504B5E42BC738CA65C333DAB0BDA25635D20F095DF6461F33AA28F2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374367, "uuid": "d241ca23-4a4f-4231-8046-ef2889aae6e0", "value": "ca2ca158def4417eca14aca89ac6bdd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374367, "uuid": "97d9bfa7-5f53-4726-9d06-e6dd97aeb242", "value": "98304:+Pnu4gE+oA0PEmdY0e1twG35TZXcKGgExKQfG:+Pu4gE+oRcZ0e1twG35ZnWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374367, "uuid": "690e3047-2f0e-461d-9cb4-400dae65e7e9", "value": 7260672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374367, "uuid": "80f1cc60-5394-4a49-bb8e-432d4948110d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374367, "uuid": "71ca2fc7-3c38-4c8f-8a32-839aa93595f7", "value": "MT SEA LADY 1 VESSEL PARTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343a1f22-c403-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417848, "uuid": "2b427c14-fa57-4197-a5b8-babbe8abbba8", "comment": "Malware payload (Mirai)", "value": "19f5c4f75d5239c2ab1f408fd06255ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417848, "uuid": "df7ad75c-6199-4968-b989-62c2ed8c275c", "comment": "Malware payload (Mirai)", "value": "71ed443a216b113af9404a90ed2357fdc544e461383722358374de3f9305711e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417848, "uuid": "16884ed8-ab3c-48ac-9346-edc49bd5b4ee", "comment": "Malware payload (Mirai)", "value": "32ac2a0bc94c21218c04e409c292c26f536d07b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417848, "uuid": "3022ec71-6b0b-4319-9a37-a2f5d25dfc31", "comment": "Malware payload (Mirai)", "value": "1be4ae130bd0f00cd70994bc5bc82035d8185c33c5e9b3502af86c657e145c442afb2924d4bbe9bd88f6e5012dadfbac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417848, "uuid": "2057255b-2a1e-4a1e-a4c9-120c61fd087f", "value": "T160931856FD818B22C5D512BAFA2E118E331317B8E3DE72129E205F207BC696B0E77D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417848, "uuid": "ace757a7-429e-4546-934a-f7eddb7ad5f2", "value": "1536:xFYnlEuYrEYum7MmrKyvBfHcCqy4IaoyluQkNMhi9EH8N8Y8T+56Ysq:xduYrWPmrTfDa4o8N8Y8T+MJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417848, "uuid": "dffc406b-c467-41e1-903e-84255f9d34d0", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417848, "uuid": "16419ebb-9517-4895-8194-c272fbb79489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417848, "uuid": "9b39213f-f7f3-4ff2-a4fb-076d6e8997df", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d8e4e7-c385-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763363686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363686, "uuid": "cb1f05d2-c6fd-432f-876f-d54d41b65d1f", "comment": "Malware payload (RemcosRAT)", "value": "1a1e2f0787bbf11ac400474f96760865", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363686, "uuid": "f42ded6f-d73e-4770-b716-97431f7252e0", "comment": "Malware payload (RemcosRAT)", "value": "730ba37fc2128b2aee61ec391d25a2b1c842a11fac3e8f09284cd40ea7df048f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363686, "uuid": "074f1819-b5cd-4d54-bd3d-743302dcaa08", "comment": "Malware payload (RemcosRAT)", "value": "b044b7a46cea33c7aab911067a12b0366f7d8ac9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363686, "uuid": "b4c65483-d143-4de1-afc6-a8f866c38028", "comment": "Malware payload (RemcosRAT)", "value": "1d0e6291bead4c9620c91259196c88bdbefa1a60a2f79f0dfd59b85c7270e1253c15f84e879418b9da37d4f7b6478980", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363686, "uuid": "3dcf84a1-2c73-4fe2-a0de-18264b2cbdb0", "value": "T13A6396E59E44BB44984E82F872873FD297F134BCF0925B8F990E1FF9556583B008A4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363686, "uuid": "fa0728ef-4723-4c81-a0e5-2f3ac484c297", "value": "192:MM67llx3WKHMUC7dfMylxWlpdLw6YU0sxltTvk38u8uN2x3ub3FeLTu2Z6y:KLTu2Z6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363686, "uuid": "70578444-1d05-4cae-846a-97b42b52e487", "value": 69621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363686, "uuid": "dcdaee26-a31f-4fe9-a5c2-4e87b1ba73e9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363686, "uuid": "de8b0637-4745-4ee8-aa99-cf9039261e1e", "value": "sdf0909fd90g0d9f032008098g908df09g890898sd0asd0a9f09sd09f009s0.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0b0ee5-c388-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763365010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365010, "uuid": "0c388343-d708-4420-b292-56e8e9ac1615", "comment": "Malware payload (AgentTesla)", "value": "23bb1a4c8a9cf3370420bbf096cb710d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365010, "uuid": "9c20c74d-b98c-4dcf-b62c-625381ae311a", "comment": "Malware payload (AgentTesla)", "value": "735d0d3e060109a3bbd3d986a45a3d1fbc50d51fd4231c330dbb94ee8aa7576b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365010, "uuid": "0246a5d9-9b00-461d-8f85-0f135b71b24e", "comment": "Malware payload (AgentTesla)", "value": "eea666e3f15ba758b631be2265c1d859645a58e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365010, "uuid": "6b1d45b5-2e15-4da3-95b8-601de12b17b8", "comment": "Malware payload (AgentTesla)", "value": "7cda1ea80db6891f30aac4e9b3acd1a22d8319b2b427df7dfd0dd829aec788f4e275abbfbb3d1cdc7f4c29339140c846", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763365010, "uuid": "d1a8b94f-8a03-473b-9644-2f2a0578e086", "value": "T150932C90CDE216359F4746FAACB449E085BC46190531D8BEF77C231E211A99CE3FEA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763365010, "uuid": "ab3f6984-01c6-4b08-b040-21886fcff284", "value": "1536:sIqRWxEgU36KBEHi125rjxAyodYD02T6F1WgzjKA5EyuzBAomf/qhvc:sI6WxEgU31BEC10jWfyD02ubl/KrjBhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763365010, "uuid": "b5b3c8a4-43c1-4066-9433-7ccaed3de28b", "value": 92363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763365010, "uuid": "7792e8e3-31f8-4d77-a4fe-167aa330d5d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763365010, "uuid": "76d21f44-17d7-453a-b642-d845dc2a28f5", "value": "Zamowienie_CIMC Trailer Poland Sp. z o.o._0051_11_2025_MP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a61dce-c3fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763414571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414571, "uuid": "c07a36b8-247e-4a2d-9946-b4b93f70528a", "comment": "Malware payload (Mirai)", "value": "e5de813a8f670632b8cce434ece63fe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414571, "uuid": "51d2b1e1-e2a0-4fce-a33c-ded300ce8e01", "comment": "Malware payload (Mirai)", "value": "74170a69e92a18a66b338715ba891d3cf3bc2c4c003ebe3340f483282fcb85e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414571, "uuid": "a98494d9-e691-4b93-8e79-af387e6b4cdc", "comment": "Malware payload (Mirai)", "value": "d1d0aa6a8fe6c05a57bfbb7250cef8e610835938", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414571, "uuid": "5ae595f2-2340-4b36-8333-a5aeff5d1d6f", "comment": "Malware payload (Mirai)", "value": "d7f5ddf4ff509cdb08a950256c55c74cf11dd3d3c78a181169938013f7e36c35f81d50bb570dbb126c9e0eaae1d5924b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414571, "uuid": "f3623ad1-df23-409a-ab97-51dec8fcddca", "value": "T1A6F3C54E6E218F7DF278C73547F74B64E39923D623E18A45E1ACD5101E6038E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414571, "uuid": "44822589-1157-45ab-9616-e8130bd72ce2", "value": "1536:l3MsLy2VEb/iH9qUsaZNsspZtc4sxwkMbE9qTO2OZ6iho5+eauFjNXPzKD0ed47m:l3knUt7sspZ8LgTD5+s5fWwH7hJZekcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763414571, "uuid": "aafa201e-55f8-4343-96f0-4807da0faba4", "value": 159440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763414571, "uuid": "9f2da60b-0249-4bb4-8079-0ff249a019a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414571, "uuid": "706b78b7-347d-414b-9025-9c2163192fce", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed564d54-c3c8-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763392819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763392819, "uuid": "63b579d0-a25e-43b5-aef9-a2084ac4c791", "comment": "Malware payload (PureLogsStealer)", "value": "9177746e794b434c8712d2d25ef4b0db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763392819, "uuid": "a03da810-0531-4f97-9f59-d192d8d00e54", "comment": "Malware payload (PureLogsStealer)", "value": "750bfb6b02d5ebacb9e4eb938ffb64751feccfaf0c883b5489b77d26825d1009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763392819, "uuid": "bb4764e7-0ca3-40fb-b5e8-e8d5df81d143", "comment": "Malware payload (PureLogsStealer)", "value": "e7e7488dfc4ca1e3b77d0e76b4d4ad55e11dc3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763392819, "uuid": "e7f6e260-0844-460c-ba32-0e15e81c34bd", "comment": "Malware payload (PureLogsStealer)", "value": "b8bedbc4b799bc4d2939e2ead1ddab12bc47a1334e50ca963fa52ceccd0c861e199e792f6ba3a941ab73de221948101b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763392819, "uuid": "8526cf10-dc91-4c4c-ba85-8ec0d93845e3", "value": "T1B925235FB9FAAA51CB284B73D00B450001F95899E675FF5F21C628E02F2479AC4CFAE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763392819, "uuid": "f8366d7d-235e-442a-84f0-09570c32cfc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763392819, "uuid": "6928de0f-03b0-483a-bdf6-cb1147cb7511", "value": "24576:Yda3UZ1zl+ov1xfRALmIL+l2V+1FnhBNkCLcd2gL:YkCl+61xfRP2+hBN3O2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763392819, "uuid": "23877680-564d-41ce-9885-0c5f4006188c", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763392819, "uuid": "463ec35f-a2d4-4126-b96a-ebd0cebafd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763392819, "uuid": "a622223b-5bca-4304-8505-d1c41f4a3d59", "value": "9177746E794B434C8712D2D25EF4B0DB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14625fdb-c3bb-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1763386871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386871, "uuid": "88f96253-4dfc-4d91-9ae6-a323ac95db0a", "comment": "Malware payload (RustyStealer)", "value": "38773cb9441e7e751cedb1fec5bd2388", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386871, "uuid": "a94b2092-ec1f-4255-add4-c3629f455b03", "comment": "Malware payload (RustyStealer)", "value": "770f87be59bd619203b0a171f44d848463a421368bff75a878a7610d88e992d2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386871, "uuid": "afbccd80-1019-4ae8-aee2-c5da9bf02275", "comment": "Malware payload (RustyStealer)", "value": "d7732891f0ae01759953bbf30cb195428ee9c2f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386871, "uuid": "22b22f93-44ad-429a-8754-102e170f39e7", "comment": "Malware payload (RustyStealer)", "value": "89a948864db930460805eb0a4252c8f9380593b290ccb51902fbc93c8564e0f497ccd8c984a0df340f5ce6eff15123fe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386871, "uuid": "25681731-1ee5-4813-bce4-9ca995834a94", "value": "T128767C03F69581E8C0AEC174C35B9637EB72BC890624B29F5BE44B622F26F605F1D359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386871, "uuid": "6dc62253-ee5a-49e1-ae5f-a6a3402db720", "value": "e1ce71f25140de24096ec0512713020e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386871, "uuid": "ae51665f-a5fc-46f5-8cc3-713efba295fe", "value": "98304:5vKxQwCYpA5qz66jh2kdDZofkdLskQCY8lGzvn+ZoJ:Gmcznjh28ZWkqCNSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386871, "uuid": "9bc50efb-1836-4921-88bc-ebf41ef15859", "value": 7394304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386871, "uuid": "a3a30bfe-b0bf-4730-bd19-058995768fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386871, "uuid": "85d89fe7-0392-4d2b-83ba-a828bb65de47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce6436c-c402-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417460, "uuid": "b6e04354-65ff-4e3b-8566-8edb2ba7aba8", "comment": "Malware payload (Mirai)", "value": "40351f27009f85f2628d3e1993986195", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417460, "uuid": "7ab6e5c5-9631-4db9-ba23-39b4742b2996", "comment": "Malware payload (Mirai)", "value": "7894c19c4bb837174c36824bdfe21115e41d8020142b6db48346eaa36758a7b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417460, "uuid": "b00fd6a2-c499-4bb5-a853-a78dea8633d5", "comment": "Malware payload (Mirai)", "value": "f72e034063c6e7ab2b758ce497f9fd0ce769f5cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417460, "uuid": "82e89f69-eab0-4a57-bcf4-49cc790554a7", "comment": "Malware payload (Mirai)", "value": "2a191025f874bc9255f03911c65740eb7ac2efba00c6831f3d59825dba8d54a72ab9ab319e0678feb392dfb330e8e189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417460, "uuid": "5de46e79-6d55-42bd-a8fe-c6d27af50fa6", "value": "T1C2F32C0AEF510EFBD8AFCE3701AD0B4735CDA55312A53B793538D928BA0964B4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417460, "uuid": "f1578a68-70f7-44e6-9aa5-b7032794764a", "value": "3072:apo5wZPkbu3CMazvyI+zzfJ1wwWMqi/FuLLwXyLeGppadqODN3qyA:aAwZkbiGIMi/FuLLwXzZqODJqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417460, "uuid": "f8ab9e81-ae91-4d25-8a6d-add0ae2b2b38", "value": 163536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417460, "uuid": "e108c330-8206-4675-a49a-aa97bbfa09bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417460, "uuid": "e7f4831d-1009-44b6-bf08-115105945bf6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb4723b-c3fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763414963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414963, "uuid": "830586b5-a235-43d5-941f-9d5725bb2404", "comment": "Malware payload (Mirai)", "value": "01a3a7e0c29504bdb6c5b59992a4c9ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414963, "uuid": "6fe04688-924f-4658-89f0-bd02feed9042", "comment": "Malware payload (Mirai)", "value": "7ae56736e08dbad45468a7fc39202181319034a103079955f543ce6dc744b95c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414963, "uuid": "521e401f-cc1d-48b0-8e63-4d6f0f872518", "comment": "Malware payload (Mirai)", "value": "82a492a0d895b76a7e540eebd048c77e80f1c35d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763414963, "uuid": "f242d92a-6043-4d7b-a6eb-7a7b0768775e", "comment": "Malware payload (Mirai)", "value": "f2b6b759579d0f7b2d2014455e2586f7c02f5e2f0f72f86c0d69588a6156bc6685c9df5de114e6f3a7d9b7e9de53c147", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414963, "uuid": "ff863335-5c6a-4e9b-abd2-d17da47e190a", "value": "T1B6A3F90ABF510FB7DC6FCD3706A91B1524CC654722A97B367934D828F64B60B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414963, "uuid": "c8a1a596-3b44-4b89-86e2-57af7856205c", "value": "1536:ftNYAUS9lFnQ+GwRw4n5Ehqt5D4z/NqZ3a65Fdx47cce2Lq:fnUS9JGWtkqQte2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763414963, "uuid": "add2a111-d3f0-45cd-a619-427c10172438", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763414963, "uuid": "83b6e143-db27-4e94-9ddc-3cf2271451a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763414963, "uuid": "3d166ef3-8a59-4096-8efa-38fbcaa03186", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7eb1a60-c384-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763363631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363631, "uuid": "d9f3ef9a-aabd-448e-920a-b828ac9ffeb6", "comment": "Malware payload (Mirai)", "value": "3461c1df2914c8861be6b50d24683bf7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363631, "uuid": "539cedd1-35a0-472e-94f0-cb5d1c566f78", "comment": "Malware payload (Mirai)", "value": "7aec8dd6fd455cd313e5513cbd65c798f50a364b396b231a2cf3baf353cb548f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363631, "uuid": "6632a25e-faab-4dc4-97e2-bf47f26c0ba4", "comment": "Malware payload (Mirai)", "value": "79face13a6d331417e0fdb5dac6c7ac9e4a95d25", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363631, "uuid": "75ed4621-835c-41c7-8f58-5d648c7b9323", "comment": "Malware payload (Mirai)", "value": "e5d64e9a2a352ef531ca9a37f4423c48e6036507eb6394468e2ad899dabc152dcce4dcd64ca10ce00de9a7e75585df62", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363631, "uuid": "e3d42a09-d462-4e04-a93a-73b9aa071b5f", "value": "T1656170F72388063B5CB6C9D672B90444B19491AB54CE6F73ABDC34B61D8DECC7C42662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363631, "uuid": "0302e3fb-bce7-491e-92e0-17fab99c0743", "value": "24:xDJStMXSsBbuSP+NSU5lASynYSGTUSTnTGxJSpA/S2jMSlnlNIpJS8xMtSgduS7e:NJbo1Mam+TQJTGpYCNGzBgJVFjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363631, "uuid": "56fc783f-14e7-48bb-8393-e9aaa84cb209", "value": 3365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363631, "uuid": "41ba355f-30b3-41e5-a179-ff8c47848fde", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363631, "uuid": "18cd3d45-d896-4539-be63-5f88a556c31a", "value": "2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7494cb-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363932, "uuid": "a2ec0748-4362-4760-a89d-6a38b7b40810", "comment": "Malware payload", "value": "ff62f48695ba8803f822f1ed59aaece1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363932, "uuid": "108bcba0-edc7-4baf-a957-69b084f311a2", "comment": "Malware payload", "value": "7b218f7df29eebcee1983aaf1e5c031eb903642f026ad5a910b06ea0495fb276", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363932, "uuid": "75ce0600-395f-45cd-b703-eda38da250b1", "comment": "Malware payload", "value": "e73648885004d873e847d2f11fe4856a4f1c6367", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363932, "uuid": "dae6ba8a-c6cc-487c-8dd1-3290ab4be0c8", "comment": "Malware payload", "value": "0ae1239f41d145c90e50fc57b1775354cba8872312db7b88b5094b807fa07fa6f5ca7900b9eebdddfa7e2b72c412f645", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363932, "uuid": "27ad783d-b6d0-4e6d-9eb5-ac41f4745742", "value": "T17746F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363932, "uuid": "467de174-56a4-49fb-a24b-a441f62c7fc7", "value": "98304:6RPB7oTwrY5KOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClt5:mmKOfyaIbaciAFvrEZpXqmY9XrF/mpC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363932, "uuid": "42d53d83-e744-4f19-b19f-5461a17bf56f", "value": 5813123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363932, "uuid": "e8e5bc2e-69a0-4e04-828e-015dab34dd4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363932, "uuid": "2a58cbce-3a62-45a6-90b9-450bb97242c5", "value": "boybet168.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3ed2bf-c405-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418639, "uuid": "fa78f4a6-c523-499c-84bf-5df967022805", "comment": "Malware payload (Mirai)", "value": "c30eeb41ff61c71293481dac0470ecff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418639, "uuid": "db5e91e9-179f-4197-b318-094bb8e0cd09", "comment": "Malware payload (Mirai)", "value": "7cfa248c156656236ae76cd9263ce5a091c9edfed1886733f6b62035fedc7b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418639, "uuid": "3d4a8165-5ba1-4acf-b7c2-a6c6d48ac9cb", "comment": "Malware payload (Mirai)", "value": "f6523315bd955c1249f28d6fdea89db27335bba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418639, "uuid": "b92a7df6-19f9-4f08-abb7-0a825b7fa014", "comment": "Malware payload (Mirai)", "value": "b31fdfd2dfbc801fff7fe6902c973f3ee8f73d817a62ccede5f82df4ec31aec60fd635a3f4884e9eda2182e64a0aa64b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418639, "uuid": "7a1da8cb-5de8-43c2-864d-ff077aad30c2", "value": "T11453195AB8C19B15D5C112BAFE4E128E731317ACE3EE73139D246B20778B56B0E3B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418639, "uuid": "eccab520-256b-4c4c-be1e-e886967b0270", "value": "1536:ZAnX0ys0+5gIaMsz+ZM6ia8SKCAb8Dw5qY0j:RX06ao8ShAb8DwArj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418639, "uuid": "76134e1c-f83d-4050-8bca-ded24173f90a", "value": 62812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418639, "uuid": "68d127c7-320a-431d-8257-13b55f6ed794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418639, "uuid": "29f0ac21-058a-4144-846f-1497a2983d63", "value": "wewe6.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3411c963-c393-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763369744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369744, "uuid": "2cb6b49d-81f1-4cbf-97b5-5f2e4df670dc", "comment": "Malware payload", "value": "d0b134905433577675a27739dc87ae0b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369744, "uuid": "113b0704-6140-4c4d-8a58-edbb6aaf2a16", "comment": "Malware payload", "value": "7e3c441336c82d6921cc4041462c96ddd3c61e4f875ff5096fa319798248e08f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369744, "uuid": "b89c9360-5871-4580-af28-d1dd4a032e6f", "comment": "Malware payload", "value": "6a7f15bcca2045a063cb4463b6cef92b804aa087", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763369744, "uuid": "d21cda4a-92e0-4248-9f73-7dc179f239fe", "comment": "Malware payload", "value": "db5da2d9899e4f2de6acfed8c2f221ba42d46ffdad3f4372a4c1bfa84d8a6993eea825b58084c7117cd22000b2e55e75", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369744, "uuid": "5b2785bc-b36f-42a2-9468-dcc74496e7ae", "value": "T1811633E15BBDCD4944492CDA5DC18B35CFFC862A4C66CC611E2329ACA6137708EAB377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369744, "uuid": "3012f21a-84fb-4332-8ed8-4f86e1389930", "value": "98304:jMLMk4ezEaFnDTvSp4mTQ/PDJjBZDseVq+Ku+aHDx5o63seUR7DW3rC:j5k7zFFPKU/bJleyKupDPo6RODWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763369744, "uuid": "b2288c62-c8e9-492b-8a2a-aa99b53719a6", "value": 4054660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763369744, "uuid": "1f99e886-9c1a-43b3-b6a4-4dad304cfaf0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763369744, "uuid": "828e7dd8-f1fa-4846-8c68-c9866550bcd3", "value": "latest.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd08695-c3b9-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763386273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386273, "uuid": "4d2e4a05-6f98-4205-95a0-d2fae0a82c26", "comment": "Malware payload (RemcosRAT)", "value": "f53dd27adac49e1e6164570a488a9c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386273, "uuid": "4cacca02-65c6-464d-ae8b-78dbe5d80f88", "comment": "Malware payload (RemcosRAT)", "value": "7e820f2a3cdf17787913010cb6c3b5ca8155c957642d7493ba9af3e6671ebf9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386273, "uuid": "0ed5bc1e-9bf3-4632-a4f2-10949aa74760", "comment": "Malware payload (RemcosRAT)", "value": "ea983fdaa5c233ed7f210b13e3bfd40be9b841e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386273, "uuid": "1354e4e9-0c31-40ec-a2c9-90ba08664bba", "comment": "Malware payload (RemcosRAT)", "value": "f5e0787eb5c8109d6f4abce78891876da57159b60169d35da6f7290207238dfb3e7072d4c457a38fad1616ba1f05f783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386273, "uuid": "24f8bed2-ad6f-4f6b-b546-74134f337081", "value": "T1DD76BF1893A804B5E82BD738CA69C733CAB0BD524635D50F099DF6461F73A628F2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386273, "uuid": "bee638b2-4f6a-40db-bb68-6c74e0d5a6f1", "value": "734efb8afebad3008b855b51a4174957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386273, "uuid": "eaee926b-a635-41ad-9223-f9ac8028bd70", "value": "98304:FDrXQJSjTDeJxx7j7mYkWK0oiaB00hLpoQfCtDei0A:FDrXySjTDeJx5jBkW1abJpoQfCZ0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386273, "uuid": "28aeeaa6-1f66-4dcc-bd7b-a3c62e6bf12e", "value": 7636480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386273, "uuid": "f0644d53-a25b-429b-ac83-8e7fd8d198db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386273, "uuid": "0cc92786-49c1-4c4f-b327-d255a93d1026", "value": "vccro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a49147-c38e-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763367734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "1cb0db08-e975-47df-9b35-f559b4ffd4e3", "comment": "Malware payload (CoinMiner)", "value": "dda707c7856425f09e79d01d8ff483fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "aa1af6f3-cab6-415d-935a-8f3e2863510a", "comment": "Malware payload (CoinMiner)", "value": "8081c8bce68b5fca858e6c500588b7612f0c7173147d157e5b1aaee8f4ec25e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "77e5f86b-225d-43d3-94c6-401db0062a54", "comment": "Malware payload (CoinMiner)", "value": "880d139a460d2a21bab9a3bd459903cf16556ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367734, "uuid": "c24c5f29-3298-4b03-83a5-8ec93af00d44", "comment": "Malware payload (CoinMiner)", "value": "21753d5a5fb45d76f4f2b45b88f936dd56c306785e765f865db9a421fae86c68c635fcfc96d6d246d542cb1c3cc6e573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "c5ca0648-0ff3-4b2b-ac87-0f550a50972b", "value": "T1E95423D169EFCDB0E4261179A52A1693EAE000F6AE44BCF60BA53734B452C4A77BCDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "075e790f-6087-4e2c-9ff7-abe9f826a669", "value": "6144:pN1Fam5cjAWZJMIpCSGYjSUPFkqnYHlxkt+v27KYhXp:LKAWZxzzu8iqh1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763367734, "uuid": "87641b02-06c9-408f-a658-cd96a4812711", "value": 294588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763367734, "uuid": "38f8ace6-cdb8-4a4e-968b-33676a21cc71", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367734, "uuid": "37e02324-c2b7-4067-8be0-9b8a80302926", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb67ac84-c3ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763386749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386749, "uuid": "d32bc873-263e-4489-aff8-0f6a7b70466c", "comment": "Malware payload", "value": "0f78cb2f10f6e862e0cfb1ebb0425939", "object_relation": "md5", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386749, "uuid": "7b5ad8df-7e5d-4233-80d3-3ca867c87ba4", "comment": "Malware payload", "value": "819ee3e0f7ce6ea68f118d7ae57e2a5605709e69ccbec3d3c9826d7e56718982", "object_relation": "sha256", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386749, "uuid": "fc35c2a2-95af-4f12-beab-3e0e9ca21414", "comment": "Malware payload", "value": "0ec7108b588079f2aa2108c10a616e785cd25181", "object_relation": "sha1", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386749, "uuid": "802cd2eb-3bee-49ac-97d0-f9456e7a1949", "comment": "Malware payload", "value": "53fd9f1632214be5e60222c4247676ed2e34d8a64d4a79a6f98d6f487d4f1b822cf601a1fc20cf8ed83b820048eea2c8", "object_relation": "sha3-384", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386749, "uuid": "f2dd6421-fc91-41c7-af2e-4dbf2f255c6d", "value": "T1BC17338077D40BFBF5ABF13B94114C36B730B9071BA3C89B52655B612EB32E41935BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386749, "uuid": "b0aa92a2-77b5-42d0-bbf9-a0e0db7a9c47", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386749, "uuid": "e25155eb-cd9b-4811-bef9-41c40cb6002c", "value": "393216:imguCGDvV+53SM8+TlDs27Nwi1Zgi/9eVtzJE4V7vhxHZUFGx44Dmbrc:ztCIvV/M8+TNsINH/gI9efJEKhxHa8xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386749, "uuid": "39972ba6-5be1-470e-b430-95fb57e6d949", "value": 19598529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386749, "uuid": "43c1eff3-9160-4dd9-a14a-28a4cfcdc1bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386749, "uuid": "e64b2db2-98ac-4285-ae72-416dc7bb5736", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b279208-c381-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763362106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362106, "uuid": "1e8c676d-d0a2-4bfd-9f95-50fe583f1b74", "comment": "Malware payload (SalatStealer)", "value": "0ff3327bd11d1472f1f73dfcc8119391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362106, "uuid": "9d13912a-02a6-4aec-aeb5-47f609b076dc", "comment": "Malware payload (SalatStealer)", "value": "83e5a11677e4f3344be6fa6ae1bdde9703f6da078b0f6b79a07283c162416155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362106, "uuid": "62295624-103e-4b7e-aa7d-03b3fc13ed52", "comment": "Malware payload (SalatStealer)", "value": "1281078921889b6ef02b250fbe064eaa6377c408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362106, "uuid": "ddf71598-67fc-4f07-8d5d-102a3319fd44", "comment": "Malware payload (SalatStealer)", "value": "eb0b0d3362db7398c478182d3a94f5beb7e7775ebb3926eaa0868471a7f73d47bfbbee27f77087370cc739c6a5eb0c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362106, "uuid": "007993cb-9af6-4121-8dbc-9f6af28b1a09", "value": "T126D69D41EF8B81F4EA435838706FB23F6631660AAF3CDEDBEA441D52E1276F11876116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362106, "uuid": "cd26a0c0-f5fc-44b8-a9b9-4a488a159e07", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362106, "uuid": "e01b8afd-ad65-42e9-ad44-8ee8192f8bb2", "value": "98304:ZKw2AdMXYeJEYRvBRSONrkKbk2aAUXL3rWFBssfwYRW1Syx5:+AdcEYhBRSON80WeBrfwbTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362106, "uuid": "a7034c77-0f54-4b78-b244-2bf7acc7ac46", "value": 12828672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362106, "uuid": "73cb53b8-7435-4f0f-b07d-e5d7a8d843ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362106, "uuid": "c5802cc7-3193-421f-ab6b-aca36bbc2e35", "value": "0ff3327bd11d1472f1f73dfcc8119391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d48b35-c403-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417816, "uuid": "2a77bb2b-2b79-45db-aed7-b7ceaf51295c", "comment": "Malware payload (Mirai)", "value": "3feb68f213ae99251b09d4ff3dfa94c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417816, "uuid": "3fe61bbc-0012-4629-83ec-02722bff7cc1", "comment": "Malware payload (Mirai)", "value": "8487e628a7ac0dc0e9f717c7529c490ad4fb3ec8c93f81c7b634354b72de94df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417816, "uuid": "db86efea-bd3e-4fc0-9b05-cdeb47207b26", "comment": "Malware payload (Mirai)", "value": "b302fa6b3815ca9e9ec061c1e37e2bd9ff5f62ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417816, "uuid": "14f5ed1c-d57a-4c14-b529-cb93d8c69276", "comment": "Malware payload (Mirai)", "value": "86e3068cccff5c82cc19c00579c933604c5f0411a4ab5ee22e1628d8bdc12a18bc4ae82a4f564ede220d8a5f2f1a6738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417816, "uuid": "75be3f1e-1db6-47c7-9fdb-7b4a9f9aa6f9", "value": "T11B03E1181527F831ED704A35992E0487F6D927B2A0FE24972D9AAB0DDBDD5027878EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417816, "uuid": "9c023477-d3b5-4c05-a845-b71b879a5d27", "value": "768:+1UqxD+zlwgYGX/lGU7Lgt4LrBXrnrVTBLBmCvaU3Y8c6Q9q3UELm0:UJcqgYGX/lpLgyhXrnr3LX3YWL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417816, "uuid": "d0ecaa6a-40a6-4e84-98d4-fa36e1d54116", "value": 41140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417816, "uuid": "3f320d09-14a9-4adb-93a1-db8400e16476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417816, "uuid": "7fb291dd-5d28-4e6c-9635-50905ae4f3f1", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80032f88-c3bf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763388770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388770, "uuid": "559bcd4d-02ea-45a3-85ad-9554592cb945", "comment": "Malware payload", "value": "86779b06c6a6ee44d474e3ac77f0f2bc", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388770, "uuid": "11a6f9e6-5b7b-4073-94f0-f14d40c0e662", "comment": "Malware payload", "value": "872a2c277097fc101cd9350bd6a7abfca0f001e3893a676e2b684cc1d2d3630c", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388770, "uuid": "c59a98ae-3f81-443b-8d99-ab9245183e23", "comment": "Malware payload", "value": "52c61a3fafed910d539f8f4fd51e56446381bc35", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388770, "uuid": "ce267748-69a5-4d66-b086-dd8f7b930b71", "comment": "Malware payload", "value": "185bfc7fa672dab81347c99e93514ef67821ac07707f240340da7bf0ad151921e7a2ca89581fc727db58b796ffbd4727", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388770, "uuid": "bbec18c4-6051-41a1-8f0b-ca1c67cfa9d4", "value": "T1A38723AA55D5B2D4DBC30540638F43DE21D1A47D81EA5C3C3AC72C029A34EEB668DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388770, "uuid": "6d5d9ab8-acc7-4550-b7f4-cb48183d4cd6", "value": "3f89fcc81a8c8aca2e05ddab1c622a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388770, "uuid": "fab42e8d-d3c0-4634-b1c4-985cb4f240b7", "value": "393216:2Oi5lhyyN7IgV3geofoFnsIgAlqHy0KJvOb+iQftLCGpp1moc715zkKltstw3ozp:2HKgVOfo5sIaS0KJmytrbsh5zDzT3qI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763388770, "uuid": "e74c2a54-6220-4934-bf2e-9526c7931fb6", "value": 36230023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763388770, "uuid": "27bc17a6-953f-49d5-abc0-b5a0521cd001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388770, "uuid": "a4130cf8-0e9a-4916-9f77-c99c262a8182", "value": "Arkanix.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443ec03f-c39e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763374496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374496, "uuid": "d20afb3a-2c3e-4fae-93a6-352b342b7027", "comment": "Malware payload (Mirai)", "value": "cfcde0aed6daa4846046710d09b5fc0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374496, "uuid": "f67074ba-1786-44c1-bb61-e324237a2412", "comment": "Malware payload (Mirai)", "value": "896aead3bcd2c568120639f3681afcb58606df0befbd4863cdbf3625ce588f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374496, "uuid": "c52b9003-0710-48c8-9a7d-096c33c51c97", "comment": "Malware payload (Mirai)", "value": "16f6409c1548f55ac275ada0239cce60878f3b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374496, "uuid": "9644185f-55a1-441c-b0e5-87c0b27efaf5", "comment": "Malware payload (Mirai)", "value": "30c26f2ff9b73bc01fa7be65a86daf54ae63c3da016baaa45288ea3c3eb7e0efc97332b7f2cfba4731a4b343c5f5028f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374496, "uuid": "37b62893-eb21-4976-a7f7-839e34d680d9", "value": "T112A3BE37D81A5DE8C18401B8B5E9DE351B63E4C046472EF716EAC6AA5087ED8F50AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374496, "uuid": "6c289415-2c6c-426f-9c6f-a4fb11b74f14", "value": "1536:q/FcslLk4r0cY1lrvuAX1dywKS9Zh7KdvEvCq9D1QbW50:qtcsthQ1lTX1dyXSR6vEvPJOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374496, "uuid": "49840b2d-2f74-4aaa-b401-bad9aa8ccfdd", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374496, "uuid": "c0cbc4db-d1ac-4871-9c3c-c04fc88fd285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374496, "uuid": "965956cd-cb58-4000-a5fb-13efb4de51d6", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a101d1c8-c3b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763382383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382383, "uuid": "4ba9ae28-225b-4210-8c74-dfd0481e7f12", "comment": "Malware payload", "value": "97133e97b41478eaf5ac99368d398505", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382383, "uuid": "b2c39768-3ffd-49c7-89f3-129960140b22", "comment": "Malware payload", "value": "8cc984f8eeec5b79298e937bc4235227778aaa1a11ac96e2ed99c0d5742876a4", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382383, "uuid": "60d8f906-ce68-4ed4-9892-6ef6234b4f01", "comment": "Malware payload", "value": "271c283d5cd2ab87199ac7da3cce959c130d0286", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382383, "uuid": "bd5d2384-59e4-423b-9e16-8b3f2813ca03", "comment": "Malware payload", "value": "ff33cd0837eff3fe7d727b5e7e1d481ee166fc9758d577705ad7f2108ad7308c759af8f60bd84ce416db060c3a291d22", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382383, "uuid": "76cd57c4-f409-479d-a0f3-506c87f636c1", "value": "T1BA5533957DECEE50DEE671201F883F806FEE27160E74299C21722828D44AEE3627735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382383, "uuid": "898ab254-2aea-49f6-87a8-b90f63ab7979", "value": "24576:Qfb6tlyhhwHwwg/Xqtbg3XnY21iLPg/cHjfjBZwJw606Iyq:9tlyhuwz/XqWnjib7jBZE2gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763382383, "uuid": "07642e21-dec6-4d61-ae9b-f1d97f45189f", "value": 1285262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763382383, "uuid": "ae9cbc42-c4d7-4ea7-ba5e-1c5520787cdf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382383, "uuid": "328a5468-91ee-4a1f-9db6-ad77f5e2cd03", "value": "SWIFT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821f7719-c37f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763361285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361285, "uuid": "4af20ee5-7f2a-4dc5-817d-f4a2f3a47960", "comment": "Malware payload", "value": "899c5c92f4c7520e3fd801e394d1df80", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361285, "uuid": "4a4ff1e4-7f90-4d0a-906e-4563f2e80bd6", "comment": "Malware payload", "value": "8ccb62fcd7f7fc21c4ba0d97d789c5988ea9437c326354f15f3c96c6780ccb4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361285, "uuid": "7dd6a9e1-d9fe-4891-8d1a-040110fd4a32", "comment": "Malware payload", "value": "ff3dc159cc8a0c48cd6e17e9711c267da060bcc6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361285, "uuid": "6716ece4-8281-47f5-9f5c-8981891b02fe", "comment": "Malware payload", "value": "f8d4ee4e258ad361aca36c4c2713cceed048e052e7a0488c088588b51566d5679d775038f9d5d8da58dc635cc630a599", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361285, "uuid": "d6917032-0068-43d1-94f7-add403a09c45", "value": "T16B443A5BA39318FCC217C13882E797B6A432F4290325BE6F06D4DB323D61D745A6AE74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361285, "uuid": "2830356f-124c-4e35-9ccd-d1a40ad0a204", "value": "e1631629e912949d40dede7aecec8510", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361285, "uuid": "960ab054-5875-4974-9024-163982d9b23d", "value": "6144:J/IlkEaGq1yzfBFw59jZTqCxmfIch9XrcUNcXN:UkAEvjZTKfNh9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763361285, "uuid": "d03e35dd-04fe-469d-9f45-8a5d3faa28d5", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763361285, "uuid": "04007fdf-2e9f-45ab-a641-d239a922a872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361285, "uuid": "82e50316-648a-4f8f-acda-166d8b3827ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50158440-c399-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763372368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372368, "uuid": "66bd92d0-c3f3-4656-92ff-24d4b421f228", "comment": "Malware payload (Mirai)", "value": "7db6e0c6fcafbdcc1561cfab6992150b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372368, "uuid": "93e344cc-60fd-4222-b091-f8022f976210", "comment": "Malware payload (Mirai)", "value": "8cf3a290fead490130b63913a10bfc90e86dbcdf20c91917f5cd3844659848b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372368, "uuid": "c259d36d-b318-4f3a-9ab6-53e1ed61d37f", "comment": "Malware payload (Mirai)", "value": "797727b8dfccec9bd9dd40e3a15ece36a70d261e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372368, "uuid": "95af01c5-c14d-484c-b4fb-dde481f0b2d5", "comment": "Malware payload (Mirai)", "value": "9b0afbbea33236f8c962eafce964815a50b667fcc97d35dae2b96c9fb2105e2ff33f94d5c5e26797d3f1a78be5c4dd94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372368, "uuid": "c5ece60e-5de7-4753-809f-e654cc8e7237", "value": "T129B34A4273180B57C1970AB02E3F27F687BFE5E021E0BA89650EDB568675E77144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372368, "uuid": "6995db17-9387-4d63-bd6a-f8c607e492af", "value": "1536:/nnUKvdWQTYclmmiIEOxTBuUTa1CsMMKD1T5VQUKGgDIThuf1:/nU+Xzi9CC1aTHQhNf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372368, "uuid": "8dff67f5-4ef6-4490-91b5-fac450f4bb96", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372368, "uuid": "55600573-e5a0-4bd7-afc2-d426a502f965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372368, "uuid": "1e371157-9f78-4e93-bec2-5c544bacdd30", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646dbe25-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763366390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366390, "uuid": "9905eee4-2d4b-4be1-af9b-701664d29234", "comment": "Malware payload", "value": "dee2ab6b9b876dd06a82142ac9f971fc", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366390, "uuid": "52c0b4bd-8e96-4471-ae9f-31eb2762a6e7", "comment": "Malware payload", "value": "8d5b587491c4d79fe0ada0b8dc091169c44ea6a73db0d1ee6f47dc63f9df6caa", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366390, "uuid": "638ef535-0a07-4b00-ab12-741b88e0204a", "comment": "Malware payload", "value": "440deb7763c51bbc744fa005de35293e5dcb2438", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366390, "uuid": "c954e0a7-94fc-443a-98a5-8610147e3555", "comment": "Malware payload", "value": "e74a24289ec8d43d7f0e2a798e0e26789ee83bba9e2010b46f9ac4070855bfbe60da31b25c956c1c470f1596d56ce456", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366390, "uuid": "7743e6b6-b4c9-4d10-8cba-62ebb027b351", "value": "T15DD4227310C87D3EE0ED98F7A823BA7976621D8E9531B112A86703CD4E5215C6624EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366390, "uuid": "56a024f0-5349-4e67-94f4-85e87496c58b", "value": "12288:fiUJBTVSOE7blSZeAzvfW3x2wR0YLTQ9xYeXhhoT8/EgOw3X38:fFzkHkdzgR+4Q9fLVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366390, "uuid": "c9e80faa-18e2-4fad-b12d-db1529fe9bff", "value": 618801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366390, "uuid": "d620d80a-ac21-4aa2-8c64-0e683a0f40e9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366390, "uuid": "971fc99d-501e-4553-9220-158f847c7c47", "value": "Order2025.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12aed6d-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763372934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372934, "uuid": "b5ef427c-98d8-4ddd-aea9-6d1af6dcc9c4", "comment": "Malware payload (SnakeKeylogger)", "value": "91ace154edf149bc6b2bc3a5225d8dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372934, "uuid": "f3834737-6908-45a4-a3ba-22287bc8179f", "comment": "Malware payload (SnakeKeylogger)", "value": "8fbc72aa442061fc7974a7002ded60e47ec96f28dfcc068fc2a4004dcbda66e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372934, "uuid": "a9675376-1746-4564-af1b-03fe3ed56ed7", "comment": "Malware payload (SnakeKeylogger)", "value": "09e5db9d9e3bce193eaf730275f68233cf93eef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372934, "uuid": "b379e259-9ef2-4f2e-a327-ca9c517c6a93", "comment": "Malware payload (SnakeKeylogger)", "value": "07d9eddc66d9d9c489792c54b49c8f75e28727757ac7a9b73fef1d5ad7c654cf0397009d49004098e0bf4c8bb83eed4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372934, "uuid": "f17971e5-c3e7-42eb-83d4-cc4913aa62eb", "value": "T13525BF1373DE8360C3725273BA667741AEBF782506B5F96B2FD4093DE920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372934, "uuid": "c5ca9dbb-2769-4b32-80bd-45274419ae18", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372934, "uuid": "40ba5131-f6c7-4bf6-9836-a5031d977d91", "value": "12288:Gtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga5Ts02a7n2xXCsG3+db5:Gtb20pkaCqT5TBWgNQ7a9j2a76S2b6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372934, "uuid": "7c9c7aa8-8845-410d-a9ba-27080b3bd7b1", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372934, "uuid": "2882d5e3-1fee-4c3a-8adf-9d8da5e04fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372934, "uuid": "b5fcb7bf-414f-4de0-8365-63939624c153", "value": "NEW ORDER-SUNNY 1000591600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb9b6ed-c3e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763404063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763404063, "uuid": "f03b6151-4c36-45fb-882e-bb9e7720aee3", "comment": "Malware payload", "value": "cab98dc39981bdd72f06d778590ba7b3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763404063, "uuid": "b689c039-3390-49bc-aa14-06b08e1ce952", "comment": "Malware payload", "value": "8fed5a86d4b163f5fcb5e8f0be467480e562c541d31c61040739b71de95c4666", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763404063, "uuid": "9149467b-547e-4f72-83df-60764cd25a20", "comment": "Malware payload", "value": "41b2d7a15c5174c592b6171d5095d80d96f3923d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763404063, "uuid": "a2ccb3f2-48ba-4347-b0b7-bfdbb2e51117", "comment": "Malware payload", "value": "90e2d400aa9716a5fabb404016afce280ac7520866a6900516ad0f0ecb594d28f886cf5d2047dce1fb043fd8b86c0c55", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763404063, "uuid": "163952e7-01f1-4f97-995b-c41f41a24291", "value": "T1D641E00533F54329E277963A5C7AE3219376F805ED72479E1140564C6C62200D96AF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763404063, "uuid": "801f82fb-9220-4ac1-b8a3-9c891811db52", "value": "24:84sLTYNxKNM+KKMW3dwYWkp+/CWcEJi6At4I0TFyDwe1kD2Fv/MRht1d/5jlUHt7:84sHyUeqKzbI8yDT1U2Yd82x/CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763404063, "uuid": "054e8613-12d8-425c-91cf-8da43bf60a81", "value": 1981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763404063, "uuid": "40a0daa1-f146-4b2d-8da2-0c1f93e997ee", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763404063, "uuid": "8f862e4a-0566-4330-ba4f-29374d57a07b", "value": "Staff_Employment_Upwork.zip.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda9a42d-c3fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763415529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415529, "uuid": "fde378a9-cb87-48d1-8a91-002639c2e4d5", "comment": "Malware payload (Mirai)", "value": "18fb5e70a921a8fb5f9e2e629fc937ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415529, "uuid": "01237827-f4c2-4b7b-8476-f8fc73362795", "comment": "Malware payload (Mirai)", "value": "9003e3930d85cf0c7015d00de08a43d0fea158daf881e5579733d8543b5421ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415529, "uuid": "742898ad-7b64-47e3-b85f-bca75eb99b68", "comment": "Malware payload (Mirai)", "value": "15b9559bf9845d17a14a2abcdfdeb467d95d24cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415529, "uuid": "f16077fe-de24-497a-a357-4eff8365e9bc", "comment": "Malware payload (Mirai)", "value": "953a708919cfe8469a71ae7045e4531851d44584061482de17ee4e6c52fa502a970f30a17d48800fb08fb572e9e25e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415529, "uuid": "a9957c27-8ff2-4f96-862d-54c9cc187a37", "value": "T11363AE33E4266E54C04684B074B99F752F93E1C182932FBBAAD18679A083D9CF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415529, "uuid": "3ca09353-e489-4d4f-8e50-4b1d84a07fb4", "value": "1536:vaHdNhYf+LrXMWVS3wEKSHduovF7UC3MpkN:vcaf8IWU3ISFvBU/kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763415529, "uuid": "5a355a47-f458-4dfe-80ff-bf3cc6d2ede7", "value": 71052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763415529, "uuid": "43572c94-2b34-464b-a4b9-dc80ca20f357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415529, "uuid": "bdf05b36-aff6-4b01-96d8-d0c117ffeb0a", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca7e0c7-c386-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763364229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763364229, "uuid": "3613e298-38f8-46e9-a2de-1c30c0ad4b2a", "comment": "Malware payload (CoinMiner)", "value": "8963dc7d02c7b5751fc4c629756d2c2e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763364229, "uuid": "74aba3fb-a141-4ff5-9568-3ec232b573cd", "comment": "Malware payload (CoinMiner)", "value": "902a3680bcf8e0270bba0fbcdd6996c2934b55b3d9ccd2171d3eb7fadf199a9f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763364229, "uuid": "aa6d2a9e-6052-407d-ae7f-db27085c3310", "comment": "Malware payload (CoinMiner)", "value": "cf04a02c85b95cd72051fac3cec23a8056c1aeda", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763364229, "uuid": "2b72ec6c-b383-45b2-9e0a-c0c506a7af5f", "comment": "Malware payload (CoinMiner)", "value": "9d6abbd1e82ba94337e0bb76893779b5d2b8a2c9c8a0aa501fd2230f823498824a403d89d6e55528041db78e992ec9db", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763364229, "uuid": "36b83b86-e62b-42c8-96a2-6cb9c2cdae41", "value": "T1B462F655F50072F1BC3849703E83A224B350246B0E997DBF74AFEA743650AEC5AFE526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763364229, "uuid": "6d356eb6-a9aa-4c47-a361-b2ba2deec2a8", "value": "384:U6sWse8bHG60HdI+9faalwLJsCoeXFnRz+DGuU9:U6sd/HG60HuPLboer39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763364229, "uuid": "52182aec-f3f3-4c29-8855-d876cdb77565", "value": 14726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763364229, "uuid": "8c737800-b74f-4b42-a39a-f5170459f34b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763364229, "uuid": "1d337315-ecd4-4d22-8716-8f4327b18b98", "value": "setup_runnv_miner.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effab17e-c3b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763385522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385522, "uuid": "f5047458-4a89-46c9-83ac-c03eea727d8f", "comment": "Malware payload", "value": "a08d58650c25abb72972bcf7931db54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385522, "uuid": "7a3fd605-06f5-4afc-aa1d-086a35447b5d", "comment": "Malware payload", "value": "905ca5cda13412ba5f231be420784dd7313ce6f8174f0f7b111705c460f27e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385522, "uuid": "9a11115b-8d66-4cd6-8e84-420bcd94ec66", "comment": "Malware payload", "value": "e266a734d09c35dcff05afd6f91d95d13b147dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385522, "uuid": "b14bec5f-ab4a-4732-bcd1-e2f717653c1b", "comment": "Malware payload", "value": "b2ea896eb62b90fad5542cb449771536eaf513e03eef7cff7e7efa64c82142043fbf61f207192791859b9df5818e23d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385522, "uuid": "0d46b3f5-9f37-4ec9-8e0f-d0745f396962", "value": "T1E20833082561D623C634DF7AC63A5821ACFD2F77C9E07AA74BB444B1BEC419C346762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385522, "uuid": "bcdb4afb-2598-41fe-a1de-d1941548c700", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385522, "uuid": "47352414-c99b-4f79-a206-3b320134e385", "value": "1572864:0N/cCC+rBSyN2os73cZScYAFRW11iVPKW8UTuBxXbXNeTBTOxrJPCrWu5v3S2:0FchCNRWD8sUeJDAThOx9CCMK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763385522, "uuid": "368d1183-0e76-468c-935e-825988a0dfd2", "value": 81014218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763385522, "uuid": "d3e8a4d2-757d-4e1a-aedd-7317685328c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385522, "uuid": "338126b2-e5ef-4f80-810f-f320b57637d1", "value": "Ledger Live Setup 2.102.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a30963-c396-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763371037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371037, "uuid": "524ae4a0-a0ea-46ca-b629-f7c4ef15f1cd", "comment": "Malware payload", "value": "de5567fbb90e2d95a24b8e06a0da70e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371037, "uuid": "a53b288b-ff8b-4680-86e9-53077328fb55", "comment": "Malware payload", "value": "91590a84f47a05dbc8a6aade4d299bc53c2b34aba00e3eabc54fb58cb5437b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371037, "uuid": "cf84bb0f-4f07-4cdb-b3f6-7898cbf4c6e1", "comment": "Malware payload", "value": "c381227c5a4ba752cc8cb5f5a0b87703836bce78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371037, "uuid": "a5f93def-9324-4e27-a01d-a964b12f39a1", "comment": "Malware payload", "value": "c5aa4c67e3c3a1b4164b2b67e4fe47dc95754a439a374298ffd9660114bf6e45c5aa7a502edb595b5ce23c7d51425bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371037, "uuid": "24f0340f-d14b-4507-832a-601c2306267c", "value": "T1FD919407E3F4499EF06BE7B467678B12F135FCB5AAB4A45E5AA093182C327407D18BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371037, "uuid": "456f5cd2-3573-4c88-b79c-da5550793502", "value": "48:69Eq8O9K9ySEp//aACLJ0YF3WtRkA0A0AsstqxBlAVlb:heYySEgrJzpWN99r84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371037, "uuid": "4ce6fcf3-7e14-4528-90c6-8861217a57d7", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371037, "uuid": "bff82cb0-0772-48eb-9894-e3732d6bc9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371037, "uuid": "e9e4353d-ae6a-4654-9431-1de9ca0bff64", "value": "CCHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0457d5c2-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363651, "uuid": "4b238c4e-7eea-4057-97f4-345fd4b97803", "comment": "Malware payload", "value": "82faeb721c8d710ab788d07c19f31448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363651, "uuid": "bc3bd506-efc9-4b24-b75b-6e053a3627a4", "comment": "Malware payload", "value": "93938be4105ae5eef4e39c39264c28ebd511521e56e3b2ecff43429985853a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363651, "uuid": "a347595b-ad49-4018-ab16-03741a021223", "comment": "Malware payload", "value": "5da478338daee881bcaf7ce60d40f36d3bebc866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363651, "uuid": "b4c8719b-42c1-4e7c-b925-3bb144ead9c8", "comment": "Malware payload", "value": "450d765592f89418ea9adfd6b81ef3a019f6b7aaa525d9030e639826169157b06396b38af0d98d9117fd983f9c14520b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363651, "uuid": "269a2921-5a53-4896-8f0f-7bf1cb2ad290", "value": "T18E0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363651, "uuid": "c38c0469-04ed-47d6-b2cb-d76acbec1b95", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363651, "uuid": "e7059b3f-6d35-4401-aa18-b720f1787856", "value": "98304:auT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:92w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363651, "uuid": "80ec9a29-de8e-4de9-831c-e7511593faf4", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363651, "uuid": "e6f9b1e4-66e4-45a9-996f-2ccab6742859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363651, "uuid": "04e6e4b3-6aa7-4b68-aede-0976aa6ad08a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d9bec6-c38a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763365984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365984, "uuid": "65d59ff0-530c-4196-901a-ab504cc85bab", "comment": "Malware payload", "value": "c2d3a5ce6b8d2a3f198d8b0d3cd3a6e3", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365984, "uuid": "00e32e44-9bde-46d3-81c0-f7c41caabb2c", "comment": "Malware payload", "value": "9406f67d047a487dc8de0a569169edccfa86dc53427cf08d7a5c1ca38243b982", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365984, "uuid": "ee205990-da20-43b8-bb12-34379b326af8", "comment": "Malware payload", "value": "11acff4761d82027de0be3d3c9306cc1bf9beb01", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763365984, "uuid": "19947d70-19d0-4397-a752-7496fcd5724d", "comment": "Malware payload", "value": "c482afb0c59c81fb110f93cc0e61b9a6f324689a216e9fc9f3dafc88e26f51de1c7e226d7d43d3788bab9ca76fc5f4b5", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763365984, "uuid": "93b6c928-83be-4c0c-8ea5-a3ce6e11d2b9", "value": "T1C002E08CFCED44B9BF3BA21D95CA319B22031D789B5B29741168D68443FA08C8C867AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763365984, "uuid": "8d60b7db-8c0f-4467-a2cc-a52856803944", "value": "192:iKF66J+J47wMEEFQUUaaTNozjR+pKu49vBziXdprxhQ0adcPBsasX:iu6LJ97eQ9eYO4prxh/PJsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763365984, "uuid": "5eb4be4a-b0e0-440f-a357-9803d986eac6", "value": 9000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763365984, "uuid": "c1a78546-3217-4ec7-af84-4f1025400bab", "value": "application/zstd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763365984, "uuid": "ddf8cc84-0353-47c6-b1b8-a163f7a72b8e", "value": "awb_DHL_shipping_documents_nov_17_2025.tar.zst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74aee98-c3d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763398795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398795, "uuid": "89b3e47f-6b96-4797-8275-2a32c43c349c", "comment": "Malware payload (Mirai)", "value": "6031cb63545a3d4919c90303a5766674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398795, "uuid": "53f426a7-9943-45f0-8743-3306e0858bd1", "comment": "Malware payload (Mirai)", "value": "95583072befb98cb0ae7c0f79e7dc791bf6678e3e77aebf0bff11d42901ca7a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398795, "uuid": "3adff214-91f6-4784-8bcf-333bde746316", "comment": "Malware payload (Mirai)", "value": "2623f10d42a4d281f85136aadbb7ec08b4ecba33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398795, "uuid": "5fd0c296-cda6-487d-bf0b-a102bc79d324", "comment": "Malware payload (Mirai)", "value": "9f2ac91018e6957d613d71243ff31cea573ceeba36b52bcc7c852698d76e8be2c1fffdf03d24687dbd70ea3a342c5433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398795, "uuid": "3252be41-e646-4bb7-9cdb-613b4b02b9cd", "value": "T16B733B56BD81CA02CAC16677FB1E428D772753A8D2EF33039E225F21738652B0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398795, "uuid": "cf4ea805-9849-45f6-a3f6-269000b87eee", "value": "1536:8Nqlu0y4yElqsBYgSjtp4OIaou+VRvk51Kcemf:8bH/WBLStp4XBiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763398795, "uuid": "42c0636f-2e8c-4b7c-a794-4d42e1636891", "value": 78148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763398795, "uuid": "9b89eaba-d3bf-45dd-b527-7a9a61ed46fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398795, "uuid": "6484ba6b-8229-476d-ada5-d6164b3155b4", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbe250a-c3b7-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1763385434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385434, "uuid": "b5be53f9-4874-47ce-89d8-6f3d74684573", "comment": "Malware payload (VIPKeylogger)", "value": "0656ef0c3118209d5e3f06275c7027d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385434, "uuid": "dfb97b5a-d7d5-45b3-86c5-b9c4a80ce396", "comment": "Malware payload (VIPKeylogger)", "value": "958a20415c168faffee4e9d9f61e496012a9138fc20faf361c3d8102b5b91c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385434, "uuid": "e9955407-ec00-45b9-982b-3c6cbaae9c03", "comment": "Malware payload (VIPKeylogger)", "value": "9a1d01aa180afdf1a641b514e5a458d82a05896d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385434, "uuid": "1550d23e-5933-4d68-ba23-fc16045e7bce", "comment": "Malware payload (VIPKeylogger)", "value": "c7af346a5f93be2b43dabfff35fb012ebd9b15e6b7094972684a3df49149a9ad377771612e8a458c0ffe149c7a4edbb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385434, "uuid": "a7f0a342-d0cf-4349-8132-fc2fd2891a6d", "value": "T17C647539FE3AFCF6826FFDA5E2B1877607555A23FB1CD90CE840F01118495AB1618A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385434, "uuid": "b43ba58e-6afc-4fa6-bdf9-bdd39e5c2939", "value": "6144:WKNvtUXDvYj37p0alaEfAOAbiKyaJ+ehJK7E2:dNvtCQjLdl+OMi/aJ+ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763385434, "uuid": "8a3229f4-1c60-4e62-bc1b-cde908d35d2e", "value": 337166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763385434, "uuid": "eeff5afd-2f02-4460-8525-f861f9fb3f6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385434, "uuid": "61191f44-6ce0-4a84-966a-ef8e76b00883", "value": "TBHD_885966552066 885966552066.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37efa685-c360-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1763347847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763347847, "uuid": "17a2c42b-ab76-46d6-84c6-1e3569d3b5fd", "comment": "Malware payload (DarkVisionRAT)", "value": "dc7d7b302c0ea574cd75e7b8845b1241", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763347847, "uuid": "2ea7e6e8-1c08-4038-8eb4-01aed90002a6", "comment": "Malware payload (DarkVisionRAT)", "value": "95c17777b19471e22cc56a77a2303db0166afc274fe5057a31be842e4e8a9637", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763347847, "uuid": "6ab44546-04e9-450f-822a-c1d9069ffdf9", "comment": "Malware payload (DarkVisionRAT)", "value": "644ae9de555e7cb226e1524986f25d651442fe45", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763347847, "uuid": "46b67886-5cf6-4fab-9730-e458a38c5ee4", "comment": "Malware payload (DarkVisionRAT)", "value": "0ab72ece4fda3747ea95fb2de4ee9430ee7a00588e462123faa15df00e220b2dedbc6ccc1656f3599fe4b84220bbed4f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763347847, "uuid": "5a884e9e-2772-46e3-8b66-0cb041a8d74b", "value": "T16895238A3380E177EC9C8333AEC7597EB44C3F5B9AA1CE2D264485454D416DD8F3AA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763347847, "uuid": "30916c05-7917-47e2-b0ee-c7f911caaedb", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763347847, "uuid": "264d3522-322a-4f9e-aa3f-610c43a0b419", "value": "49152:z9sKK9Zry6v+ArHII5zDDr2cQEwZMsEL6E:zq5ZG6v+e/zDHNQEkMsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763347847, "uuid": "ceea2852-cae0-4ee9-b231-0f57433da60c", "value": 1920512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763347847, "uuid": "c6cc4d3c-0c00-4ab2-90c1-51912a9e3e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763347847, "uuid": "7c6ee79d-5dc3-4cd0-acb5-7633ebf240cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3665c908-c3f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763410980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410980, "uuid": "f7954e81-80a5-4fd3-a8d8-514eb6ca00cb", "comment": "Malware payload", "value": "557b55b31fe979bed791e0c85d75279a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410980, "uuid": "fedb9046-dbca-4e65-a3b6-6c86a4860034", "comment": "Malware payload", "value": "95c9d69e6c805936bca6809f717cf82e88dddea7ef6b139b3c3cdeabf95c4b6f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410980, "uuid": "1a237b19-c0dc-4efb-bc8c-970cb21f095b", "comment": "Malware payload", "value": "db118ecf6c96e0e5f9f2937eeb7bffc150136d95", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410980, "uuid": "7cba7443-cd7f-4959-b107-622a25407a38", "comment": "Malware payload", "value": "152c998a44a7a558cfbacf8022c5fff8e19b91a11313e8cb212621bddb3198c9a25727b7e3d0700e0823afed0eaddc4e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410980, "uuid": "56e1ed16-28b6-4f59-8e59-3976dc87f579", "value": "T1650248212CEB10D8F2275B715BCCF5FB0AA5E075652EB2F42181DB444BB4AC4DC62EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410980, "uuid": "7f0891e5-6e20-4a4c-8e93-c8a41fff6edf", "value": "192:8T630qPXO2VtbAdWmsLC2EIwuFu5PIOygEu0rctXX3hY008aLDmC:S63fPX9tbYWm+C2EtuFu5PIOygEu0rck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763410980, "uuid": "1feba571-ae36-4aaf-b5d9-78a4db999908", "value": 8523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763410980, "uuid": "e745c613-835a-4a8b-bbe1-442150e1faef", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410980, "uuid": "9f6769b2-6419-411b-8e40-640fba6fc854", "value": "PDF_Factura.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a1420c-c3aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763379810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763379810, "uuid": "523b9763-bfa0-4221-9551-81424a9c7fe8", "comment": "Malware payload", "value": "e835567bbd9e75afb2ddb4ad3cde3f6c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763379810, "uuid": "d536e18f-bdef-4aaa-a087-aec488f9984a", "comment": "Malware payload", "value": "961a94fe3b8e00298aa2ce713398f1b012d492eeb4ac177f9e08d734385572e1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763379810, "uuid": "0d61a638-1c96-43c3-b773-99194565070f", "comment": "Malware payload", "value": "f0c67be22a741a9df5d0df82088ba73ad2f87d49", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763379810, "uuid": "c7efd137-9f6a-4f81-af53-3e2c3f5f50bc", "comment": "Malware payload", "value": "f30a6cad108439cfe09e61b678dff3ae3a4509bc56eb73737405fa40dcf0a8eb95791a06325431d1ca6aeb569a110782", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763379810, "uuid": "cd2ca3e9-4f08-4a6d-8e4b-7e6c73d7e6bd", "value": "T162D4A401E7EA499CE6BA6FB001BD1BD03BBDFC449E31470B261865593FE1B80DE153A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763379810, "uuid": "566d5e2f-0fb0-40d6-a8af-dde18ad55abf", "value": "6144:58FidjbtlYYae1dfnewlDJqYrDssuTEI/hdv+RB:5TbtHb5/1uTzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763379810, "uuid": "6f18ea37-2502-442b-8aef-802d8f94014f", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763379810, "uuid": "6e5c6b0f-4a80-443a-adbb-498b106109de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763379810, "uuid": "8ea5834b-bbc7-495f-85d4-6ae3cb042aac", "value": "Actively Managed vs ETF HY and Loan Flows.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05958fb0-c398-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763371814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371814, "uuid": "92915b97-4762-47fc-b31e-b63c68917150", "comment": "Malware payload", "value": "7b95a72b862383d4e3128689775499cf", "object_relation": "md5", "Tag": [ { "name": "barys.", "colour": "#9ED07F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371814, "uuid": "7892b80a-aef7-4127-b6f3-43a2f11def64", "comment": "Malware payload", "value": "9691ddc08712445cba00656b4d7965eee2c045ebbcabe81c0a1f21f5357a953b", "object_relation": "sha256", "Tag": [ { "name": "barys.", "colour": "#9ED07F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371814, "uuid": "c16b4b81-51a9-4292-ba41-a84a496207a0", "comment": "Malware payload", "value": "e79802231bd0f27f97127f728a312ef3158a322c", "object_relation": "sha1", "Tag": [ { "name": "barys.", "colour": "#9ED07F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371814, "uuid": "aba0818a-0457-4046-bdba-b0e28999fe61", "comment": "Malware payload", "value": "7f8a8b63d8e15d79c40108dac986dccc8d6e6e577876dd7af1fc43ef26776033a0d3789024de5a3c4704c80d8cd4662e", "object_relation": "sha3-384", "Tag": [ { "name": "barys.", "colour": "#9ED07F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371814, "uuid": "dda64328-c18f-4037-9380-804d2af948cf", "value": "T1B0259D9D726072DFC85BD472DEA82C64FB5078BB831F5217A02716AD9A4D89BCF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371814, "uuid": "5986f5fe-d21f-43a3-81ab-82eb2640eb64", "value": "24576:y4u5WuEpqO+s0QxVXH9AXxTpRL5DpVfB:Q51ET0QzgxTvLDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371814, "uuid": "4021cee8-8cb1-4fd2-86cf-746206532b34", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371814, "uuid": "06bc758d-31e7-4fa6-9e39-cc3d67193d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371814, "uuid": "17e983de-cc6b-43e2-a09c-6525bd9b413a", "value": "m2ax4c.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b78900-c3f2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763410789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410789, "uuid": "61f10a63-b485-485e-b62e-94fec59b1be3", "comment": "Malware payload (Mirai)", "value": "f20b05d51fb905c1dc36fe3123907b9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410789, "uuid": "a7631393-b105-4d40-bf30-af1aaebeaa4c", "comment": "Malware payload (Mirai)", "value": "97587f0745de02de138f6f941279e5cf1fc31b664bc1d7edf793946370d192c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410789, "uuid": "6446fde7-623a-4f8c-9568-fef900e672f2", "comment": "Malware payload (Mirai)", "value": "e1c9f193d674cee7914c2804faec92d8641a842d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410789, "uuid": "c33dc31b-0829-46ff-bff8-84e0941fcc5c", "comment": "Malware payload (Mirai)", "value": "62dc48c030725c39bacc1c1962ad58ad4432e05a32fd9e69c94c35e5545348abe0f5b12682e59752a3c554e45e84a06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410789, "uuid": "c9642a04-5bc1-4f0e-922c-c64c148dc7be", "value": "T19A934A22BA360D27C4D1A47A21F70B25F1F247DA26ACC90B7D710D8EAF656502643FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410789, "uuid": "e7ebca7d-fc85-488a-bb1e-dedca3e8fdfc", "value": "1536:t9NSEHz8Imzo439hQ36+ZoExB7eYKktnxdYL5gWFow4qDntCMluVh:t+Mz5336E77ckpXYl5+wm1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763410789, "uuid": "e5a41e39-c399-4f99-9424-dd142db18aaa", "value": 92328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763410789, "uuid": "343da2f4-3500-44b8-b3e8-780758c8fa39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410789, "uuid": "7e4d1c30-b9ba-4422-a0a8-f7d7dfe68578", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c81158-c3b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763384667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384667, "uuid": "c3db8821-3edc-4148-a11c-2c65741cb017", "comment": "Malware payload", "value": "d05fc79004adf9ef2e040124ada0770c", "object_relation": "md5", "Tag": [ { "name": "370f7b", "colour": "#A5EDE8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384667, "uuid": "32f9c073-2eeb-4179-8db0-cfdd91b629f3", "comment": "Malware payload", "value": "97ad0e015706dafd784c4a3abbd2dd9bb84adbf944b8b74ebfb43d444ecb17a0", "object_relation": "sha256", "Tag": [ { "name": "370f7b", "colour": "#A5EDE8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384667, "uuid": "db091ac2-ee7f-46a4-83c2-b62ce6c7f9b3", "comment": "Malware payload", "value": "abbadd8f1d0048189dda2e88e9559200c0f302dd", "object_relation": "sha1", "Tag": [ { "name": "370f7b", "colour": "#A5EDE8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384667, "uuid": "03091dea-9dc0-45e8-8da5-415bd1588674", "comment": "Malware payload", "value": "afa9efe17c7f647b8f19b24720ac83b70f9fc8418c9aab516426b551e325fed79c0b1423c601c9b503d2efb6990eca77", "object_relation": "sha3-384", "Tag": [ { "name": "370f7b", "colour": "#A5EDE8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384667, "uuid": "5ae3ad30-200c-4c25-82f4-b38ed6bb4d9d", "value": "T1CE17338077D40BFBF5ABF13B94114C36B730B8071BA3C89B52655B612EB32E51935BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384667, "uuid": "a291f1e8-59bc-4e86-9c44-6455b7d140f9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384667, "uuid": "59b857fb-fbe6-48df-a86c-6bd7860f37c1", "value": "393216:/mguCGDvV+53SM8+TlDs27Nwi1Zgi/9eVtzJE4V7vhxHZUFGF44DWrc:etCIvV/M8+TNsINH/gI9efJEKhxHa8Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763384667, "uuid": "7834faee-6ce6-48d4-a8ca-d8ff072bd517", "value": 19598348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763384667, "uuid": "c801d1e1-7625-4c57-9061-46f3972dad65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384667, "uuid": "370c6200-fd44-49f3-809f-6ee77e5bb91b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d292e6-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363897, "uuid": "4eebbfdc-217c-4a26-b509-bd289220a56c", "comment": "Malware payload", "value": "e16d51ab4cddfe05af60c3db8208d93e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363897, "uuid": "06a10f9b-3126-4540-ac02-4597b0fda9c5", "comment": "Malware payload", "value": "98303d29927d8600ed8bbbc21f3ee044d10fb4bc42f555b8713d7410ae6fcfe1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363897, "uuid": "77d0529c-fba9-4536-aa70-132302207efb", "comment": "Malware payload", "value": "aba0016c7aaa94939920778a69e88dc412a4e259", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363897, "uuid": "21795ff3-8565-448e-89b4-a192a534662a", "comment": "Malware payload", "value": "e2d27902566a1f05cee69c7e79de6a9afb46175b44dcef317d28b3ac5712fb6216a8b56ae22b53661a54f073bc9351de", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363897, "uuid": "c0a137b4-0962-4e6e-884d-f5d9fb36973c", "value": "T14B47234BEE48CC5AE8F65239FD32432338225DAC4703C5BFA565B63D3E732D28A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363897, "uuid": "8e0d02d1-69d8-4ceb-945a-6a25580c1920", "value": "393216:wQIgYOHU3f0KFYigMficdf+LhMs5+bZwrdFD96F3RNsDabLs6QEKHx7s8/iIot9P:KMU3fFvL+VM5ZGdV9U3LsWb79A7s8m8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363897, "uuid": "75c9a867-473b-4068-b7e5-dfe7bc99b8ea", "value": 26870576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363897, "uuid": "d3c7c1da-6337-4db6-a7cb-5bb1ff9f3c82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363897, "uuid": "f07d054d-438d-4c1c-ad39-cb64c7052f35", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc765641-c34e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763340338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340338, "uuid": "1c1b3c3e-b9be-46db-9cd1-dcf018e04fd0", "comment": "Malware payload (Mirai)", "value": "a16a84a74fa677076aa4f99400002cf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340338, "uuid": "980d638a-19b8-4775-8c53-ca95ac16f252", "comment": "Malware payload (Mirai)", "value": "98db59a4350cda3707faf7efeba9f9425f2fd45735a8bf2add02d36f6f91fe53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340338, "uuid": "66e0b110-dd87-4eae-afce-9a2c20e719e1", "comment": "Malware payload (Mirai)", "value": "b8070ca73e44332042313e2176281127707516bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340338, "uuid": "d077be9e-5a68-43a9-9927-b70c00fb3a4b", "comment": "Malware payload (Mirai)", "value": "97c4c092c3bd86e431116aa809773fe7e66a07bce974ca4ddb9e86c61744a20b1db3c01ed08eb7e18605af87fdd8f701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763340338, "uuid": "2ac9cabc-03cf-4ac9-bc11-e1fe43e0a433", "value": "T184C32945F9828A22C5D713BEFA2E118E331257B8E3DF72129E105F2573C662B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763340338, "uuid": "92458e85-15ea-419a-aeb1-0ff1c217712e", "value": "3072:yLK277N/EOSHSw4mgrWa5dtOrr4uZj1N44h:yLK27R/EO2V4TqaxFuZBNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763340338, "uuid": "e58499a6-5422-45af-8026-7e2aad503079", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763340338, "uuid": "8a5a6ea7-26af-4bbd-ac45-438281542e2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763340338, "uuid": "d61c1116-e339-433a-97c5-4cc5878fbf93", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5bc60e-c3e7-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763405922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405922, "uuid": "bc965e5a-f369-413d-8be4-a7a910afeaa2", "comment": "Malware payload (ConnectWise)", "value": "2c52537644712a2ca28fbe68ceacbd10", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405922, "uuid": "f985f7f6-44eb-40fb-9b47-db70fea4a978", "comment": "Malware payload (ConnectWise)", "value": "99b076f70c21c6f533494adb1c74891c980edb19d38b3f2fb8b3412d6195a29c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405922, "uuid": "68cecb69-6f02-4ef8-9714-6fb9ea9b68e8", "comment": "Malware payload (ConnectWise)", "value": "9ab74dc02cc3afcf527cf504fee482281b46cc15", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763405922, "uuid": "01349c2e-c343-4a0e-a1b7-f1494c71b831", "comment": "Malware payload (ConnectWise)", "value": "05acb118ab859eb82319b744bb3f7e15424a61d7adcf66bf2b66d5f497a6875c8e2595f1757331612449cdcdf5930aeb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405922, "uuid": "08a35673-c3d1-49ad-a870-46bace022650", "value": "T193E5E021A3E4C136C0BF0639D8B95561A7B4BC099366C75F57A47D6D3E73B808A223B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405922, "uuid": "1170ae9a-024c-4b43-bcc4-405c3bc898c6", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405922, "uuid": "bc60c93c-40fb-4a76-bbc0-e3aaaa9417a4", "value": "49152:iZwPTPFIST0+TL3Z0Mi963PSugQeccp6EsToWTn1Yt+fLbXGundZRT4T1gS:iZkyZ16MAEsToWT18+vGWkTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763405922, "uuid": "b8f4e302-64fe-4d25-82ea-875425803b69", "value": 3282064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763405922, "uuid": "ac4c082c-dba8-440a-8e69-aaec6497766f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763405922, "uuid": "3f9b6c2d-07c4-4fce-be26-b4f2a4ba78d4", "value": "Social_Security_Statement_490783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f88cd2b-c3d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763397600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397600, "uuid": "3da5e073-50ef-4fe1-b535-c7ead9911495", "comment": "Malware payload (Mirai)", "value": "ca51bd859ccf14e56009b4f6f99ed4b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397600, "uuid": "1a68a99d-86a1-44eb-92b6-8ec217d5d1a4", "comment": "Malware payload (Mirai)", "value": "9b5a8390a4607c316a5fce9d77c1416ddcc5a864b9281d5abb82f516c955ab1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397600, "uuid": "3ab89af2-f5ca-4164-85a2-cb5798736dac", "comment": "Malware payload (Mirai)", "value": "cdc154be22586cdd2ed39ac4a81e2d37b9bc7a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397600, "uuid": "2726be3b-ba8d-4c9b-8fc4-54c855566275", "comment": "Malware payload (Mirai)", "value": "18dd1d9b6bcef6dc89f42e5c6a60c4247f6e8054400c1c75f224cf3229ab428d454a01665f00425e9924d6c20337109d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397600, "uuid": "87ef7fb0-9c88-4251-a1e3-5f9e02d589ea", "value": "T109833A66F9818B11DAC516BAFE1E418E7313077CE3EF72669E205B2023C666B0E7F505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397600, "uuid": "d405aba0-3817-4487-ba0d-543938ea7559", "value": "1536:qInFU0eObSQxnAxOuWYnn7ualGabQxMDiUY+uxgCb7ao55YUoema:1bSQJAggnn7ualVY+uxgCbeoXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763397600, "uuid": "f5c5bbf8-e7a3-4330-9df1-71c6a6ebc0e4", "value": 88552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763397600, "uuid": "302f200b-c3d1-41b2-ab97-3e5940dc984c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397600, "uuid": "7050bb61-277b-43c6-9a62-f1173c0da39c", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306e28e6-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1763387348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387348, "uuid": "fd1ee849-9d5f-4102-a8d7-9168a90f622f", "comment": "Malware payload (Adware.Techsnab)", "value": "d69b7d460e0ca596e12f08ffac7a0b6b", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387348, "uuid": "596fbccc-db0e-4fad-9225-f39228e1da27", "comment": "Malware payload (Adware.Techsnab)", "value": "9c584e670667b9f5eada005ea4d02978d9428aeae050824dc1d1096064fa4974", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387348, "uuid": "3890ab0f-ffbe-43d0-82ad-8057e2268fa2", "comment": "Malware payload (Adware.Techsnab)", "value": "a78c964b9451a68bc469dd1b6c079bff5ec26c08", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387348, "uuid": "48af7838-11de-423d-a402-0dc00a134319", "comment": "Malware payload (Adware.Techsnab)", "value": "91cfbecf62b6151de9efa678caa922d9a92a8d3baffe6e6048421f7afc9ec2abea092c5a08bae33ff0ab330ed8a07da9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387348, "uuid": "5cb05527-c9ad-45f8-91ec-aa5ebd909a0a", "value": "T1CB035326FDC74CB687C3EB63D2F3D21CBE69449C801B9EC5B5B886825865D291748F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387348, "uuid": "cd7342af-245f-41d1-8a34-a7e06e0ba9bd", "value": "384:TK0RfD9a7hZPIi4lsCGZAICzR/4yAGdnuIdRIe+8qpcFFGwfEnaP:WADkZwDNkfCzR/ZAGduIDTwcFF9fCaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387348, "uuid": "de09c769-26bf-4362-a354-39b4f095a5b4", "value": 38915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387348, "uuid": "4c0f1033-cc74-48a9-8649-19a1681884b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387348, "uuid": "d983c942-0455-46b6-8b12-f1d0483c1258", "value": "LDR50f38c3edc0990527aeea22ead563dee2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc803d47-c37f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763361437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361437, "uuid": "b640e236-c331-47ea-b850-cb46e94bb8b7", "comment": "Malware payload (Formbook)", "value": "cb98db5488d642d141fb8e3e5f93a8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361437, "uuid": "3da7b796-9f30-4c67-a20d-b3ea1187c5ec", "comment": "Malware payload (Formbook)", "value": "9c7e2dde0946480aac4422abdb458efaa6d9809241c3a6d979a0dba92120f84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361437, "uuid": "5a5303c4-d95a-453c-94e2-9117dd71c85f", "comment": "Malware payload (Formbook)", "value": "1598fb433bb8b619bcfd8245643913c352ddd34f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763361437, "uuid": "7e27c0ac-0c75-40ff-a1e3-e1c8be512fdd", "comment": "Malware payload (Formbook)", "value": "f796482c831541ad906d93bea0768c83175dcf8edcc8d5b1b9a7fc973e89164630124a1da753adfc64b5c067f71ba1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361437, "uuid": "7295fc17-0162-4224-86ba-12bcb9fa347b", "value": "T10DF402546299DA02E8A10FB42870D3F597B9AD89A421D7138EFFACEB7C797401D443E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361437, "uuid": "e95ec73e-f980-4997-ae70-29c52fd53f06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361437, "uuid": "33dd0505-9d4c-4d6c-82e7-66f1a996a717", "value": "12288:OvpSYx/lYEithuihlQBciLnVDHYSbftyt1kVTfn9Hm8uLa2UIrUd29UhUKvb3AeJ:ORHu6ijQ/VDH30cVTsLaCrUd2eHT3Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763361437, "uuid": "a1880ad6-eccb-412a-9f64-599043d9a97e", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763361437, "uuid": "152f1e75-c5ab-464e-867e-6e02b3f9735c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763361437, "uuid": "b88d9e76-a03a-4ac8-8063-561f5f9f6957", "value": "SecuriteInfo.com.Variant.Application.FCA.2785.6962.19571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d17abf-c409-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420369, "uuid": "78b5c9c2-49da-4b0f-aade-96175ed858d1", "comment": "Malware payload (Mirai)", "value": "90d51fdacd08f3ff2c9c96a574f7b202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420369, "uuid": "89f9fa5c-46d7-49c6-bc9b-4d46bf05f269", "comment": "Malware payload (Mirai)", "value": "9de16d986b95f1700bdf47913fa13cabc3f49ebb4f791e074ac0525dfe44e47a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420369, "uuid": "81cb4bc5-db7f-42bc-9c65-3530872aa2c2", "comment": "Malware payload (Mirai)", "value": "14ec1782cfd5ee238b093760e94bd7ef91a06a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420369, "uuid": "32d0449c-360f-4da3-b000-025fe0cca106", "comment": "Malware payload (Mirai)", "value": "b1ffb76104c4bf955be4490ffbcd29f1d9c71f788cb8e37c216c498c00ab5fb82ded96d09578b73f01a77b3a850fc6be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420369, "uuid": "9e6eca64-df61-4083-857a-faac56d77fb7", "value": "T1E3F33B56EB418B13C4D61776BAAF42453323D7A4D3DB330699286FB43F8679E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420369, "uuid": "bf082969-dbf2-4928-819e-c60948a50ad4", "value": "3072:RNtZDKtUPaNnW1a+2vywLFjqzNPtSpkDWK44BM/9XovPz2n07:btZDKmaNW1a+2vywLtqmeDWK4uM/9oPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420369, "uuid": "9b1513d9-767d-4eca-972b-c3e3ab7e1706", "value": 163686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420369, "uuid": "0ade871f-15be-409a-aa44-47befa867b8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420369, "uuid": "2b9645c6-dd7d-441b-af05-09e388991e69", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf34290-c40a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763420843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420843, "uuid": "0c415852-693e-4fb7-a9ad-18bd3217839b", "comment": "Malware payload", "value": "2e670c59308439e767940339c67e3132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420843, "uuid": "574b3585-7b78-42e6-a458-edbf1ed43190", "comment": "Malware payload", "value": "9fd930b3b809af86c55193eaedffb3921760bdd86164b3e210e1419ff1504dc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420843, "uuid": "9018ecbe-27ab-4507-9dbe-144eb08d30c5", "comment": "Malware payload", "value": "7beabdf7111f748311831960d6ab8c223616a741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420843, "uuid": "47836097-0dfe-46db-b051-a801bef04ef6", "comment": "Malware payload", "value": "2118de9d91fa59a0a0896102acde4a6c24feefee4c957be58f63118b0731ae70f8449ccff70021496ecf4ed04739be52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420843, "uuid": "b9e41f06-8896-4fb3-9b83-0b8fbd952951", "value": "T1FBA2D1E020AF0F79FF9D837BD647288B69F684847B83E3C14F8ECA51DA511A81685754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420843, "uuid": "8a3d053a-4aac-4b52-8bc5-043ccdf23092", "value": "384:MGXbowz2tmh6u3bKlBQuK2IdhPd8vJlcGAwEcv799gzmjV7nzCLv1Rx:LsbmosGnQus7QJZAwE+gzkVDzOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420843, "uuid": "196eda88-15d0-46ac-a4e9-edcbae439191", "value": 22868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420843, "uuid": "a8ee631e-fbef-4a8e-b9f6-05c99bcd5f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420843, "uuid": "104e51dd-cf14-4ec9-85ff-c5e816afaefd", "value": "wewe1.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a441bd83-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363920, "uuid": "0bfb9638-39c1-441f-825a-08d9799f560a", "comment": "Malware payload", "value": "8244cd2f6355526e335af70be8228736", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363920, "uuid": "034cd3cb-f5f5-4fc3-9e15-543f2ff3c7f6", "comment": "Malware payload", "value": "a08b7376717db67dfe1f4f209a78b80b871cabe72e96cc4485d50ec97bd285df", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363920, "uuid": "96959651-2b5c-4f1d-93c6-1e6a556e33c8", "comment": "Malware payload", "value": "46ca9a844a34935ec374f2a1311fe249facb05d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363920, "uuid": "d13399e1-bba7-45e0-82b7-1a6c9f35a608", "comment": "Malware payload", "value": "f38a7971819b5a6f7443d29c42bad5b06bd3eefaea1f19d45730f1dfa545a809a63e88cd66a21b773df1369e59d7e096", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363920, "uuid": "bee41a0c-039b-4e19-b399-6b0803146831", "value": "T1B9C533FE9581CCA5CE7230C1224857D0E386C6F4EAACD64127F82B78688DD8B5BDF954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363920, "uuid": "8ffb25a7-1342-41b2-ba5f-c07dba7104a3", "value": "49152:HZY/STB9QWvs3Jel4Rgh5vrpvXvoQ2RaUOY9wecvyp48StE:5Y/kB9QWQKn5DpvA3OYGe2yp4PE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363920, "uuid": "2904d184-4de6-48ef-a553-f9e433a90412", "value": 2573769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363920, "uuid": "7d939900-645b-4bfb-9f81-43a9d26bb312", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363920, "uuid": "78e9ea2d-c1b4-4887-9ed9-7d77c3337ac3", "value": "WestWorldVPN-For-Windows-1.07.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d13cdb-c34e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763340297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340297, "uuid": "c3264b11-a01b-470b-844c-97859b9767e3", "comment": "Malware payload (Mirai)", "value": "c586ca0ea5073f8c2aaff57633a38352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340297, "uuid": "8bc3fe99-26ef-4b6c-bba4-4e629db6a3e1", "comment": "Malware payload (Mirai)", "value": "a13c9574f547fc3f4014f2863b1c1b7f9eb7df13c87089f02715c29dcc07f61d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340297, "uuid": "e218d47a-ef68-4be4-8f65-ec8b8d50ae73", "comment": "Malware payload (Mirai)", "value": "df77c5335c0b104d4ba423788fdb6479485b5e9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763340297, "uuid": "b233b7a0-23cb-4fcc-920d-ba1ee319c685", "comment": "Malware payload (Mirai)", "value": "8980cba8ca420b2ab8a272f0db13b1987381a4fdb112a87e916f8b439ad729906b2d2ab272962d0e34da4fb04574bb21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763340297, "uuid": "549eeaa1-a463-4799-9851-e8ba71169709", "value": "T19023F1A059FAF17191A0287399FC4F9A7E6F13F8E1B8B182274C005C7DCAA5177F5482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763340297, "uuid": "c310afd6-867d-4bcd-9b0b-c4f7ac97ea31", "value": "768:cRybtgQgGq+Nc1z0mQ7HpaxzxDbRx7WewdwcX5ilUwLYffL+kpNMXQ9CBcfZaTt8:VbtiOUzc7J6zxH7Weksl45NMXTEHp+LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763340297, "uuid": "fa909250-7923-4781-b70d-6f4de139a034", "value": 50048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763340297, "uuid": "0cfb0a7e-a790-4ba7-be64-c79cd34d6e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763340297, "uuid": "a647e100-1ea4-4050-8c1a-73d890861eda", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ec3a7b-c390-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763368457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368457, "uuid": "9b4009c9-9750-40fb-a165-0793f4121ed0", "comment": "Malware payload", "value": "74d09cc6a20ae4cef0ec39255f48bef1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368457, "uuid": "22551ca8-12f3-49b3-8aa7-77e6eb555a12", "comment": "Malware payload", "value": "a3ad628117eef110c7c45d575c2187fe89ad4b18e3930322431b5d99dd35fd72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368457, "uuid": "c1c42dbd-be70-40ef-ae24-53786c55b0ff", "comment": "Malware payload", "value": "7dd38ff2ba40ff39b701df7685830febfe149de7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368457, "uuid": "5aedfa9f-a246-4a36-a3cd-39bca2740b3d", "comment": "Malware payload", "value": "2f86b17862836b97169425c28e41076f95906c723ddf54abfa5c1ac63a8dc3cd8676aa4f5aafd82f93d52177be64c638", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368457, "uuid": "c6699618-f875-4eba-ab87-880becd8547d", "value": "T16031231D6921D5D85E4DCDD7B1AC6174C32AC21E2A12F0C9F3CCC12D5B21FD6AD62944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368457, "uuid": "0d59ed3c-1e9c-4d52-8d4a-1ac0b907f201", "value": "24:4OTMHe1PQYOhgEbu2hRuZTexxg4j0PuX/sdRVh6bHbTo/:401oYOhgAu2H2Texxg4loQnTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763368457, "uuid": "1ef7bdc9-c83a-40e2-af82-b61008335e2d", "value": 1587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763368457, "uuid": "29dff2d4-eb7b-4ae7-9c4d-8c25796a6ae6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368457, "uuid": "04186ee4-18cf-46ea-8ec0-538b4c4da452", "value": "a3ad628117eef110c7c45d575c2187fe89ad4b18e3930322431b5d99dd35fd72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb76e08-c404-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418592, "uuid": "a89b3aff-00f6-4ddf-8ecc-38e68ab8a60e", "comment": "Malware payload (Mirai)", "value": "ecb03f1a727d94941c621f6d7b5d7e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418592, "uuid": "605ad9ec-23d6-417c-915a-8b9b40dc4c3c", "comment": "Malware payload (Mirai)", "value": "a6415db151d92170e48488c645bf4dd220a5359ba938108e8c98ec712592b25a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418592, "uuid": "ea374f45-23a8-43dc-a55e-cb91e0e3bc89", "comment": "Malware payload (Mirai)", "value": "86d014491c5be198bbf650d9ce76f69c5f02f40b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418592, "uuid": "c32c779e-6f08-495f-ab0c-1d8f7a91640b", "comment": "Malware payload (Mirai)", "value": "94a8247bb6ab81a10df95b57ec662be78f81c5422cd9963e77499409e16d4c07a02a9b4463da4de34b0006a9ff3da666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418592, "uuid": "03e22591-6b04-4b87-9f68-b61efe834339", "value": "T199D2E125463B9AB2453454B59AE48E88610B02ED41EB710B46713C772EA67C6BBFCAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418592, "uuid": "68142fc7-bd8b-41b9-9cc8-aac50d7e1ac7", "value": "768:o2mrGvYsIuBTygo7eeL/C4PtQ95T5LFfZNQ513m3P38CJRk9q3UELKX:oJrGEu1JAeK+vTnfZS5c/3HRNLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418592, "uuid": "96eea5cd-c4a6-42cd-8c7a-bb81fe77ad51", "value": 30844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418592, "uuid": "d87c19b5-4478-45bd-81ed-f9450276e352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418592, "uuid": "41ec90f4-901a-481d-822c-c630e47da169", "value": "wewe6.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9345b0c9-c3b3-11f0-a129-42010a9c0007", "comment": "Malware payload (ClayRat)", "timestamp": 1763383648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383648, "uuid": "56cd97af-a4db-4954-8066-59778f7664d8", "comment": "Malware payload (ClayRat)", "value": "1431e8d0f471c692a43c52531da223ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383648, "uuid": "1f4fec1b-d2b3-45af-ad30-6f628a3bcef7", "comment": "Malware payload (ClayRat)", "value": "a864d996cb6607a470469d9192cfb8abd3797a8ad90bea7ce00caa1195b40e5f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383648, "uuid": "cd95c368-2d54-4a78-a933-c7c227a3365c", "comment": "Malware payload (ClayRat)", "value": "0ddbb68b1e5710b385bef0fce269a93cb8fb3eee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383648, "uuid": "6f49da51-d8fb-4da1-bec4-7ec161fddeeb", "comment": "Malware payload (ClayRat)", "value": "e0545da51db3f1e5bb41fdd1cf17072280449f89be5fee5ba3eff2bebb7ac39bd4754bd69824a3ffe74b91245878f99f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383648, "uuid": "58d99914-eff1-4689-bff5-b25817264793", "value": "T1C1460196F70994BEC8FA67360A7612701163CD268F839787696C723C68B71C85F29FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383648, "uuid": "50af2a12-507b-40e0-87b8-8a4744657858", "value": "98304:YXGJ7o5+Re7uTS79WWf7J05/QG12RN2Wt7gQYutbC3I3/WQG3lChDH2H4vmAMk3o:YXGJEUTW7Lf725/QHRN2WtIO23tQCChc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763383648, "uuid": "bee837b5-1aca-40ec-9851-9b55f1933c40", "value": 5501723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763383648, "uuid": "df6e7fec-c378-4a2a-a2a5-c4682622b4d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383648, "uuid": "00fff8e3-a7e3-4369-a3ee-6bc3a00c5640", "value": "TikTok18 .apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983391e6-c3b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763383656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383656, "uuid": "91e0c789-8c89-41e7-bb54-13712250290b", "comment": "Malware payload", "value": "38f200d3373e6cb74d692dcae5119e35", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383656, "uuid": "7502cd2a-de47-4bba-8296-4e45ebf63bbb", "comment": "Malware payload", "value": "a9d2af33acfb4f7d6b75199eae29f2ff6ba983547269c8ce1c54dcde72991a1a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383656, "uuid": "d0c32504-ed1a-404a-aa08-9cc64de6e6a5", "comment": "Malware payload", "value": "65672553712a7335e7f3f14c6d5ee092e3b633dc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383656, "uuid": "629ecc65-c98b-44c9-8f7e-37f44d3198a7", "comment": "Malware payload", "value": "1555199f67f1729689dc7afd9e3fb1fbff00b713649f392652805597326cca373c415e41bcdb7278e0f79be3fc1770d5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383656, "uuid": "2650b29d-80e3-40f5-9ce1-6a4c84fc181b", "value": "T14956F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383656, "uuid": "e56562a8-4c95-494a-8355-15c82f0c40cf", "value": "98304:LWPLoTwrY5KOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltf:ykKOfyaIbaciAFvrEZpXqmY9XrF/mpC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763383656, "uuid": "6cbbe762-a9d6-4b0b-86cc-9b070934d04e", "value": 5890511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763383656, "uuid": "e32569e4-3417-4239-afe4-18264b2f7b13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383656, "uuid": "1d0a3d74-ff96-4ed7-9527-30d055e4352c", "value": "Adagaming168.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626f64a5-c404-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418355, "uuid": "54d5cdeb-2f58-403a-8fd4-faf8e69c5dc2", "comment": "Malware payload (Mirai)", "value": "7dc5b1e2e1c6613c2385f7c4846ec135", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418355, "uuid": "8fb3a784-39f8-425d-99a9-30d3eb8e5faa", "comment": "Malware payload (Mirai)", "value": "ab894321ae51b4ca5758c99cb29756ffa6d5a9363685fc69c05db82ed3ab1847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418355, "uuid": "101090cc-2d6e-43bd-87eb-9a61a49e2427", "comment": "Malware payload (Mirai)", "value": "357f1eeed1ec8fb0479924ccfe62bfab00c5ab04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418355, "uuid": "b5e0c90c-4475-49f1-8194-c14ac5d997ae", "comment": "Malware payload (Mirai)", "value": "dfc26004eb2e65d7941d62dc1a4d088a815eeeb20200ed21776f28b755a7fa8eebade04bc52abec489213c329ca9c30e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418355, "uuid": "ae37c14c-4a43-43ea-afb7-0a38137ea1e5", "value": "T1AD13D6B5B407B3BDD4D5003CB84B25B9296302CC3688E3D3A3AA0575BDA574D3EA6E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418355, "uuid": "b7db1ba0-a697-41e4-9156-97f82edcf51b", "value": "384:B3XMsNoqH7Uwgf6dboF5v3fMwcKiaoWN/O6S9SGW/2guWBVKAiuinjfdxoCZlxBn:isdbUwgydasjdQugkUC73A7yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418355, "uuid": "c5c2cc6f-fe35-4555-9b18-0de5a2ef4125", "value": 42636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418355, "uuid": "294f4ab3-2a05-4c87-ac91-cf14360549aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418355, "uuid": "b1d4b645-ba20-4714-947c-7c7ab7cc7b30", "value": "wewe12.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a7a881-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363900, "uuid": "74a79537-989a-4806-b0d4-1018d336c99e", "comment": "Malware payload", "value": "c4989c6eb2e244e09fd410965cdcbe3f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363900, "uuid": "651158e5-48a3-4c22-930a-3ebdaa6a06eb", "comment": "Malware payload", "value": "abf614c388216d3e04e3a4a8faf5e851205fa22af4a7313278d994934dc124da", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363900, "uuid": "8197de86-3501-445f-87f9-745ff4eb78f7", "comment": "Malware payload", "value": "29ede6b1c713d3064b3124e188265b22560c68ed", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363900, "uuid": "11781f7e-30b9-4cb4-9605-dce4c3ef06d6", "comment": "Malware payload", "value": "186951c445752ec20c7362a0383e73aaf0954a907fa022345d91b744e887c8afaaf9233486ffcbdadc5ad4fb890c3c40", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363900, "uuid": "95f51587-ceff-4259-96c5-bf40f14322cd", "value": "T10CA612D6F7D8AA1FC4775032C97A52F2154B4C168A839F876A18770C6CB79D40F8ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363900, "uuid": "00b94100-3bb3-466e-8158-aa71699e4c0c", "value": "196608:YFQVYgd/GW9OUb6HlrMWYladRCQoQCzb80FKJhMpivav:uVwrmF/IajIVciKJhYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363900, "uuid": "afa8da3b-4472-4730-809c-d56f026adacc", "value": 10414012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363900, "uuid": "a1e4a021-8ca2-44d6-8e45-132f674f9d6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363900, "uuid": "de9710d4-0c95-48d2-84e8-5554241b04b9", "value": "guruji-matka.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482c5605-c3b7-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1763385240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385240, "uuid": "f416a79f-0003-48a9-b60d-c1955da7dd72", "comment": "Malware payload (VIPKeylogger)", "value": "00135a92e4088fa7dd2caa7d1a94b5f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385240, "uuid": "148523e0-6570-4c07-a05f-52d905bf92c8", "comment": "Malware payload (VIPKeylogger)", "value": "acdf77f74f6d21c09d55634b1401244b1a18a9bf77fef81d7f7e57e5a3da4d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385240, "uuid": "c27635ce-41bb-43fe-9bd3-3e3d816c694e", "comment": "Malware payload (VIPKeylogger)", "value": "e4868ad0f27e8753f47051673cef5ebef9e248fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385240, "uuid": "4575c071-bfcd-439e-b15e-0dbe7d245df7", "comment": "Malware payload (VIPKeylogger)", "value": "49fb63b164d7c153d6a2d5bff50f7ea8556035b39c393984a538e8a747ff0d22bcbe5da9d6fc3f17ff8827d742a507ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385240, "uuid": "d2a4f1dd-8e94-4642-98e4-de539a5126a1", "value": "T1B3F40254229CDA02E4614FB42875D2F493B9FE9DA921C3078EFBACEB7C6D74059443B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385240, "uuid": "79249d86-c72c-45a1-b1a2-343dc0a86c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385240, "uuid": "d122b483-cd1c-47c2-b1b3-1c28e893c0ca", "value": "12288:B6pS2EMWr02SCE9oSdV4pt2oZaj6ucNKEtZaw3656OSodlOx/lYEithuih5:BWeMiPE9Hz4vXAEtf3iJdlyu6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763385240, "uuid": "23f31821-4b3b-40a5-a2df-dc69949831fb", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763385240, "uuid": "b8b9c851-ca7f-4763-ad49-506402851f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385240, "uuid": "02f260a0-97c1-4e48-85aa-7f7215df2adf", "value": "Scope of Work for Epoxy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d73e833-c3a5-11f0-a129-42010a9c0007", "comment": "Malware payload (VenomRAT)", "timestamp": 1763377545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377545, "uuid": "fab4677b-d7d8-4238-a540-436216059374", "comment": "Malware payload (VenomRAT)", "value": "6de57c12f3402c1da3cf2b047fa1efc0", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377545, "uuid": "14ad1b21-92a5-46e3-b594-260c2e9288be", "comment": "Malware payload (VenomRAT)", "value": "ad6417ba292c504cb7307ca0c520435739f87908f117cc2423cd4b7e81cc1ac8", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377545, "uuid": "208a9580-b071-4bd2-82f8-e8627197a707", "comment": "Malware payload (VenomRAT)", "value": "517238312d878739fefc844e77e560c11101a9d2", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377545, "uuid": "09450aee-4cb5-4148-a0bf-96a2b4697b2c", "comment": "Malware payload (VenomRAT)", "value": "1f94358832957b66effd24c76acd01db86797e7d91d89a40f554650cdbf987bdbef8cf5bb035931a449244e238074dcf", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377545, "uuid": "5232041b-d51b-4b75-b74f-e160869226d7", "value": "T1D775AF34DC2A3CEE361E384DCC1C1D0A3E155B5F92A10F18ECE96D75669EA81EB1D4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377545, "uuid": "eca85303-bbf6-4b01-b056-4afde440eaec", "value": "24576:kaJMuBS6kqWxg3WUG0cskc6bIgRa0pAOVPvefeN6FAyvwwDvhJe:VfSn2G0T7krN6t+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377545, "uuid": "b766924c-2f65-4b83-96c2-aa398f7448b9", "value": 1668183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377545, "uuid": "86fcc25a-e167-492c-acbb-fe67de2ecf30", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377545, "uuid": "49350946-157b-455f-a687-5867c484dd77", "value": "IMG-2025010-WA001310.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e4faf3-c357-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763343896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343896, "uuid": "e125175b-c838-4f23-bb7b-a0507ecfc087", "comment": "Malware payload (Mirai)", "value": "b9a54dc84427d086cc54176acd2944df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343896, "uuid": "034c52ce-fb55-48a0-a5a2-3263181da06a", "comment": "Malware payload (Mirai)", "value": "b1ad8f75d8ca1ed287e2e191fc613b1a7bb60dee51b59384ecbd750c84dff7de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343896, "uuid": "a2441214-0d8f-4bd5-aa09-76443df09317", "comment": "Malware payload (Mirai)", "value": "35ac951e7919a42f658ae9c7d058b8bfe7b892f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343896, "uuid": "eba6fdb6-775d-4582-b7a1-0cb4a196c3fa", "comment": "Malware payload (Mirai)", "value": "082a6bb4e2d323d8d360a27e67e9d03037c2a81c6772c7c98a7615f48065eb96e3781ae1374455f07db581bd21a80e7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763343896, "uuid": "307400ab-6e94-43f4-9ef0-082fc3e128a6", "value": "T11AE3E81AE7664FBCF26C86B147739A609A48139717F3E181E46CCD05AE7034E681FBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763343896, "uuid": "c10c4afd-8580-4e07-b397-0a3157ac770d", "value": "1536:XqDJhxTOlHmcQQ4lvFFeZJWCrPp1dFtVvlXPH9lLH1rgVfRZPETFxj7bH3NT8zAt:rZfX4BAPA4/LyJW+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763343896, "uuid": "a09d589c-fd11-4feb-9848-9c96f8d121bc", "value": 147084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763343896, "uuid": "b682c69a-6723-44fa-a42f-6a8f28384f98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763343896, "uuid": "dfbe9e59-f77d-4a0c-bde8-06ed788ae3eb", "value": "b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0af1f0-c39f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763375232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375232, "uuid": "8f9cc362-94ff-4b7d-83fe-01c88fc84d55", "comment": "Malware payload", "value": "df260e14a2cb6278b39c2a0eef64671b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375232, "uuid": "a5620a79-a8b7-4d1e-9bbe-aceaf33bf80a", "comment": "Malware payload", "value": "b2921e1ff0b86b3f5435b81ba6327a26e84169af136a594bac21625095daf8d1", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375232, "uuid": "a2604daa-61b5-4bf2-99ae-a60d7ead3503", "comment": "Malware payload", "value": "dd753e191ebe37b9b4128327ea0ca35baa6ebfaf", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763375232, "uuid": "da05bbff-7905-421b-b8d3-ef65a8882018", "comment": "Malware payload", "value": "158b1270e419b35328e4a78c575513a6afbb12f265c88e92ba313aa73c40253e02fb150617fb8cf8e9c4ad50f5443c2a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763375232, "uuid": "e4dab206-30d8-48f5-a86b-010979d901d7", "value": "T1CDE07D8F04101A33C7CD05716E41CB77D20C484180E6F8BBC14D602A1CC36360D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763375232, "uuid": "a738265c-a23b-4e8a-9a9c-42d3d218853c", "value": "6:5j21xZADuth2ILHdZblUkXabhckfBL8yyXJnE21xviAkt+llX:5j8x+DYX9Zbl9yhFuZbx7kta1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763375232, "uuid": "2ec86009-61e6-4065-99e7-2884b8b93322", "value": 321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763375232, "uuid": "9f37e281-2b1a-4f3d-a668-fd0b266033cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763375232, "uuid": "f9b9a7ca-bc6f-4e34-92db-5a9450634850", "value": "Invoice.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1db80b-c38e-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763367748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367748, "uuid": "27ce9108-d9e8-48d2-bc37-269b87c21016", "comment": "Malware payload (CoinMiner)", "value": "dcb54909553893d9513404130a00345b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367748, "uuid": "f8cd7a21-c4a9-4671-ac17-6a8e86d24915", "comment": "Malware payload (CoinMiner)", "value": "b39bff6adb3947886e8689be98aca658b276362a2df330d7952222ccd52a209e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367748, "uuid": "51dd7899-4b7a-42c4-a17b-f682c8503b72", "comment": "Malware payload (CoinMiner)", "value": "06094aecaf258d6987a7b49ab72510538857be56", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763367748, "uuid": "57fc5795-5e93-44e9-83e9-23b15e969724", "comment": "Malware payload (CoinMiner)", "value": "c4e555bf03c492cf5710c26102f50b862e313d180b37df1986e2e73dfb08bec5fcdffa1c02aa9d2f7b6a6a055f66ce1b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367748, "uuid": "bc9f5253-ce52-4735-a54d-16ecfffe1df7", "value": "T171E48D27BA60A47CE16BC43497CFC2B2EA75F46502263A6B3BD4D6303E29C509B1D753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367748, "uuid": "654a7e2d-01ef-43e5-9ead-a186030c2749", "value": "12288:4NwwV1kI11RPJFErLZevNIHc7+S/DRRAnAjBsKz04meaft7h:4NRLHRPJMA1IHS+QRRAnSsKzxaft7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763367748, "uuid": "78b3a888-124b-43c7-b575-c80e75d7f1e0", "value": 672520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763367748, "uuid": "a6d4ae28-7f59-4aa0-b3f8-0ea6abddcda0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763367748, "uuid": "4884c891-5545-4c58-ac1e-65fef966de9c", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec85ae7-c396-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763371105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371105, "uuid": "806c0429-3d65-4194-a901-7950511ca10e", "comment": "Malware payload (Mirai)", "value": "7cb93fdad665fbfc7de0c67cd75c115e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371105, "uuid": "419b08ad-b73b-45a0-8532-408cb461f04a", "comment": "Malware payload (Mirai)", "value": "b4b60101a9c634f267e1d43ba6ef11be85611980dc6ee58849fc590566ee418a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371105, "uuid": "fc9aa451-7dd0-4cdc-8697-250caa84b3d6", "comment": "Malware payload (Mirai)", "value": "d38c83df4c3802a5fcd884998ee543c9f3f4c56d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371105, "uuid": "690d32b8-4802-45b4-98dc-7d2b9ed7f820", "comment": "Malware payload (Mirai)", "value": "703f98896b4028b86a7fb43ff2ca43cbb2ec8fa759df1391114fb8874d3c6f091b337030240473887f1639ed440651e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371105, "uuid": "f2d62170-2e0d-4ac6-a265-aa8c351efb4a", "value": "T143A36CE6E243D4F9EC6241303176FB379E72E5FA2129DD83D7A49A63BC52A01C406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371105, "uuid": "2734ed1f-e5bf-4b57-aa98-ce715c912abb", "value": "1536:fJFS5Mgc9Gm+iptNcsqMW/FlbTmDr4w0K3FXF7oUvmZcmV4N/gcAuiWngC:BFLgc5msbmFl+Drp0YFdo/Ss4/NiWng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371105, "uuid": "78415e54-ba83-4adf-9445-683ede82904f", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371105, "uuid": "1216d9b8-1619-4f5b-90a2-39d62097fc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371105, "uuid": "632ddcae-a157-4779-a937-a5e9a4b831d9", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6633157f-c349-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763338046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338046, "uuid": "88dee0b7-905b-42c9-bebd-ccf2faf902f4", "comment": "Malware payload (Formbook)", "value": "14a6288715feeeab82fb2df7af513f93", "object_relation": "md5", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "downloadfilesd-xyz", "colour": "#5C5C73", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338046, "uuid": "071c35d6-f769-46c1-b8cd-8b61ca456da1", "comment": "Malware payload (Formbook)", "value": "b6426ad74f110c618f386180fda830a366607fac16789a2055ab8b28481c286e", "object_relation": "sha256", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "downloadfilesd-xyz", "colour": "#5C5C73", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338046, "uuid": "e1ecc01e-7484-40f3-ada1-b92e3fd682ee", "comment": "Malware payload (Formbook)", "value": "d5d00dd7f03aec58efcb780685d42269c65ce376", "object_relation": "sha1", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "downloadfilesd-xyz", "colour": "#5C5C73", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338046, "uuid": "5e5a89df-78fa-43c5-8ad2-2156e0983504", "comment": "Malware payload (Formbook)", "value": "808dabdfb5dd1f1e3138cf15e8ece74948c715bcecd1fc05147c4a3d77cfd40482b6a0f014654e63478c2b3df877b428", "object_relation": "sha3-384", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "downloadfilesd-xyz", "colour": "#5C5C73", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763338046, "uuid": "2d0eacab-9eac-41a1-9cc7-a597f290610d", "value": "T1D9120F70CC33040F8CF75EE050118A7FFAF4909BAF7E9956E991926764EF8125B22B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763338046, "uuid": "634732c9-9493-4efd-a566-649433ba0999", "value": "48:+RhsMiP5HHB3eVRqvs0BtOEZT3GVIi5M2dnPAxm8laOlEyD5d2fZEBwBSZDA2NR:+RhHmnB8XOgEaJHdPAYPyDr2fZo0ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763338046, "uuid": "56dcee16-f7a1-4e9b-8c3f-56af1d5ad74b", "value": 9361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763338046, "uuid": "86c48adc-3381-4c26-bda6-8e5eb9f17c5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763338046, "uuid": "27c8c364-9143-46ce-8a49-2777078b8bd3", "value": "ffss.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17e855c-c384-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363620, "uuid": "a841dae8-e2ef-4ea8-9a57-61130c9dca4d", "comment": "Malware payload", "value": "d85ef319dace834370cc2a6081841df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363620, "uuid": "35c11591-d99e-4fb3-851e-7cb78b5321c6", "comment": "Malware payload", "value": "b6494a40a5c01704e851d866d226886dab85320fdd15232117ad40a0fcf684ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363620, "uuid": "c37823ff-94a9-4864-8796-9dfc3ef2f0ee", "comment": "Malware payload", "value": "91470ab34fe4ea906602f9ecd8360dc07ad65dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363620, "uuid": "ce72d524-08f0-4737-9b87-d0da7d31fb18", "comment": "Malware payload", "value": "245741ad083eac01b6b83bfb454ac57990deeff04b399c04474b55ba2980b5d1f6b1500e24ef3dbf53875b6abbf89a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363620, "uuid": "5d886cd4-6bc0-4fa3-b6dd-37ca7cc33649", "value": "T1F90633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363620, "uuid": "f5e7972c-cdff-4d3c-9724-7d0af50074c9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363620, "uuid": "35de81d5-6f1f-4cad-8900-3980581ad725", "value": "98304:arT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:o2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363620, "uuid": "2c753bb6-8712-45d7-ad4c-99a77245d812", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363620, "uuid": "7b5f7072-2d97-4962-9aec-8f589cbcaa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363620, "uuid": "181a7551-2029-42f5-a221-a6d1a8c15a4f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1be4c8-c408-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763420335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420335, "uuid": "02d4a7d0-ba64-45d4-abe9-152761581d76", "comment": "Malware payload (Mirai)", "value": "55ee45bb1e4789419f9c7803a2d718f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420335, "uuid": "55c96aea-f4d7-4cbb-a306-47042177d6e8", "comment": "Malware payload (Mirai)", "value": "b8616511ddb3b4c3fdfbb364a3d1b136b5351327380bd79d33847b3b0fe8be09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420335, "uuid": "8ff64f95-ee88-4c09-aab2-4ea262b59a60", "comment": "Malware payload (Mirai)", "value": "71ad3dff4d2da95fcb71740a121f1ae93a70bde6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763420335, "uuid": "85e2f2be-c85b-4757-8420-6fb44af680b6", "comment": "Malware payload (Mirai)", "value": "756ddd251e44a0ad8d95883aa1315288b4a763b7a6ed712157fab883935089e0104efc2170b9ef19ff2b0052c249278f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420335, "uuid": "f7106f76-ab3f-4910-96c4-f880e6bd957e", "value": "T1E0B2DF65E5005FEAE89FAEF0A8B0D399FF901F4A3B8548C52189DF73125B115AA88DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420335, "uuid": "21c70c7b-01cb-42e7-8f60-338229b95774", "value": "384:u/kti5OnQVZGgnXdgSzYMs3GWxZWh+cqnGdnqT8oXMJXX7+M4uVcqgw05VxJi:oYiQQhraGcZWwcqnGdnm8ocJH794uVcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763420335, "uuid": "7b8211f8-5f59-46a4-80e2-a274686b543a", "value": 24360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763420335, "uuid": "8defba9f-2587-4045-b4b8-eda58d5e6a00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763420335, "uuid": "b9eef1e2-4902-4bc8-9be2-4bd47e4c809d", "value": "wewe8.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2a18a3-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763387480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387480, "uuid": "a32503e8-12e1-47b7-a04a-c42e9161aa90", "comment": "Malware payload (ConnectWise)", "value": "84b58121896b32b232bb6877f3e64f86", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387480, "uuid": "7aa9187e-f04c-431f-b624-177497889c8b", "comment": "Malware payload (ConnectWise)", "value": "ba731f5554d55c6b101720e3587709877f98117c22a8f437438f9fd25d825e6d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387480, "uuid": "44995af3-8bf3-4bda-8bbe-c0cd988e7bc3", "comment": "Malware payload (ConnectWise)", "value": "3f333b7ae5d2a6961b1a859b51124953d74f547d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387480, "uuid": "658043e3-5d11-4425-b95f-65eb0602b0ae", "comment": "Malware payload (ConnectWise)", "value": "8c419de86c8d3a0a36a6e6889263b2a2ab126e0909bb4a7b347a5a7556491324b70bd129020df67f5a0b5de5ab3a20be", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387480, "uuid": "77ae44bb-2713-452b-a591-6d78ec77b8ff", "value": "T1C3A6232523FD801AE8F75A7DED3682F45972BE64CE22C11E9328BD0D2974D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387480, "uuid": "e96f32f7-f040-4f36-beb8-a0471995b247", "value": "98304:OwJ4t1h0cG5FGJRPxow8O8wJ4t1h0cG5vwJ4t1h0cG5RwJ4t1h0cG5wwJ4t1h0cW:rWh0cGwTWh0cGCWh0cG4Wh0cGTWh0cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387480, "uuid": "5bddec21-1bc2-4a27-9ce5-7ebd5ed4dc3a", "value": 9912320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387480, "uuid": "aaf9a85b-6b58-4353-a2af-6f7d96ccba0e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387480, "uuid": "b04c93b2-1c63-403a-832f-94b18c8b5cf8", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452828aa-c3b7-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1763385235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385235, "uuid": "550ccea8-b4c7-42f3-9fce-422601754841", "comment": "Malware payload (VIPKeylogger)", "value": "6f3d0248dec646f4cd7e6456d0d8e43c", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385235, "uuid": "7e65d7dc-2c2d-4f66-abe5-0c7daad8fe94", "comment": "Malware payload (VIPKeylogger)", "value": "bb63200f249ac33f2d5facd07fe750c5eb079a6e9ead9f38402af694c91c44f4", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385235, "uuid": "8d9826f5-35fa-4deb-b1ac-245a0e3982db", "comment": "Malware payload (VIPKeylogger)", "value": "d5155664bbe830a3f37b44c307d0a4eb45f9f058", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385235, "uuid": "d1ab785a-e428-4bbd-be64-cb5cbc00e0a4", "comment": "Malware payload (VIPKeylogger)", "value": "c677f0bbfb1a1d7101545340cb45c2328bbeff7c565a6cb68b56e5f3910a6985acd82676bfb3cc183d5192e63b730550", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385235, "uuid": "d0c7eb2c-c59f-4bba-b46e-59575334116f", "value": "T1C4E423B34F56C3A5D2A0C11C816B578D8AE9EF90F00FA5D24715FB9B6C1361813CAB57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385235, "uuid": "0a8717fc-023a-4ec8-9913-d5ba3eb1c97f", "value": "12288:3J4UoRfpIcIa4biYzaVBbJ+4SWQ8kb34joR6FUmZ4DPEzjN94Firnr:3J4Un1tM/7kEjow1jN9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763385235, "uuid": "3d77e4c8-a70a-4f8e-bce0-f22202a22e2d", "value": 696163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763385235, "uuid": "3134a998-c7c4-48fd-8d19-eb80f93500a7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385235, "uuid": "6caa24d1-5c7f-4e1d-bb5d-de72637c82a7", "value": "Scope of Work for Epoxy.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1951e39-c39e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763374733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374733, "uuid": "ab091fd0-9d25-44a2-a375-882ba5e62185", "comment": "Malware payload (Mirai)", "value": "4b0ebcc4f0e383cc516b553937c86f8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374733, "uuid": "18b1bd60-5f36-492b-8b06-a646f040f57b", "comment": "Malware payload (Mirai)", "value": "bc5ba710fc61fed08e1c12249085f7ff4397c7349ae8ec9a37a40cfce27e5f8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374733, "uuid": "cf99f49e-9367-4c2b-b2a3-16121202f7b5", "comment": "Malware payload (Mirai)", "value": "e98022271930e3c2dc983c760b403398c8028887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374733, "uuid": "ec2b8123-e080-470a-99f2-c4eed97732c7", "comment": "Malware payload (Mirai)", "value": "325e3fe599877f803c875ecd1a706b4f588e2c7dcf970a05be95416ba2d95203b84e85da589f508134f6180f873acaea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374733, "uuid": "691a56cb-d768-4e28-b949-26a462b87a05", "value": "T171839D73C82B1D24D04848F0B0A4AF369B63E215C95B2EF6949AC679D087EDCF6467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374733, "uuid": "66f21468-e62d-4f2e-a590-c53a466dde86", "value": "1536:HE+Lx1PNlHPgpigujKDbCCGrSq6CHi/PzD/29Ore:HhLxBPgpiHGDqrSq61/PPeue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374733, "uuid": "a81348eb-1d23-4ee9-80c0-14973dbc007d", "value": 81028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374733, "uuid": "b420a295-6dc5-48a8-aa9a-f42130f3e6a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374733, "uuid": "6bda5268-ce0a-4e51-890f-a6c17d56942b", "value": "Labello.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca8d226-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763366269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366269, "uuid": "f912576c-76de-476c-9e33-6ab98620b119", "comment": "Malware payload (AsyncRAT)", "value": "bbc1af77f6d6136572972ab2e0057067", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366269, "uuid": "11f23f0d-4164-401c-be09-c2fbaecf89da", "comment": "Malware payload (AsyncRAT)", "value": "bce3d785263907d22616adb089e84a1941b291ff326053bd43f9ce6b0ae11a99", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366269, "uuid": "f96e324a-a293-4667-be08-b12916aa3ddc", "comment": "Malware payload (AsyncRAT)", "value": "5cc1d1c35194d122a0d4c1b76d5d14157f8bf212", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366269, "uuid": "77dfe080-8ea2-4a98-91d2-26d479a99d29", "comment": "Malware payload (AsyncRAT)", "value": "a9214783e920c46586237dc609b14e0947a734297209ced8d175a8e6bc0ad9f2fed523520de4f2b8da162097ebab8f91", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366269, "uuid": "6e5ab501-f419-48cb-afa2-bf4cbd235781", "value": "T1CA05AE1B2E55B936D3744BBF0820E2B85AB85C1595E4E20379EFFE9F7C39E021944392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366269, "uuid": "51315015-d6d8-4d90-98ba-44b67cd494cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366269, "uuid": "f5e71481-4bde-4bd9-962f-0abf0895f996", "value": "12288:kSgSlcyQczwYIzsiRIb+kH1GO2hUxVOdlUUB+x/lYEithuihm:krOcyQczoXRIb+kHh2hHllcu6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366269, "uuid": "e54df8a2-9390-4f62-98b4-fb7810d5c827", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366269, "uuid": "78bc9258-1770-4e53-afcf-b3c4d23cb776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366269, "uuid": "eb0e4ee0-7abe-4e87-b737-2bdd2aa62308", "value": "Our-CompanyPNGared Msg-DateD-20251711.TXT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e505f21c-c365-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763350284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350284, "uuid": "2e085fde-aaaa-4cf6-8791-a7f8a3dd0ceb", "comment": "Malware payload (Mirai)", "value": "fbd24d6dbb78c30cbbc567c53faa5c8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350284, "uuid": "aff974fa-9165-4a6e-bb4d-f0c33a825af8", "comment": "Malware payload (Mirai)", "value": "bdc43d2e00422b88e01195dd8a226cb3f966e3801ba98b5b85000bcbe8bf9c88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350284, "uuid": "a218a178-3076-4a02-b1df-2d416877b71e", "comment": "Malware payload (Mirai)", "value": "9b338db1e8b4c479e163df2eca9b115ac85ac008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350284, "uuid": "3fd88b9a-ec52-4d04-bdc1-2d27aec3630a", "comment": "Malware payload (Mirai)", "value": "3e18d3b9e75d26d60101bc9e2e3c374eb82051d3976285d90c969bedd5f4ce9c58d3de06db642b98df3fb79efd8e27c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350284, "uuid": "2458c00d-2c29-4c4a-9eeb-b262cfa5050d", "value": "T185145C46EA414E13C4D7137AB6AF4249333297A4D3DB73069D286FB43BC279E0E67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350284, "uuid": "dab96c09-87bd-43c3-aef6-7ff90a16eea2", "value": "6144:6RxoJkilrcSWvpb4Taiv5SJBE5WkiprBsKab5M/9/3HtBg:6R6JkilADB4Taiv5SJBE5NIm5u/9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763350284, "uuid": "1f25de4b-5f46-484b-b5a6-d129a83b8251", "value": 202130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763350284, "uuid": "40188600-726f-486d-a89d-ff09e8f8d10e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350284, "uuid": "6d697d7f-f70b-4fd8-af2d-08e0b7cf70da", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7244801-c3bd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763388003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388003, "uuid": "b89e7443-bc86-4adb-99f2-ae5d4e5e1cf0", "comment": "Malware payload", "value": "a68840664e3b46ff610a04fe109f7e58", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "notifica-modulo-com", "colour": "#3A5C2E", "exportable": true, "hide_tag": false }, { "name": "systemcloud26-com", "colour": "#B7B154", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388003, "uuid": "71ba0b72-4068-412a-88f5-57eab491c28a", "comment": "Malware payload", "value": "be0688a7350f0bb59bc0cd924cc35b6fb0810bdec1bddbbda000a29fa74995b5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "notifica-modulo-com", "colour": "#3A5C2E", "exportable": true, "hide_tag": false }, { "name": "systemcloud26-com", "colour": "#B7B154", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388003, "uuid": "3035a03a-ceee-4842-b5ad-84262f60083d", "comment": "Malware payload", "value": "f4c2aee9f82bb0d5ca63f2b0cbaa9da70ed265e1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "notifica-modulo-com", "colour": "#3A5C2E", "exportable": true, "hide_tag": false }, { "name": "systemcloud26-com", "colour": "#B7B154", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763388003, "uuid": "1de7d90f-1101-49bd-9313-c175731898de", "comment": "Malware payload", "value": "0c664b847ed842ac4000dabfdd761f63485a596d7f59da8dfe30e0c294da189eee3aa8772b2a3c85979eb21b216655a6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "notifica-modulo-com", "colour": "#3A5C2E", "exportable": true, "hide_tag": false }, { "name": "systemcloud26-com", "colour": "#B7B154", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388003, "uuid": "add43113-63af-4203-9cbd-7fc638bdd7a7", "value": "T1E506D032768AC132C66E0172A92DEE5B567DBE720B7144CBB7E83D2E59708C16335B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388003, "uuid": "3d021bfe-e246-43e5-bc0d-c5cf88fba720", "value": "49152:lASIc/f9r84jEHYDgM5+7vGFfF5NqP/1Ujgk5I/U0Hsb8OuQMhMgeCaGRljj5Gx1:oVHYDgBCl8P/iOOLGI1D3FNfJB9dz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763388003, "uuid": "6fb89e6a-e146-4f0c-9d38-a624a25b9a38", "value": 3960320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763388003, "uuid": "1776e3ae-8c50-4ae3-aa2d-7067ffdccb9b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763388003, "uuid": "0a5fecc9-2195-446f-9724-577059f4459c", "value": "be0688a7350f0bb59bc0cd924cc35b6fb0810bdec1bddbbda000a29fa74995b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e28c168-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763366299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366299, "uuid": "9f2c5157-963e-4732-b12b-8a46fdf008de", "comment": "Malware payload (Arechclient2)", "value": "d4f2e3bc5b9e878a0b07ac79e23e4184", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366299, "uuid": "c31221b7-bb12-4e30-a2e5-4b3ca83d3291", "comment": "Malware payload (Arechclient2)", "value": "be6944d3999095fd8831277adc37f0b5fc40e0639b8126a69f6cac24e464f31a", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366299, "uuid": "85776931-b06a-4366-b185-e960779ca4dc", "comment": "Malware payload (Arechclient2)", "value": "491eb082a7159352adbd929bdec08e5d9358f739", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366299, "uuid": "86622b08-06a0-4acc-9acc-e5ecbd73530e", "comment": "Malware payload (Arechclient2)", "value": "b7f09a2bb2c6f0b9c14dfb8e69ba6e26de3266028a94f52994050417831bbcb97e726030fcf25c6da22aaa18dd9ccb52", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366299, "uuid": "7b1b4249-0e37-48c0-8f83-125fe9a9e364", "value": "T14E356A0872AC4A06E2BA6BFC9AF1C93003B73D996415D2658CD6F8DBF971F410A16F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366299, "uuid": "1657ef02-d7d8-4756-8ef5-0c621d4baade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366299, "uuid": "787f2893-a1f8-487e-91f8-9f616e1843c0", "value": "24576:BIH1cfu6iLvaha16BeEfNNALFG06CCCCCCCCCCCCKCCCCCCCCCCCCA:S68vaha1vEPAFgCCCCCCCCCCCCKCCCCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366299, "uuid": "2339faaf-53de-415d-98c0-7a4897e86f31", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366299, "uuid": "6e97aa44-4ae3-4246-82ad-7e7ab7c283a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366299, "uuid": "30e104d2-f892-4c35-8fcf-11ac85ae64ff", "value": "Specifications.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776a56fd-c36c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763353107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353107, "uuid": "9daad75c-e532-4547-9a6d-9af8c5af8b24", "comment": "Malware payload (Mirai)", "value": "75ad5b5061e180c4e5d96a99788fd0ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353107, "uuid": "8369e66e-2133-41fa-936f-82fd567957b8", "comment": "Malware payload (Mirai)", "value": "bfab251a8e4aeac7e6b60a02c4e21e6b85cacaa22d3785799785ddd560ce6696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353107, "uuid": "4704dcab-d216-4644-b4b8-7a027a165cc3", "comment": "Malware payload (Mirai)", "value": "0d44e5940f8470349aa596d1ed3757acbc6200d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353107, "uuid": "ea97e1b3-bc03-4c38-b477-ca50c056dc13", "comment": "Malware payload (Mirai)", "value": "eb141e744c1a2b9db4d7d1724b02ecd3cc27b4c726a2f588b601c258784761992f3c0f58c728a2436a43f4efb08dd36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353107, "uuid": "26d76bfb-8048-4e4c-9559-81687e98f9c4", "value": "T11DE3F709BF610EFBE89BCC3B05E9170528CD555722F93B7A7634D818B64B24B1AE3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353107, "uuid": "9953b96d-4963-4d49-815c-4e7169452d95", "value": "3072:/AzuVdSz+DEqwavbPb+z3EyhGJ4+rdM8:/AqVdSz+DEqwajbi3fGJNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763353107, "uuid": "a0289c9f-5bd6-4685-9952-642f78d79ee0", "value": 148896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763353107, "uuid": "33dc206e-cd01-4d5c-b4ee-32dd12dc454a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353107, "uuid": "abd1e4d8-1458-4a52-aa05-5f439a12c403", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8470f57c-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763387489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387489, "uuid": "40194c49-de7a-418c-bde0-fd9e4d184e66", "comment": "Malware payload (ValleyRAT)", "value": "45232c722edf4630703c74070f840cbc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387489, "uuid": "75731a59-f022-4c1e-8c41-c76567a840e6", "comment": "Malware payload (ValleyRAT)", "value": "c0839998e41d029efd4bb304440cd029acf32ce8f541be6f813c5c4d935e9350", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387489, "uuid": "444f8b5a-e689-41a7-9cdb-4a8b711ecc4b", "comment": "Malware payload (ValleyRAT)", "value": "dd5cfb77cf1514a78b5441d7086c05d9e2d3e996", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387489, "uuid": "762f7797-3589-48da-b182-54e39dd7a192", "comment": "Malware payload (ValleyRAT)", "value": "74c0bb81f004743e45b549f2e5aad07dc7ffd9ec8ff58fc9dfd3dde9a46cb99fedfd9083a87671051b21cb795fd92b1a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387489, "uuid": "bb1e7c2c-a803-40e1-b1e2-6800ead2797d", "value": "T15DD423BEA94C52A7D48E887CD21609D39517C1192A9BC3ECDE7C426F6FB893C291F443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387489, "uuid": "f3198bb8-54de-407d-a3fb-40740bf0419c", "value": "42eb1dc2f01a922b7f152420aa351e96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387489, "uuid": "90ec5838-0eec-435b-9b33-3851f15d999c", "value": "12288:1FpuzZSkcBNrl5mTEUkDaSdJfpSaoNRVBUyMCe8VMM80B7qrI3iK1XBwZQEn:1FmShDrngEUkDaiJfpSaoNRpMCe8CM8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387489, "uuid": "8feda933-d847-4261-b391-c08548aff6dd", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387489, "uuid": "8358aed8-ffd6-421a-bef2-c5ee5e73cfdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387489, "uuid": "10d0a30a-de3c-4c49-a135-da05222086a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee54b06-c3b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763382460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382460, "uuid": "a8b1e385-95d9-4ce5-a201-d50f13d4f046", "comment": "Malware payload", "value": "ca3bb771bacb080c5e664a531650792d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382460, "uuid": "78b4ecb3-bf87-4746-944e-1f74435ef1dd", "comment": "Malware payload", "value": "c0baf892597238aa02ccc4fdd3e9d56e2d870d04d933ae67c3463cc3cc3cab7f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382460, "uuid": "6f6322b3-7159-4834-851c-35e526c988fd", "comment": "Malware payload", "value": "1f2ec8107a1480984e0d5c3fc23f9e0cff2c57cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763382460, "uuid": "12520ccb-95a5-4017-9299-33f0f647a2a5", "comment": "Malware payload", "value": "8529abd50c9cf23130e6d252e9565d21dfccf48e0f0a47250a031db8636e8e2fe6af35fbf095053c4b94f9b9225ed8e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382460, "uuid": "036e8d3b-3ad2-49a1-bc88-192b21ace78e", "value": "T1E6859C15E3A811B8D82BD738CA659333D6B078960330E58B0699D6552F73FE19BBF702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382460, "uuid": "1bd67831-7c59-4629-b396-b3e14ff8c19c", "value": "4c6520324b31d4fc8980fae450f66cf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382460, "uuid": "700160e5-67f5-40ca-8e6a-da953e7ff577", "value": "49152:mYHhh8AdEpjaUPZKuSWrC+EXAfaMmv/uBCusKB9:WBf2F/uBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763382460, "uuid": "98cc4688-838c-4619-8b77-08ec3807d8db", "value": 1840640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763382460, "uuid": "69ae25a6-1c4b-4353-8a65-72fe2b18a350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763382460, "uuid": "c6ddc366-20e9-4c3f-969f-b3657ea923a9", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950d9423-c3b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763383651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383651, "uuid": "5340f0fa-f928-4e7f-92b4-7d8ff4cfe471", "comment": "Malware payload", "value": "d7d6a1ad4368a21e2fb34b3dde3ca78c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383651, "uuid": "a19be4e8-9d7f-4052-b9ec-e816079c63f7", "comment": "Malware payload", "value": "c0d060d1d7774daa163b08982f7e40ad8286c7c4b314e5071a688a524f976e73", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383651, "uuid": "8da749f2-95d3-4b3b-942d-10ecbbb95b58", "comment": "Malware payload", "value": "5c1d226d6370cb359afebdf56232d7e24443899b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763383651, "uuid": "3f40a2f7-028c-4cee-a034-24e8f8c6b3e9", "comment": "Malware payload", "value": "69eede61afbf6a7cfcf85527f4b4487bd902493ca864c5401796ddf5d56cc2be0dbe222510f1616942254453178399a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383651, "uuid": "ce091cfe-228d-4b88-8979-5f48a3e66b11", "value": "T154C66B5BA6024F66C5AF833688F703557332AE86BF4397470246B47EBC732D09B952C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383651, "uuid": "edf80888-c804-4734-8769-7efabaa98d4e", "value": "98304:ZxBHaD8wPbpnPohVYyvHSYdemMqPdI6DbVe3DRKn156q0sId2ofrjabf:1HeHKQwHSYQRK2qD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763383651, "uuid": "b399b9ce-b6e6-4b06-a95c-6780a91c3424", "value": 11976702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763383651, "uuid": "b7e237b6-deaf-43bc-8195-059a8edece8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763383651, "uuid": "36b62d23-3306-4024-9689-0155b5ca508d", "value": "upload_d33980e821057eb7ffd30d971a62ba7f.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5999ded5-c404-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418341, "uuid": "1fb0f44d-b8c6-4230-84be-4fbaad1b1946", "comment": "Malware payload (Mirai)", "value": "85654d38416cbd7313797be30597182a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418341, "uuid": "e8f75638-0387-4323-b95a-377bbc0cd860", "comment": "Malware payload (Mirai)", "value": "c0f6745474101e205a3f37da61426db5a585926c75a57830769c173924481bf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418341, "uuid": "ffdfa107-8549-4982-bc7a-874216299717", "comment": "Malware payload (Mirai)", "value": "5223e98ee16c3a2653476d5d568106d04ce936ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418341, "uuid": "38df9951-6c27-4eeb-9288-096a92cc57ba", "comment": "Malware payload (Mirai)", "value": "9cfb91b92c15a8c1d2ea607b653efc5462443bba2a7a9d2ea5c48fcacf4273510dbcb7d49063e8f7d7eaefc7c1577913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418341, "uuid": "4ffd74e8-5458-4436-97a0-6f23aacb2f17", "value": "T10713638CF86A673EC3E277FFE79853DE227607C8678BB616C235425537C83486921914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418341, "uuid": "84b0dfc5-70fb-4491-971b-b45db6cbdd6e", "value": "768:cOsecKhECRpQhKfptV73fOzlTgtwOBbmMNJTdk2njkcLvHHHHHHHm2uR:dxcMECRSIFz2zlTA7IUldNI6Pnnnm2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418341, "uuid": "49a031c6-c631-4456-ab36-001d6cc9c22b", "value": 43143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418341, "uuid": "a18e7fb4-b68e-418f-985e-a99efe51c8a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418341, "uuid": "2858e5bf-cb33-44fd-ba26-74e9d161273c", "value": "wewe7.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af51c8f-c3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763395955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395955, "uuid": "4181b430-9574-42fa-80f3-6862e34a2c94", "comment": "Malware payload (Mirai)", "value": "1ec9d76e896bc96f57ae2b0bc833140a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395955, "uuid": "41bc2b75-0d8a-439e-a1cd-18198ffced59", "comment": "Malware payload (Mirai)", "value": "c1b4922e78d22ba1afa198fd1b9c13b50760e4f78122ffa7e6b6fbb580729c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395955, "uuid": "5348595a-d5fa-4f2a-a9d1-0b88cb5598d4", "comment": "Malware payload (Mirai)", "value": "d99dac69a588b56b0c0c6e4bad298765472ad45d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763395955, "uuid": "b9bd9f74-92ce-44f9-8b91-06bbc6e93b8c", "comment": "Malware payload (Mirai)", "value": "a367d3e0770fb7a2edbf9a1d89aeab1ad240110d4bf391b31be7abde5a27a6f57d3bfb0194296b4a3d7f0377b0c61015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763395955, "uuid": "2878a0c2-9253-487e-8ec5-6a0d48fbe518", "value": "T13A733B4273080A43E1676DB13E3F37D5D3EDA9D021F4E6452A4BB68A52B2E325587ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763395955, "uuid": "fa037ab2-80cd-4921-9301-2745d94f6782", "value": "1536:RCal9/1RO+GsbqlhU66vIQlowJBObIB8MfAlGeaLiqsem/a:RCaDtRO+Zqh6XPBObISMtexa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763395955, "uuid": "01793872-0436-404c-8a52-c99fc68616f1", "value": 80256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763395955, "uuid": "a04811e4-180b-41e9-abef-6aa05eaf4ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763395955, "uuid": "8f00de20-9657-4ab7-93d0-6027f4402963", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bb5ca0-c406-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763419467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419467, "uuid": "43e116c6-d3f9-4b59-81ea-948ad1c3f48e", "comment": "Malware payload (LummaStealer)", "value": "98b0c4422ea4285c3ef5fb5459cfac52", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419467, "uuid": "683351fb-b9cf-4e96-b314-95a0c2c06fd8", "comment": "Malware payload (LummaStealer)", "value": "c31c13f817da865347abcb0e0e0681c93505e895b7ca8b67d65b7c1f67616c6b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419467, "uuid": "37342762-159f-40a7-8796-c029a6690351", "comment": "Malware payload (LummaStealer)", "value": "24b4954b87c8b6aca5aea3281f4e0e751ea648f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419467, "uuid": "12a3469a-e1aa-40b7-9095-5bfc629b0970", "comment": "Malware payload (LummaStealer)", "value": "7f4b447c036be6c996e88235e8b1d6d3873faf37cff8605e6ee8dfc632b280053f2ac638dbbb1ba714012ad8eec96848", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419467, "uuid": "cebf1813-f637-4558-9ae8-5256660f1652", "value": "T1F095235B7BE404A9D0BE87B084F902469A757CA19F89D61F2598D43F4E232C06F35B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419467, "uuid": "e65cd20a-1f9a-4bea-a5de-84f44308d60f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419467, "uuid": "82eaabc2-6e43-49ce-b90d-24fb436fdf2c", "value": "49152:PjKYEvVXhGk4NVxIoaypaBYbiKdDx9sBRXrg:fEKk6xIoRa+iKpxuxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763419467, "uuid": "7f1e8bc1-93e7-40be-bf2a-238068be136f", "value": 1978760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763419467, "uuid": "9a213938-ff8b-4625-8139-73f408ec9946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419467, "uuid": "c96307a4-df93-49d8-80a8-b8b1bf55a70b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ea6408-c381-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763362129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362129, "uuid": "992433e6-0c56-4e7d-bde1-6237e122b385", "comment": "Malware payload (Mirai)", "value": "acfeab53361b2ecef5f5d0f360ce0802", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362129, "uuid": "494506a8-5663-4bca-9783-36476444b807", "comment": "Malware payload (Mirai)", "value": "c4be97fbc5d832313f1231dd66cfb9f70a238e918cb8db74d7faf5519c705d64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362129, "uuid": "a3f0e8d3-853b-46ab-b7a8-c5ce4fc50a52", "comment": "Malware payload (Mirai)", "value": "7d360984674f8698426d82fc23ba50bd042304f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362129, "uuid": "fadba005-798c-4828-92f1-4917c63014c5", "comment": "Malware payload (Mirai)", "value": "85ff290b0ee57c884caf373fc026cda6d3ef744a12747d5a47c8b73f32c436fe5e125fe7ee8fb48d049eb274745cf633", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362129, "uuid": "33fa1966-22b7-4b42-bef4-57f68fc3724c", "value": "T1705193AD10E08BBDAE5ADAA332A8C356394971D7A99B9F0E9CDC34F5004DF063180793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362129, "uuid": "e0ee8094-6f0a-4280-b16c-d4ed8702f611", "value": "48:iT6ATNmTMMTFeT7CTnST0ac0aX3KLTenATXILTiuJTNOT56Tw8TgYTlbh:iT6ATNmTMMTFeT7CTnST0l0E3KLTenA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362129, "uuid": "0d9da7ab-7965-4da8-be19-447af0a3c65c", "value": 3044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362129, "uuid": "7fe33fa9-6200-46f7-85d3-91662296ebaf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362129, "uuid": "c879b0d1-2370-4c1b-8f14-3f2159726033", "value": "qkuys.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2397ddf3-c402-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417391, "uuid": "55fa9d10-23b2-4955-a6a7-6ec0cbeae77f", "comment": "Malware payload (Mirai)", "value": "78ee4399cbae83f715d11826519c55f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417391, "uuid": "8592326b-aab1-409d-995f-84fb86be8a19", "comment": "Malware payload (Mirai)", "value": "c72c3e5a1c721746bc10ca17e97877b2f9b9856a5e6a1e9ea661fca0441196f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417391, "uuid": "e661612b-1c17-41d4-b79d-c88da2fb8e2d", "comment": "Malware payload (Mirai)", "value": "4cba2dc097428bd8c4dd0711ae01df1757ba8620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417391, "uuid": "ac5da577-a0a1-4345-a4c1-80fb1b16bbce", "comment": "Malware payload (Mirai)", "value": "ecd73bba2e9b6666470d5e86254b0cc090142a6b16d03bbade73ac8d86992bed80f4a39fe49a5433e1ad8c1d10570d49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417391, "uuid": "8bd0e3dc-9297-404f-b156-58fb6db54b6f", "value": "T11DF2F1E351C58590E7B85F79B9F89AC5F3700BBC80EE170372644B7468C5B4A69B82D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417391, "uuid": "b7824334-c4df-4723-811e-2eb74af8fbd9", "value": "768:t5FykdcVPc2FqKbu0YmjhH6Vp+RczusFW936s3UozV:tykduceCsxkWcznFW1zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417391, "uuid": "1b51c7e6-2485-49ca-86d3-fac9dfe99f95", "value": 37156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417391, "uuid": "a3bee104-a019-41a5-9a83-ff410fac2a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417391, "uuid": "a4831336-c788-4aa6-a585-1ed01e05ee29", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea28a18-c3f1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763410323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410323, "uuid": "98b299ee-adb0-441a-9f99-2a63d54f3f44", "comment": "Malware payload", "value": "a56220a0b2a69c6b950693c813ce5fea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410323, "uuid": "c07d3cf0-c846-4bd2-ac4d-3f0770ef9326", "comment": "Malware payload", "value": "c79ef37866b2dff0afb9ca07b4a7c381ba0b201341f969269971398b69ade5d5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410323, "uuid": "d245c129-3ca0-4769-8415-075281479d45", "comment": "Malware payload", "value": "b0a9cc848de36e1230da132131f46018f0ce2c35", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410323, "uuid": "9dfe474f-22b0-4afd-888f-5590cadcbd39", "comment": "Malware payload", "value": "5ee1d405f8880e1f7e38597d08138dc848d215a79b24d5dd548ac2892444ed5c37c1ff2d34b978d97fc0243b6434d0db", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410323, "uuid": "6a3b2e56-f53d-4062-be78-7fff95c0d7da", "value": "T1E3C42382EEBC94238F461B3F5BDF74636DE589490714827EAB4D8C9A34E2D00E95F099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410323, "uuid": "2f2ab2dd-c03c-41fe-ae40-3865a9565e69", "value": "12288:lHVN5uNW+gY0TE1+/xGSVkPxEsaTuoTXU5R7NYzrIwl4GtJvLB:PvuNWzYl0/rgxyaozU5Re1lDttB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763410323, "uuid": "34a89ce6-fd3b-4639-90ae-22c3ff0022c8", "value": 581698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763410323, "uuid": "36e539e5-6278-4539-ada0-c0380a294d6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410323, "uuid": "1f1258a6-1194-45f1-9bcc-43e074cfcd68", "value": "Brief.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4486f63d-c34d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763339707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763339707, "uuid": "04af9c13-f261-4db2-8b3f-d49738ddad3f", "comment": "Malware payload (AsyncRAT)", "value": "aeebeaa4a16c8e3bbdad4143e2fab399", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763339707, "uuid": "b2ab1557-4973-4347-b0cb-59dbc8d43249", "comment": "Malware payload (AsyncRAT)", "value": "c99b158fb80f9982b74c361d1dd1b8152399a2ee160379b93099f352df44ce17", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763339707, "uuid": "0cf996d1-55bc-4732-8ff8-1f53834a4f79", "comment": "Malware payload (AsyncRAT)", "value": "d3c19908f281167e49f7b66d25aa866bc28dabe3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763339707, "uuid": "70948212-816e-40c8-b6f8-6fb7533a8067", "comment": "Malware payload (AsyncRAT)", "value": "119d6cb7b074141888e9f3bd77d5078537e86804cecd7ad492df1db83f06f4d07754445dbe042f3c56acbd963af28b34", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763339707, "uuid": "0758197c-b067-4b65-84c4-fb9b72501dfc", "value": "T1D4232A003BE8822BF2BE4F78ADF36245457AB2632603D64D1CC451DB5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763339707, "uuid": "35aba4ed-fec7-4eb3-b8ea-ab316ae7d893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763339707, "uuid": "4b50d4d9-dde0-41d2-ab56-011d00221882", "value": "768:gu/6ZTgoiziWUUd9rmo2qr32OBnxZAE3PILzjbPg/jAupbV5z1kCQBDZFm+:gu/6ZTglB2i2qzwL3b4/MMz1HGdFm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763339707, "uuid": "282d8a6e-d768-4f1b-83cf-dc0e3d569a1f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763339707, "uuid": "d813153c-2cb9-477f-ace3-9fb5caf993c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763339707, "uuid": "f58a8cb5-1b92-48e2-bd4c-dfaed285e468", "value": "AEEBEAA4A16C8E3BBDAD4143E2FAB399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afd7956-c3f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763413645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413645, "uuid": "a033644d-d2ed-4980-9ce2-7675ddbaad09", "comment": "Malware payload (Mirai)", "value": "d5bda30ac78cf8bc93e87d6becf96830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413645, "uuid": "8e241d8d-0db5-4d31-be09-d463e8580c6b", "comment": "Malware payload (Mirai)", "value": "ca2000df6a56ab2b459516efb51d06c7560feba6b38547f21204e3852e97bb91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413645, "uuid": "2c5b6963-9449-4d1f-856e-b7e22527b9a3", "comment": "Malware payload (Mirai)", "value": "4150c6b3796f02315b465bf92412d5468ade388e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763413645, "uuid": "11f52987-97f8-455d-b443-2c5444a81fed", "comment": "Malware payload (Mirai)", "value": "cffb12ff45efba7184bfb459e44e40f5b656d98c0bbcd425a4b7df458af5f5c92b51b7a482753ee2f46c73156020a659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763413645, "uuid": "190e1eb3-d52d-4033-8b0d-1a5d0c8182ab", "value": "T143633BC5F503D4F1EC1705B0307BFB3A9A32E1BA1129EA47E3999932AC92B0295576DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763413645, "uuid": "58de33be-0c19-45d9-a503-7ab78d52b7e9", "value": "1536:mq5a3DCjtpvLJMbFtGUtkYeYV3IoGVjG7rtjcW9mpS2rN:mq5a3DCppvLKb3GUteHXtG/tgwm/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763413645, "uuid": "45204915-9502-49fb-a81f-d291d9991aa4", "value": 67472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763413645, "uuid": "1be200ee-11ad-4e0a-889c-fcd001b2a019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763413645, "uuid": "e305119f-ef02-45dd-84f3-b4a23551c195", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1661078-c365-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763350252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350252, "uuid": "800461b7-17b8-4426-8f88-1b7f4e320feb", "comment": "Malware payload (Mirai)", "value": "f630c07d87888601fb80511534b17213", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350252, "uuid": "abe61fed-27eb-4af2-ad5f-30c58839a38f", "comment": "Malware payload (Mirai)", "value": "ca211fb6122339dc96ab59797c0daa53458089c877554d7e7d070b08772fdc65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350252, "uuid": "a831a88a-e63c-42df-b67b-ef8c4e5dd400", "comment": "Malware payload (Mirai)", "value": "ea5e96673b52f84c9681b98cb15133f0c2a8fa3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763350252, "uuid": "0d28e25f-e9a3-4304-8579-39319b46f8d0", "comment": "Malware payload (Mirai)", "value": "1b52538f7e54497298330a2f5fd497a4074f53d5d99c964adb5ab11a094008b50572ed9d0d9af496bc2da7fea29952dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350252, "uuid": "464aee5d-8ca7-445f-b3c4-4a3f1f6fad22", "value": "T1D16312B2FAED3497C7546810EF68A688985DBF72F0BF00F9972C445C988B8B51067DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350252, "uuid": "b8bcf06f-d6bd-4244-8ab0-072ec1d124fb", "value": "1536:svV7CCZJRHXYn2XOMM5hmaiL2l0BwmBPrYB32Xzf+5L5RBZFKFqhwUIfFf:s97jPR7XfOdlG5PUBGXzQL5RDwMhVIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763350252, "uuid": "0c68935d-cbd6-4c25-b325-ff533a4875c1", "value": 73040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763350252, "uuid": "f1165712-c30b-4aed-99d0-360f27bf153e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763350252, "uuid": "b44f7aed-3349-4b65-a621-c78d4690cab2", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d826ec81-c402-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417694, "uuid": "d1a701ae-95ad-4369-b15d-fc4977ea69f2", "comment": "Malware payload (Mirai)", "value": "a0fed1706226a92a43b8d7e16007f45a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417694, "uuid": "c3cf1668-7e6b-4bb3-8bfd-1aee8ddf0485", "comment": "Malware payload (Mirai)", "value": "ca4bd50228d92ac1266506b2ac7fb5636638bd6f3e8ae710fc373c41189ada26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417694, "uuid": "035b77b8-f8f5-4e3f-afdd-90d1de38d4c9", "comment": "Malware payload (Mirai)", "value": "a1686583b33893206e6708bfe58c8e54da018b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417694, "uuid": "9f54dde0-90ad-4485-b41d-6474946cbaf5", "comment": "Malware payload (Mirai)", "value": "8d1bcb26ae51f3ca10028737413b3a7e82ce627184d83dd9f93885284da472b90b4a54b3632cf0da054af50c00e6ce70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417694, "uuid": "5e426b7b-e6b1-4d36-90d8-8e3e826883be", "value": "T1E1C3F55AF8819B21D5C615BEFA0F529D33231BACE3EE7203DD145B2437CA95B0E7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417694, "uuid": "e724230d-2c2b-4199-af29-106e7959e10d", "value": "3072:M9t1c6WH5hhSPiwgXczXn71viCHNMsDaYKnHlV3CxiINEgInyAn5p:M9t1c6WH5LSP7gMD5KaNfDaYKnHlVyxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417694, "uuid": "0c162e38-9d94-487a-ab9b-c98b02e14b8c", "value": 124796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417694, "uuid": "59196d5f-5fcf-4d60-9e6c-65c9ba140be2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417694, "uuid": "f58053ba-9654-42a8-8899-318912706d96", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614e5703-c402-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763417494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417494, "uuid": "82020739-feeb-4419-9cd0-25b94b766ec0", "comment": "Malware payload (Mirai)", "value": "7f92ff322b5a2fce5c6e0b068de18cd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417494, "uuid": "d7316d17-1fa2-4dd8-af85-f48281b3937d", "comment": "Malware payload (Mirai)", "value": "ca50372415ca8075a28edbc880b26abc3496e80a00574361ccf818ee9dba7487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417494, "uuid": "e15aafda-8de0-4250-b08b-6965dc498c03", "comment": "Malware payload (Mirai)", "value": "8e2ed10786f69b0286207d03a50ace44bdb4fb1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417494, "uuid": "55de47df-8d27-40b5-a724-7efaa013a432", "comment": "Malware payload (Mirai)", "value": "90a436973daaf233748cfbb2a09537235673e4aaaab5a0c0ca5318d6cde912f0db603cb644d3330c1664ba88d0def339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417494, "uuid": "d41b0772-6858-4ac5-9d14-1289d0c0a6d9", "value": "T173735A02B31C0A57C1A319F0363F6BD1C7BFA5D221E4B689651E9B869675E332186FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417494, "uuid": "e8789659-4caa-4982-9100-3021ee048bc2", "value": "1536:9wxc8yQK1oJ0DTJIrho1JzLzqzmgKXzF5BknQJpVho9/v:KqQKBTL1dzRDDJLh0/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417494, "uuid": "ba1d1555-f965-4271-b4c2-ee74343a44d9", "value": 76960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417494, "uuid": "c06a3f8f-7811-487a-9e00-659b14a9d78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417494, "uuid": "f0993642-f69a-4a28-a67c-f7e093aedd2e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8664b4-c3d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763398080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398080, "uuid": "3fbc615b-cf03-4822-ac21-ade29743e084", "comment": "Malware payload (Formbook)", "value": "24920ea73a9396eff424fe50a5829226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398080, "uuid": "81e57129-637a-4080-80ef-b47906aed3e2", "comment": "Malware payload (Formbook)", "value": "cb0967ceda978b995206f92ca21de64ecdb0dfa3d0f1bc7ad416304f18f540fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398080, "uuid": "329fbe37-1d4c-4c7c-83ca-0db8ef8591d1", "comment": "Malware payload (Formbook)", "value": "309eed06cc269fb2c914be3dabc4e3e0a8a2e09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763398080, "uuid": "4b7b1982-9ede-40dd-88f7-4b07f3072fd5", "comment": "Malware payload (Formbook)", "value": "59288094fc895cac6f10ee9efdff99f9b92a0ed870b83811ff14ac82dc25aa22617176efdaf4380bfeacc20209e39856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398080, "uuid": "3268e462-1324-411a-be57-5743e5563405", "value": "T1EEF4230CFFC8FB57C22C4F778247B90840B18617B6B6F65A1CD948D61BAE7D481A8987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398080, "uuid": "a225a6e8-52a4-4aac-ba11-6355d37d0708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398080, "uuid": "6d56daa6-c62a-4167-8172-68330f6487aa", "value": "12288:2o5X1MrG3eWNSZb9RMOoEEUt8ja79IJqfeN+tKU3VKt8wrTKWsgMdATF:1OSeWMt9RMMXm29IhN4VXIbPuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763398080, "uuid": "327ac2fd-3e20-4cb5-b981-a552ff1a13af", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763398080, "uuid": "df0ccd2b-b18b-4622-b587-e4ead96e9b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763398080, "uuid": "da1ed803-bfb9-4546-b9f7-c1c9f4c8d352", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baf5ecb-c3a6-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763377837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377837, "uuid": "e310d55a-0601-4811-a154-30c7142f377d", "comment": "Malware payload (SnakeKeylogger)", "value": "c4a60afe97352409e5ed1521b2143487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377837, "uuid": "3d91950d-d419-45a5-8086-ab4f8c3c3c75", "comment": "Malware payload (SnakeKeylogger)", "value": "cff27c8330319bdb46e960d581aca24fbc8163cbb38390897a13aea97fb8e504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377837, "uuid": "41bab7f1-70a1-44c0-80c1-53b5c431426a", "comment": "Malware payload (SnakeKeylogger)", "value": "93d074b6e29f0622986361f703cffe4aecbf61cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377837, "uuid": "43a4399b-5446-4ab5-8bfc-4321a61acb52", "comment": "Malware payload (SnakeKeylogger)", "value": "f319d517d00f52c7e14b9a58db11f55d109baf86016e7de5784c318627bdbb3f46b2b5ab925613e379567880c8e9477f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377837, "uuid": "27455abc-0c2e-402d-b734-745ee31486d4", "value": "T1CE25BF1373DE8361C7B25273BA25B701BEBB782506B5F96B2FD4093DE820122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377837, "uuid": "2bd3d715-6621-4796-9e83-d64e1f3e7bdb", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377837, "uuid": "850114a8-d6c7-43ab-b3b1-9ee04b3ac6c6", "value": "24576:Rtb20pkaCqT5TBWgNQ7atshOe+2qset6A:iVg5tQ7atshOWqs+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377837, "uuid": "5f35bdce-74cb-492e-af7e-d709dde9f303", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377837, "uuid": "6e0e0969-f866-49e6-bf95-c5535f652c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377837, "uuid": "5b0db51b-f22c-4f8d-b308-5d41dc1729dc", "value": "5310748200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76242668-c381-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763362124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362124, "uuid": "d1c65cea-cbca-4611-8124-91587400b723", "comment": "Malware payload (RemcosRAT)", "value": "33ecef4a04f80feebbaaf28fe9a20b1c", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362124, "uuid": "5dca8ecb-e525-425f-9b9b-e8e209f79727", "comment": "Malware payload (RemcosRAT)", "value": "d0fb43a18c501b9ef4f48a7cb7c85a3f11eb0127e6d8530e428d4d1f3e57d080", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362124, "uuid": "c6a40757-7302-4ec0-a84e-aac67eb90855", "comment": "Malware payload (RemcosRAT)", "value": "c4d5f17cca142d1d278390c8eed17076be7a6de4", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362124, "uuid": "65bc0b9c-33ef-4187-8158-37b9d4ad57c4", "comment": "Malware payload (RemcosRAT)", "value": "9b51b42fb160ef6ef619fb103ffa827eb05e5a470a8f004134158ca2176a51915644843a2b1c86e7d858f83b4bef0ab6", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362124, "uuid": "70fff161-c375-40f8-ae11-554adf3d8f7a", "value": "T1E615DFFC45F05ED44B6122AE31759D033DAA86C2D1231BDB859EC036192EAB4F7F618E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362124, "uuid": "99dd1e0b-51e7-4bae-beac-80a3b92dfe65", "value": "12288:jIdZl+z77Db12oVfAy9DZe+iriEcflFEZZwaD/qKNXVOtRJE67D+kKZBC9JACqv7:MUz7nZ5oy5EdonEEaeGVOtRJMRm1Z39a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362124, "uuid": "6f77da5b-3757-42e3-8b41-abe68ab02b60", "value": 928795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362124, "uuid": "f79026e8-8ca1-44eb-8dee-93026d7eaa7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362124, "uuid": "6bfa579d-fda2-4efa-b50f-81450db2c4a9", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36640f32-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763372755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372755, "uuid": "7a51e7f2-eb75-4164-a276-9563c45ab907", "comment": "Malware payload (Mirai)", "value": "0104fe766d4d575e47a948c95d16d68e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372755, "uuid": "091a5c7e-40f9-4938-903b-d6e4a742a008", "comment": "Malware payload (Mirai)", "value": "d25ff2751b74cc4adccb68f0c579f36750371038e3bc8458c6a06fa95e248974", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372755, "uuid": "97722f6b-251b-4b2a-97e4-0f05a594d4d2", "comment": "Malware payload (Mirai)", "value": "0c2578a1062eae2b8b9f3ea884c7fce0dede23fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372755, "uuid": "cb4ce335-ed14-43aa-9f8e-3f757ccc5874", "comment": "Malware payload (Mirai)", "value": "e985c9b1adef574cda32c90bfca7e47bc75fc6bac80b7527b480901f23118eee0d0ceea75c32ae8753abff5de6d1cbba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372755, "uuid": "7878c768-8095-4441-8ae8-da613e4d8e81", "value": "T1DE41CDDC7EA19F635449CF80F6230A1D600FEEDAA8848EF8D8DDBC5D84BCA0D7416685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372755, "uuid": "72b3cfb4-79f5-4983-a024-32b0a9797e11", "value": "24:z5EMy0MBBxuV+LzKXRCOg3Pe3omDUgHZgHJLvmkKXO4952n3KXZ:z56pu6zFgZHuHhryy3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372755, "uuid": "f7301101-f0c5-407f-add0-fbe58340f547", "value": 1944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372755, "uuid": "626b5e73-517f-4c79-942c-3b12302c5114", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372755, "uuid": "2d17ad42-a933-4e82-b71b-83f6335b8602", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21856343-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363700, "uuid": "c7217deb-106e-4ff3-a3e1-cafd28901b3a", "comment": "Malware payload", "value": "8e818863dae2a0ae90bf1309e51454fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363700, "uuid": "b7e29d9e-e6c6-458a-8154-d7e9d1d7ed39", "comment": "Malware payload", "value": "d3b185b55f842d5d6ba61dfaf312bd74017f65a509df0376d7179ef7e19f9d93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363700, "uuid": "50c6a146-e317-4466-bc89-11d1cfb62655", "comment": "Malware payload", "value": "461de60f760cb00d81e770886113c9ce123f2133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363700, "uuid": "56613360-9192-48a4-82ff-b1b8402d36a5", "comment": "Malware payload", "value": "fce2d658d459e289f6a4976fb05257aea3cba94e7a1a33a84f1995e5e05f9351cf140c58a78e988a522104ea534abae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363700, "uuid": "598cd711-e305-4b8c-8035-cc25b4b7d2c3", "value": "T147352A1AF6A611E5E0B9C234D9622127FD7238958734EBDF57C19A0A1F31BE0D93EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363700, "uuid": "757bf958-d442-46cf-9960-1b93c1f0a0cd", "value": "8db74963b008888f5d10ffde3a9b779d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363700, "uuid": "219bfcbd-31b5-447c-98d4-7edd5e0dc2e1", "value": "12288:Qqx5n6ReEhnIm6YbfyDZYx87nOKpGkFE7crnpiXhKZMqzHex4ZBM+PS4V:QqvE+UqaC7nDFE7KnVZMI+xzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363700, "uuid": "8e5c25f2-ecfc-4763-85a7-aadd9a60829b", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363700, "uuid": "17a3fbce-d567-41bd-a594-bb7b67404b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363700, "uuid": "07b5852d-a53c-498c-baa4-00cf6c2dbbba", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6cdc92-c401-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763417245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417245, "uuid": "b4b735e7-856a-40da-921a-e1e0c220eb8b", "comment": "Malware payload", "value": "df0c507209b08ae1bff0a200a00d9e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417245, "uuid": "25a08e19-47f1-42aa-b24b-2dba19a35518", "comment": "Malware payload", "value": "d3dfc2211f11b694bb769f5e36fd42c9bf8ec3b5b9d3c049b65c4fadaef654da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417245, "uuid": "2c89cc48-c970-43eb-81db-92473e914d93", "comment": "Malware payload", "value": "a521f4de69757fbb5818d1e8556a024ed3bf0fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763417245, "uuid": "23fc80d0-b016-487f-9cbe-dc5929fcfa77", "comment": "Malware payload", "value": "0d3c10a5f8ad5181d9bdba96c6c7d5ed9ddc098298fcdf647ed9b460b4ea2d683ff1a1df7021e05cf766ed3f47e06e76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417245, "uuid": "96f2ca60-b96b-4bd7-96ca-6b1349b91480", "value": "T139331984B981AA17CAD14677FF0E43CD7B266798E2DE3303C926AF51378B92B0D67111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417245, "uuid": "45872dc7-5b19-4bbc-8b38-6b4f29a62fa5", "value": "768:HPNi8FW0hoolQISbh+Hf9ONG8642G8Mui1oc+NZylryVVzuvwKI:c8FW0hnlQxgfIU8hBu6MzylmruvwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763417245, "uuid": "2f1d4ff5-c1a8-4ccc-ae66-37f0c1fa85db", "value": 50520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763417245, "uuid": "e01306ad-2041-4e24-81a2-9cc08c1ba448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763417245, "uuid": "ef3904b6-3e06-41dc-8e44-f90381430a85", "value": "wewe4.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb94c70-c390-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763368447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368447, "uuid": "16e7b843-4a50-4685-bc62-3dcebb8e50ad", "comment": "Malware payload", "value": "13206d96f35cde1284a5f280f8c507dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368447, "uuid": "dc8d3c79-cc30-4f10-b208-3b7a9b1dac7f", "comment": "Malware payload", "value": "d437cc2a434907c530b82aa164eaae9dc2fb8b9f942d5dc0d6f0d2e68348da4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368447, "uuid": "fe63fc89-8237-4856-98c7-ee66599bedde", "comment": "Malware payload", "value": "d42284e8d4134563d588eaa35a89f0f1ab0eac9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368447, "uuid": "2003dcab-27e1-4d56-9c8b-54b597d674f4", "comment": "Malware payload", "value": "3eefe3e79640232db60ebafa3d87c3f0ab8c21cfc0e149f0464bdd77044d8ccff1c4aff1a77f4c325750e4283900398e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368447, "uuid": "e47f49f0-4c90-442d-8f17-30d688221c8c", "value": "T1F1E449DAF79844D9D966D2B98E62EA01DB777DE84B404BD31120B32E0F378C96C3AD14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368447, "uuid": "b2aab7ef-176e-474e-b80c-73595b55dceb", "value": "df707dd4b56b4adac9cc6e90afc6b24b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368447, "uuid": "a151b000-c391-4880-9d6f-3dc1fdca04aa", "value": "12288:hEm9AD9tTpA5qqkv6HUnAPyfysOr36KjV01amRiNK:im9AD9tTpA5qqkveUnAPyfysy36n1aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763368447, "uuid": "2166f489-b2b3-4486-869a-05d414023aca", "value": 695000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763368447, "uuid": "aaf088b1-2a2f-421b-9b52-a99119188dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368447, "uuid": "2ded00ee-04af-4c13-8139-8e89c7a35d4c", "value": "Zoom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1baba3c5-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763387313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387313, "uuid": "0184b037-b874-41cb-8f34-8704373c6256", "comment": "Malware payload (QuasarRAT)", "value": "42f0d8da6d18d54daf4ea76dae68d00c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387313, "uuid": "6a71bb72-804f-441d-a64b-f480a473f441", "comment": "Malware payload (QuasarRAT)", "value": "d6775da94945ff5cbd26a1711f69cecdce981386983d2f504914630639563c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387313, "uuid": "c4002816-640c-4ff8-81fd-56060ead715c", "comment": "Malware payload (QuasarRAT)", "value": "1a615d015154c11a6da1aa86711455b71c375969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387313, "uuid": "f4685c32-2429-4886-91ca-9d7a2fd85ae9", "comment": "Malware payload (QuasarRAT)", "value": "9885bd0c00ea1be6ee16f48e2fff5cebb9ce0305fb1e9a8b6cc6e56a2d38be889951107a3fb33c68513d625e5701d08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387313, "uuid": "58eee88b-95f0-48a6-a561-64484f54efc6", "value": "T17575383439FA502AB173EFAA5BE4799ADA6FB7333B07645D1050038A4723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387313, "uuid": "6fb7b521-57dd-4a1f-a7ae-e736a210b98d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387313, "uuid": "3ea17519-cc19-44e2-ad35-8c5c2bc3f8ee", "value": "12288:UaOvMqs5/edK18hHAcbDwyPUKXhVN4objlNjSSTIhpe8pkUsMzGj3LHiUaSRLMBE:UVMehlBN6wyeL0J5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387313, "uuid": "d818505a-95a2-485b-8288-2a7fc07cfeb9", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387313, "uuid": "7763a1fd-b667-441b-b4d7-d6338649264c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387313, "uuid": "62d85fba-a08c-48b8-8461-7e36d069f034", "value": "stage2_payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704f866c-c376-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763357390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763357390, "uuid": "666c26b7-2219-4dd1-8b32-8b9f160a6db8", "comment": "Malware payload (Mirai)", "value": "a1d9555358b083c578f25f9888edf090", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763357390, "uuid": "2ccd8ba0-fb44-476b-aaef-8d1c1ecb8342", "comment": "Malware payload (Mirai)", "value": "d6e356fcc158e9d3c44888bd31d18ed0253f8b2f6e6d43dc3ccdd460f44470fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763357390, "uuid": "919427c9-a426-4396-86b2-f0529f310268", "comment": "Malware payload (Mirai)", "value": "c5bc2f1850a583435c5d217884053205cc653c71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763357390, "uuid": "c82e9420-dcb9-4781-8b50-9de23dd46aaa", "comment": "Malware payload (Mirai)", "value": "3aa77f7e484b9f4ab55a0c6928e8ea6ca66d4bb44dd5368675d2563d5a27aa417246a5166a89cb97694a4f1e71954987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763357390, "uuid": "515d72f6-26b5-407b-8ea2-57bfb1a57dde", "value": "T1B8D39EA7B74715A1C8A302F40BCB4B9D3E9362826F5B98E37C1F753718790DB4506B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763357390, "uuid": "6dbeac60-8eda-455a-b6c9-24020fe21ace", "value": "3072:gi3apKhh/Eyp4E6tdj2QGSgTluColgiaLq:gkFb/EyWmQSH1Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763357390, "uuid": "6d1dcf68-1165-46cb-8f41-c8397f8995cb", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763357390, "uuid": "bcd0686b-626c-4682-97fc-de3525966761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763357390, "uuid": "859cf542-d953-4ec9-b0d0-0ece41846c86", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73928e3f-c3fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763415807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415807, "uuid": "5c081ed9-7c9b-48ae-ab84-fa1e1dfc5b5b", "comment": "Malware payload (Mirai)", "value": "254a2b266caa067fa57d1f81a48f339d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415807, "uuid": "f3a701fa-d463-4da7-85f0-d96de07b6294", "comment": "Malware payload (Mirai)", "value": "daf806bd3836d96902477c804436b21b99819b4d084a4432742663e92c121b47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415807, "uuid": "7bcb5d6a-ba41-4379-9df2-df175811f75e", "comment": "Malware payload (Mirai)", "value": "b73ad069f72de8b7e34d16156bd4afd80e11e70f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763415807, "uuid": "47b0046a-8332-4468-a857-889b160d9d50", "comment": "Malware payload (Mirai)", "value": "063b7c53a4470e58d531f79ff5c4d7af094dcaffb1d13c492da9c04156e613040253ddf6ecf184c3d9e16da6af99138f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415807, "uuid": "438aca65-fce1-4535-b079-95f5771b114d", "value": "T19533F882FD829667C5D01376BA6E568E336163E8D2CB7213DC244B20BB8565F0D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415807, "uuid": "3a70672d-1f37-4fc4-b8d3-b1182e88409a", "value": "768:7Xb5Cque+nd930kCVs3EveaA8d++ed2+TCQbgv8TD8jhwQF9ASo5D3fNAwS:7ChnP30nA8E+ed2+TPkkv4hw8i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763415807, "uuid": "55dfa98a-190a-46ec-8b7e-15824c79e9f3", "value": 53080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763415807, "uuid": "a03c0ce5-519f-490e-8a0e-7f21322e9150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763415807, "uuid": "6981cfca-84cb-481f-af21-0b5daf7d7c5f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9057e44-c3b7-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1763385483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385483, "uuid": "fa78a444-c897-4cfd-b822-21be2c74f100", "comment": "Malware payload (DarkCloud)", "value": "481d399b9279e3a4987c4d67532ac3ae", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385483, "uuid": "2de1b201-8c95-45b6-aaac-3a176f38747f", "comment": "Malware payload (DarkCloud)", "value": "db0130a6466a71fbe5972f9f12c50c137ef5cb5b82eac94058aba7ae93982e11", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385483, "uuid": "3f7c6574-0462-42f0-8aee-67652e7b19f4", "comment": "Malware payload (DarkCloud)", "value": "db091c6f578e109f1c0429a7b5a344fb71b8dfee", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763385483, "uuid": "3564f0eb-5195-4a7f-9ba4-eeff24d1e54d", "comment": "Malware payload (DarkCloud)", "value": "4ec6c1217ca5743dc8edbafd3002d36484ec02bda0c747dae756a42082fa20acea03469e0534a489c6db123085e6ffe5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385483, "uuid": "9f01ed8f-0bef-42fd-af96-e26ced67ffb5", "value": "T19215E11E1BD65AA4D5BD8F34A3F851A803F0761B9221E7BF5E4412E8DF2178B65023B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385483, "uuid": "b017216f-1e07-4a38-9811-5a02e4104fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385483, "uuid": "05831a81-2e02-4f57-9fbe-f4336ae7f73a", "value": "12288:lF/b9P4tPOWxFhlD75nb5c3YuFvpoc+WScdchmEBVybIpT:vhtOXdnb5KYufoc+Foc4uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763385483, "uuid": "b13c82fb-9c91-4a3e-8437-0d723c2f8867", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763385483, "uuid": "82851929-14a5-4c88-afd3-736f83f7dbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763385483, "uuid": "d124da58-9d8d-4e63-b5c0-edd1c5d63683", "value": "Solicitud de cotizacion 2025-09em15.PDF 30.0KB.lha300 KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98aa0b0-c3d0-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1763396221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396221, "uuid": "8003ba3d-79e0-4c48-9d16-e76b45700954", "comment": "Malware payload (DBatLoader)", "value": "ae1bdac3223796ab23e84ce28eaff75c", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396221, "uuid": "2c8c16bd-a6ff-4d38-9796-bbbd02841f29", "comment": "Malware payload (DBatLoader)", "value": "db9f2474a4f472c2b67d8b9ca090c201904f87b14ba472dabb3b75159ba74e7d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396221, "uuid": "a75c996a-6c49-4bfc-a9f1-5a7d5a83f58b", "comment": "Malware payload (DBatLoader)", "value": "88dac6c8b45254d67cbf6cca605054feb42911f7", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396221, "uuid": "4f40393d-a5e6-484f-99ee-b97129ed6c50", "comment": "Malware payload (DBatLoader)", "value": "7e0d900f27ffe38c928d4341c24728b57fb88b248ba452e7c75844b5f7879eb541ffb18ffa2ebb6fc0dd348de32bd1f8", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396221, "uuid": "8c6b079e-42d5-42b3-af55-b54d5a4a9435", "value": "T10F75CF02B2E18536C12769355C06A3AA1529FE743E74E8453AED3F48CFFB261381AD77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396221, "uuid": "5a80a605-0e47-40d3-93fc-d3820fcce0eb", "value": "825b81cbf84889d1f9a947979d8d2e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396221, "uuid": "ca224d4c-a107-47d8-aa88-cd13c991a64a", "value": "24576:is2HDXNkMW1w+cVmtncbV4KhdRPtdfDa4uFfwRqc8Kwc5zo/NxL:idM1q+mBAfwRq+wc50/NxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763396221, "uuid": "3597f3d0-1964-4d5c-a614-581cf5a89b40", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763396221, "uuid": "2930019b-068b-43e1-8b39-35036ee0128f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396221, "uuid": "72e59c54-d8d7-47bc-96ec-eede6d418f53", "value": "RFQ-PO#900BD SQ9039 Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3046feb2-c3a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763377469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377469, "uuid": "7f0eafbb-dae6-41f7-9a5b-06c423890c51", "comment": "Malware payload (Mirai)", "value": "f0b7d3f3ffda253d75685533db9d169b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377469, "uuid": "8017c62a-8d71-4d7d-80cd-ce3f882dac1f", "comment": "Malware payload (Mirai)", "value": "dd4c8e5677cff93170ea94553d123d3c2e70cfe89f2e6e4ed8eb081aebc24e7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377469, "uuid": "c72e937e-bf43-497e-ad25-26ff7f0ed0e5", "comment": "Malware payload (Mirai)", "value": "a161d7b4289fe377d3ca945380fe4ce5c83b195c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763377469, "uuid": "a35e9d96-c73a-4ff6-8bb2-796b0c1a1caa", "comment": "Malware payload (Mirai)", "value": "b430a9234aca7fe67897dfd5ae1183413cfc4c7cfd4c7355d5bc2d7ec1199558a8cb7461d07399f76db1e5db853f161b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377469, "uuid": "4c54576a-79da-4d54-8077-a9405fdd57c8", "value": "T1DAB339C0F98B81F6C40B8C306166F63FDA71D4A95271CAADFF999F36DA37602911224D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377469, "uuid": "ae5a2644-0075-4178-99c5-a5f8280c698d", "value": "3072:Yq4RpFsbLjSFAnk2AwNLp6IuwVv9Bw9gVdZ8R6y2:InFQLjSFAk+RpF3V1Ly2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763377469, "uuid": "632377bb-d77a-4fc6-ad0b-20af79bbf88f", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763377469, "uuid": "158b54f9-1a9b-48b2-bac7-7a8ccb023a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763377469, "uuid": "970160a3-6a31-43e3-b179-7f264f168f61", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c720f6a2-c354-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763342933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763342933, "uuid": "bd52a094-03c2-420d-9a4b-dd1b7307d133", "comment": "Malware payload (Mirai)", "value": "98748a194b749749befb108cba372897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763342933, "uuid": "57438301-1ccb-472e-a231-fade73dc3ce4", "comment": "Malware payload (Mirai)", "value": "dd7b55328c542532f55fabb86fc3efef3c1294ccfe70273b1d28f8c206b725dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763342933, "uuid": "3d84f42b-ae91-4fe6-94d9-3c8e947dbb41", "comment": "Malware payload (Mirai)", "value": "ea0823d82daf4fb262b20365825ef8ef87713e51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763342933, "uuid": "93a83364-5168-4477-a3a9-1148677592c6", "comment": "Malware payload (Mirai)", "value": "0d8b1cf31946388274b74452199336fe55e10eba002461c7f2589e27529c4336a984aee03ab01f28bf683e305a69e74f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763342933, "uuid": "799e4b3f-72b1-4e1e-8ea1-faf09a4f6d07", "value": "T1DDB36D21B8391E27C4E0947B22F74366F1F617D915A8CA0E7E720E8EFF255503647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763342933, "uuid": "86449ece-3419-42f4-94de-26eda3852461", "value": "1536:W70EAWmL9ek3aL/ngxFyTzAkLm70dpkLKR0UwhfX/+6coC8tGpYm5da2cMCJBttL:+0yke7fWLKI/+F4opYOELFAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763342933, "uuid": "84568a8f-95a9-4635-9d69-cc6a9f629765", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763342933, "uuid": "a775d4b4-348b-4f76-b61f-8638c5e4d0ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763342933, "uuid": "39402d45-a0a6-4631-ade5-3e089ff94083", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6a0e71-c382-11f0-a129-42010a9c0007", "comment": "Malware payload (MicroStealer)", "timestamp": 1763362402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362402, "uuid": "7eb2e54f-d6cc-4a62-8b97-102b25e72177", "comment": "Malware payload (MicroStealer)", "value": "c900bd0e9911dc21c53f4779842aed07", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362402, "uuid": "d59dd2c6-f66e-4be5-b0e2-c4f415a8929d", "comment": "Malware payload (MicroStealer)", "value": "dec0d327c39044523564721608ab551fffeae7af144b9657c367cd47aeb16a7a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362402, "uuid": "b4f9b715-e73d-4804-b552-8b4d9511bc45", "comment": "Malware payload (MicroStealer)", "value": "d616c7115b606ba923b4585a220e75ec2ba66764", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362402, "uuid": "8e39f4cf-a0cc-4ff4-b085-47937206e741", "comment": "Malware payload (MicroStealer)", "value": "8fd9e93fc3890a43cddec2af662021991d16b8ab27d4bbc0b1ce087dbc6d5c0c177210b8b429c0ba8b38bca06847d72b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362402, "uuid": "767011c1-a8f7-47ed-a2f4-0cfdf4f968ae", "value": "T17B570219D25F403ACA57D67928EF4BE6FF30829F8220571F23F439198CD2B990B62759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362402, "uuid": "b56367ce-9f14-495c-98e4-5cec40ab707c", "value": "786432:LDNcvQGN5q+feL1rC8Mk4CrpPXjstm97IDEzn:LDNc4Y55eLVC8MkDtPXWu7I4zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362402, "uuid": "89787737-b886-4a3c-b83a-c60478f70c94", "value": 29312841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362402, "uuid": "9867c176-db7f-4aec-b0a4-147f925f124a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362402, "uuid": "bfee30df-b39f-4575-b722-85c8ddc57e6e", "value": "game.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ea9f08-c3bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763387486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387486, "uuid": "fc6c61b1-bc92-42fd-aa6b-1d9642f3e797", "comment": "Malware payload", "value": "53574eaf3318f05c164024adb463b7f9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387486, "uuid": "30583ea9-cde7-4186-83d5-601af7543111", "comment": "Malware payload", "value": "df000aa66d562da6e4093eeefc1f0fea39304b58f4c57d14a1c0486d2c1cf963", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387486, "uuid": "f425b892-b28f-4c97-b2bb-d84fcb22a900", "comment": "Malware payload", "value": "b6a3a8cb3b1b5f58ac97bb4ca8f25f5fd40ba59e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763387486, "uuid": "b5c4c911-2f17-482c-a121-65ab48e19153", "comment": "Malware payload", "value": "1e5221118aac255f921da0c17b32dd1b334e539b82b1851b029356b69b51593614f9adbd7e5031510a77b2ab57b8e718", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387486, "uuid": "6268fd18-e197-40cd-9245-511ce50ca949", "value": "T146F00C43DD07E9D72E3B7B90A6019C3AEE810A47211E80023380DF1A0F202A47AC84C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387486, "uuid": "e7b3e84c-0209-496b-9fa7-b83822fc6cfb", "value": "12:KqSPwv8C8UHk9iKEQvDz/HpSKWMF9fjAW4iZXrfWRKtCcwEA:KqFqiKEQHJtW097z4EK0YcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763387486, "uuid": "08f38c29-91c5-4183-87a6-2ed70417a03b", "value": 592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763387486, "uuid": "29a31e88-a5ea-4713-a7f0-ea4de98012c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763387486, "uuid": "48d2e5db-7786-4bf8-a68a-273269f4f263", "value": "ZoomWorkspace.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dbce3c-c3b6-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1763384857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384857, "uuid": "159a5a00-eb57-4598-823c-0d719ae49f00", "comment": "Malware payload (VIPKeylogger)", "value": "efb1e8c5c1be599507b8cf89b2a5268a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384857, "uuid": "3e10cfc8-9b20-4bbd-b22e-06dd4238a861", "comment": "Malware payload (VIPKeylogger)", "value": "dfcfd9411491364986e5933eac3626e484c6fcf3921ddb86fe99edf180ecc225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384857, "uuid": "4807695f-3fa7-4aeb-930b-badc1c94402c", "comment": "Malware payload (VIPKeylogger)", "value": "2bc8d9b78f26838fcfd0ff4d679a7dfb56afa3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763384857, "uuid": "c2e09278-2cf2-4cc8-b4c1-6569211d9d27", "comment": "Malware payload (VIPKeylogger)", "value": "811fbdc6195109de9cfc10659c1ca6cf17af299695e832c380ba157626478ba8e9df86ab26f4e46049afe5771880e979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384857, "uuid": "3f5a7048-ab31-4d17-b0b7-643d9ae6ee79", "value": "T16F64A37718016ECEA638614D26978F1623F3A42A55D39EAB744108DF301BB0DBBBD5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384857, "uuid": "70aff305-50cb-4c5a-98a9-5b3896491645", "value": "6144:pEQtDycbAqqjOGl/80mYxpfad5tqq75cyMx8hs0Xz:2y0//8m411ThXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763384857, "uuid": "3d7c66b8-25aa-47a8-a0cd-9642d10964f2", "value": 324266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763384857, "uuid": "a4306bd2-321b-463d-8e97-f2ab650cd56c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763384857, "uuid": "1ec5a287-a687-4442-b93f-e3d85df9b354", "value": "SWIFT_MESSAGE_5890339TECHCOMBANK Referans No326343 EUR_FNYINT_14112025pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14feb539-c390-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763368404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368404, "uuid": "7dbf1b91-a9f1-4164-879e-ccaf26850f7f", "comment": "Malware payload", "value": "4155bcd2e719a498f88fab6e2e6496ed", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368404, "uuid": "ee80ab01-4b04-4ead-8923-472466d194aa", "comment": "Malware payload", "value": "e1a82e6f3bda56c93362fbbadace40b362940092c5aa26816d558760ead7bca3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368404, "uuid": "13fb97e1-24bf-4406-a6e1-7a9d72f3f5b5", "comment": "Malware payload", "value": "32b1e4cc21e378e1e35c00744637af73c61a65cf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763368404, "uuid": "882f2b5b-c006-4a47-9016-4e813fb37270", "comment": "Malware payload", "value": "44b47fdb0211b166a2f633d79eaeaff50160cf77dabba3d8343f50a43d54669b668a7973583d0a6b50a7503229468249", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368404, "uuid": "ef84598c-86ff-45e9-ac96-9d4b9d1c040b", "value": "T13341281DFC1FC3A9C62283561A6E802EFEC494DAD42995257B54CCCC2A74378F6D458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368404, "uuid": "269d98ec-1773-42d2-b7d3-44637d639d53", "value": "24:u9IHKKmBCm8/KuGjDmytIIwb9mtNSHbNZh7N5yGJcqhMX9+1980VMBn9MSofE8RS:lqrCmrn3mdIwoDex7NdVS+md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763368404, "uuid": "09b57579-adb5-4b7a-9f5f-1be4176ad0c8", "value": 1898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763368404, "uuid": "63081ef1-4fdf-43fd-82cd-d380d038f753", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763368404, "uuid": "5e8e11d6-fdd0-4785-a6b2-96ce3abf6b58", "value": "user_c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef155899-c3ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763416444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763416444, "uuid": "090ad21d-94c7-49bd-8708-04c7a368ea04", "comment": "Malware payload", "value": "943a39c3e80676a2126b4e82eef2840a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763416444, "uuid": "92ac3a73-e6ff-4833-b4c7-155ce9f28b92", "comment": "Malware payload", "value": "e1d5f77d935de6feeae4fdf20a1f88728b1ef29d0dd089d4201c57b9aa454cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763416444, "uuid": "f74a08fd-7b16-41e6-afa3-2ac2483380a7", "comment": "Malware payload", "value": "cf1d64efcb9b2fe09e5d35a4dc75ab81f2428ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763416444, "uuid": "6708257a-4959-4baa-822d-37308276a432", "comment": "Malware payload", "value": "8dee8e26ae84a189c7609f897978b1dcd93cf642231aeff33ff2359d5a5ed37b3a1382c12d7d82b1984cc6192b69bd11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763416444, "uuid": "9cc34b8a-bd3c-4fba-90e9-e20dfcb45c69", "value": "T1C6333B31BA721C2BC8C5697962F34725F2F5478A20FC8A1B3D710E8DBF65A4036976B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763416444, "uuid": "d7db187e-f0c3-47e5-9daa-6d713fd3bf38", "value": "768:K+A2pYgPkKo0FsxFRrEBWO+YHG5qTuIv1tkaIQba+:KQl1o0FMx5Ym5ktka1bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763416444, "uuid": "e0e1bf7b-6cf4-478c-abde-f336a801f041", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763416444, "uuid": "09da0d85-356c-41f9-bc00-fe6563ecaec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763416444, "uuid": "680ecc47-54a9-4d5d-8858-11a1729139ec", "value": "wewe9.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e16f174-c404-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418294, "uuid": "62619a0c-d593-4c90-bb19-9e02c0e71b1c", "comment": "Malware payload (Mirai)", "value": "f5d21ed894326df3dda478cbdaad1287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418294, "uuid": "731b455c-4ae2-47d2-b87a-be5892a66df3", "comment": "Malware payload (Mirai)", "value": "e2e99dd659231af43fbb00875625246e3f008ba754d9b13fa2b675fbaacd5da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418294, "uuid": "a1f8adff-550a-41f5-b86a-50ef671a7b5e", "comment": "Malware payload (Mirai)", "value": "ac7aefd9bbeb475c13d32505afe3cae986cdc72b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418294, "uuid": "1f3792d4-c32b-45a2-8823-1bb8824aa14f", "comment": "Malware payload (Mirai)", "value": "8dde73a3f88524469cc584fc959995351ee758962c64b055f473a716928d3337b997df8ddfb4e683b447c61117dbc115", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418294, "uuid": "7bcfa7bc-48d4-4d2b-a8aa-d9330e681187", "value": "T19562C0225725D5A1CE616E34DB384BCF39514FFCA2BF3423325911A46AF548A27D078B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418294, "uuid": "dd1b6e7d-f6ee-4ab8-b8ca-b84925edc050", "value": "384:okg8GdHaltP3w0KbBppjVDv+yEnMKFh7qmdGUEpiapVV:7GqtWpphD9Dk9q3UELB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418294, "uuid": "a3463444-a353-431d-9b91-5e0871e855d3", "value": 15856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418294, "uuid": "c56d2372-d81c-4897-9a5a-3fb69165e7e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418294, "uuid": "9bb90200-2827-4689-8828-fd991ee108b1", "value": "wewe7.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a939921e-c39c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763373806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373806, "uuid": "083320ac-8e36-46fb-8eb1-191cb8530c71", "comment": "Malware payload (Mirai)", "value": "ae395aeec5c676986d9fdef3ea5e5bcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373806, "uuid": "455a5830-cd0f-415a-9a9e-f1e252849a39", "comment": "Malware payload (Mirai)", "value": "e356bea6cd60c09eae185536ee8a4dc4804fabe28b0b5a8931a092b08e0694ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373806, "uuid": "d80fa8c7-9e53-481c-bdce-371d92caaeaa", "comment": "Malware payload (Mirai)", "value": "5fad3b2a73d64821d3b0a2cad9d8a21893c010ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763373806, "uuid": "fce248cf-9d54-4e32-9088-5995ed3a4dc9", "comment": "Malware payload (Mirai)", "value": "579d076752a83acff2a8b23e45d691bea40f5679b20a2e0e78ab567a6835bc4b77f90385fa9825c45c7132a097ebd6af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763373806, "uuid": "7156d9a3-23d3-4d5c-81c8-f75121a045f1", "value": "T1D0830881F8C28B2BC5D4177DA6AE618E3361A3E5D2CF7617CD205B26378120F1E67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763373806, "uuid": "7219b198-3372-4cf9-a15b-9c561cc97493", "value": "1536:nnPxcoqyx2KB7aH80nv7bBgSX9jopOVAAWRit4Zk5DQExnSe:Pyoqyx2sa1Rh2fZkVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763373806, "uuid": "7a9be989-6483-4c81-96d2-feb0084b884d", "value": 83468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763373806, "uuid": "ce83709a-19f1-46ca-befa-ac84659a6f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763373806, "uuid": "4a2a4d6b-e41d-473e-bcfd-9997e40e8211", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95b75fb-c364-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763349889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763349889, "uuid": "d33aea7d-b02f-4ff1-8834-db94b43745b2", "comment": "Malware payload (Mirai)", "value": "dd8d3dd8857d2822df3a522cd13ea37b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763349889, "uuid": "5697b7d5-aee4-4855-8549-d3ea6a02932d", "comment": "Malware payload (Mirai)", "value": "e35e68542b6217199c0943cb5609e4ebc9f2b1ec19f7a1236e6c97e1a3e0569a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763349889, "uuid": "1f3a8f2c-0778-40b1-bf54-42d45231ede4", "comment": "Malware payload (Mirai)", "value": "d73168c7b974ae569e9a60b68420634bdf63835e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763349889, "uuid": "ea52b25b-017a-4e43-ae35-c056abac5ee1", "comment": "Malware payload (Mirai)", "value": "cba801e568e859c491ed1664c979ecfc7aa6ab7e1952b0975b90e199234666a58db3b4faa5b803433df1579489fe4a1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763349889, "uuid": "552a261c-8c2d-468c-b8c3-538237a0bae6", "value": "T182C32A56E6814A91D1D208F37A1F2299374B47BAE3EB3103ED150B60BBDA51F0B379D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763349889, "uuid": "08fc0dd9-15e8-4e36-95f9-24ddb2782ebd", "value": "3072:BP7xi7MfTYKTlkw53QDy3D7ofCmcDiuX2:/T0ikw53Qu3D7ofxcmI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763349889, "uuid": "bcd3358d-b686-4f6a-8375-ce90c4e76bd7", "value": 129840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763349889, "uuid": "48022188-b8cc-4ab7-81b9-823fa781e18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763349889, "uuid": "d44252ba-bddd-4b6e-a389-c5c109dffff5", "value": "dv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05978d20-c357-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763343897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343897, "uuid": "7f7538a3-ac39-4c12-abbb-bc1cc72219e9", "comment": "Malware payload (Mirai)", "value": "596e85e67d3dad958f629bf864ac7c04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343897, "uuid": "91957fab-e602-4940-b95b-01130b0157d2", "comment": "Malware payload (Mirai)", "value": "e4418b3f8494c0373ac6978cf7175bd7234c52da7b58a5252905aee6ea3f3bc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343897, "uuid": "cea48a8d-e952-4dab-a630-42069b7a03fe", "comment": "Malware payload (Mirai)", "value": "a947921106eaa6edbbc7bc1b576e7afd68e9f3dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763343897, "uuid": "2c2cfc4d-a177-43a8-8f65-f78955f89217", "comment": "Malware payload (Mirai)", "value": "9ad63cd4e5fc11e0e9987ff17a62c7f3257e1d0b6a9e14393a5954f2fdf13e1d1b79b601d5486943cce67893e2d4ffb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763343897, "uuid": "83c06628-dc7b-444a-9895-94775c5adb91", "value": "T12BE3E916EB210EF7D42BCC730199278528DC436751AA7B77B938C824F99A58F46E3CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763343897, "uuid": "3d06239b-9194-4e37-9958-15e37f3ffa66", "value": "3072:OAvLg7UGfMQJ6IRyqv7I/fH7fmjvXbv1:BsNMQ5RlE/fHKv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763343897, "uuid": "38d39de0-028b-48c3-9478-0de1643585fe", "value": 147916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763343897, "uuid": "1ab6cff8-2f2a-4dba-9a98-a541da6fecbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763343897, "uuid": "130a5fad-2fb0-4cc0-9852-495c221b14ba", "value": "m2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6f3673-c396-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1763371208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371208, "uuid": "9d4297ce-cc5b-46d0-90db-6edd67344e7a", "comment": "Malware payload (DCRat)", "value": "5cd29d1e98bcac3144e0d17baf4a49d2", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371208, "uuid": "9ce8f8ef-00e5-4891-8be7-6a68ba3a5b23", "comment": "Malware payload (DCRat)", "value": "e4f5d0ac6f0720e1c435f56ae06b4416d5b8f1f7057d4e353bf056f3d9aceed5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371208, "uuid": "22597427-6cc1-49bd-b3a2-854bc31288f8", "comment": "Malware payload (DCRat)", "value": "91bb1bdc79f73d76b96ddf1306e1f3e04096d334", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763371208, "uuid": "d2662f0c-7024-451b-a3c0-2e8544feb4db", "comment": "Malware payload (DCRat)", "value": "02a8c8e90149812cdd1f79975a4fa8310a1b674c12b00aa22168bd89a3bb2987aa0b49728a741f91ed8bad2aab20d794", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371208, "uuid": "094426b3-f415-4e45-9e91-0ebf104d7a63", "value": "T1992533750BB5E2BD015B3082503F8B8B5608C6051554C9378EE633E956ABFC23E6EEF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371208, "uuid": "be8dd61e-67ce-47e9-bc3c-c0314d083bb8", "value": "24576:q5RXIy1O8N9hzL6BkaqZGCwO+vS8DxITQhWd2pXfDpMkr:qj44O8RvQkapCwz1ITQWd2pvui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763371208, "uuid": "828fdabe-f67e-4ea6-848b-16bcbe999f6c", "value": 1013205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763371208, "uuid": "f44ef2a7-9bd7-40a5-8218-7079d6fd4e0d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763371208, "uuid": "21ed5d01-9752-45ad-ac68-4d6ac21da4d6", "value": "m782tl.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90ce7b0-c398-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763372196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372196, "uuid": "c24a2dd5-4aed-49ef-adfc-deb7f4cf6096", "comment": "Malware payload (AsyncRAT)", "value": "aa3649275b55e9e983fb5030f18dd80a", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372196, "uuid": "4b76c349-2ea8-4fc5-929f-becf2a588fa0", "comment": "Malware payload (AsyncRAT)", "value": "e6d8df4c48bffbfe904756db8468178fb73547d51b05ca1a8cfe22230d4dc0e1", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372196, "uuid": "565c7939-5dc7-479a-af12-e9339ccf8b98", "comment": "Malware payload (AsyncRAT)", "value": "06c0bc35ddab0c018ef3c1d6fc4d44227dd99ae7", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372196, "uuid": "2732f7c8-0627-4322-b251-fbe0583b831d", "comment": "Malware payload (AsyncRAT)", "value": "7c1dc13987f4f466d148976cc1dda1b1b05007fab0b19b54f53bea57253024fc001eec15f9b6e564e45e6b7165011ab6", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372196, "uuid": "403390b9-070d-46a5-ab9c-b2964b6de42b", "value": "T1BFF422E134A5B894DEEFE24F84AECB78B75F0682D707218A531F1D58462350F7A849CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372196, "uuid": "e3872186-45bf-4f47-a16b-3e54bfcc5cba", "value": "12288:N6KbA9wNywBmVz6lV3S/P8okX3xshq9ekeq/BRSp6g0xr5Hj2KnJlkpw9vZsiA62:N6KbA9wNywBmVz6lV3S/P8okX3xshq9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372196, "uuid": "2a3f299a-69d4-43da-984f-33ead7b16f9c", "value": 728314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372196, "uuid": "a5a21a5c-2100-4474-91f0-9a58968c7f3a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372196, "uuid": "f829cf5d-bb6b-4b33-bde4-7443da89ac0e", "value": "a9z2ls.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e580fa2b-c3ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763386793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386793, "uuid": "be696cce-e352-487c-b6ff-9c5c56b07c88", "comment": "Malware payload (Mirai)", "value": "096d0cf6298805108e6b61529c07c2f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386793, "uuid": "a70089f8-176b-4d6a-8006-18246ff9c11c", "comment": "Malware payload (Mirai)", "value": "e795c83dae5affbbe8c245643b84e5dfaeb6658f775ce785b02b9a503e8dc222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386793, "uuid": "aa6e9fd5-ddaa-4a26-a4ad-8cf249df929d", "comment": "Malware payload (Mirai)", "value": "ec46d71be2b899cd3828c6b6832c6c412e693d5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763386793, "uuid": "629a200c-21d2-404a-a926-7319496e0804", "comment": "Malware payload (Mirai)", "value": "5f442583fe65117aaf126e31abd34375bd678307bfd5820f5cdae3495dc5784f2ecb225348681ab0c6208de2cfed4c00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386793, "uuid": "696f96c3-2fd0-4d92-af53-9a89b022fc33", "value": "T179A3F809EF514EFBDC2FCC3706A9074524CC661B22A83B767678C92CF55E24B0AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386793, "uuid": "8bb56ce2-8f7c-460e-802d-470b40b29c7a", "value": "1536:EEUFio8OM5AjoNfi6YWIlaOlifSkDBhfNMz6V31sVZZC/sb2NWkd7o3dCqkTem9n:zHo3yAUxZiDYqL27sVqlaCqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763386793, "uuid": "3eef5336-e703-4a1a-854c-805b9ca95715", "value": 106488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763386793, "uuid": "818ba902-0439-42aa-b13d-55edad89301b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763386793, "uuid": "4a4d480b-ede0-49a6-8d13-2d57d4a994ca", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f893002e-c384-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363632, "uuid": "1ee82224-468e-4b3b-ac37-c0eee5078ba7", "comment": "Malware payload", "value": "768edc05ed6c6e30826e10946bad2395", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363632, "uuid": "7d2b961e-dc81-4cbc-b97c-fc94d7af9fae", "comment": "Malware payload", "value": "e7c5565115992f37c3bff28198bb5a17a0cf524713d7968f3be16cc5200170b5", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363632, "uuid": "43cb0e70-f800-4cb5-b5ea-88f4d0011a93", "comment": "Malware payload", "value": "0d0dc237c906dd0d7f4e35cbffdd1e11055f0266", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363632, "uuid": "c822779c-9178-4e83-9200-319852d9e675", "comment": "Malware payload", "value": "edb02a1788fdab2fddedb45a18db5f93a499aa95d3ba5a711d92c5cd508d625006ef0dea4ea8d4720c8929b1b0932c40", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363632, "uuid": "bdb9feb8-640d-40ce-ade7-c5fc4484f04e", "value": "T17701FD31389F8B08A2B26375130A8D11D111CC0670883E5BF19C869FED7150E2DB80E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363632, "uuid": "a3c79624-06d5-4c2a-808a-b644dbf304bb", "value": "12:zc/ZlryUPl1lrEVctTG61rRi8GTUnRZRxLq6gLsV2/+GSZKhDsxm3/sVL:zcbyUNU+zR2UnRZRx+oV2MZKhovp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363632, "uuid": "ef1b4594-61c8-4b77-8431-80ba6038421c", "value": 792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363632, "uuid": "fb98dc64-3eb3-412f-aece-b595ef5ac1d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363632, "uuid": "20f1544d-e97d-4bf4-812d-32e3647d7443", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180d3e34-c405-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763418660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418660, "uuid": "1c70f58d-3320-4fd7-9881-0ad7e92abdc1", "comment": "Malware payload (Mirai)", "value": "8da2aa7eef8adf45a549ac47caf199c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418660, "uuid": "f087a131-36fd-496e-9026-fb01d4cafe18", "comment": "Malware payload (Mirai)", "value": "eb1207b9ff0bc1f10bfb2c836327210ce46fa222d1889082ee85a8ce7ae58248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418660, "uuid": "053474fc-6d9f-4acb-a351-88bc0dd0ca75", "comment": "Malware payload (Mirai)", "value": "34cb35aae6a079e0118ba2d3e4a4f2d69ab844a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418660, "uuid": "7541294a-0726-481c-90a8-55ec74ddc001", "comment": "Malware payload (Mirai)", "value": "e7c024937e2fa77948c73660edd4608af58ac07e33da74a3a3c80826bb009aa6fa8d8ed3916e8e9c34dfed75dfa25bc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418660, "uuid": "a051aa6d-40da-4e89-abf4-89ea369a3263", "value": "T10923B74D2E269FECFB9C863587B74E20925833D226E1D645E15CDA001EB034E785FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418660, "uuid": "79d02926-c854-4eeb-821e-bbce01d8697a", "value": "768:z2CtEIgG6661xL1NTAL7ZL7yAL7tMURcgmV4NotVOVfmkDv5RafW8qxJeUUrKT:taGM1xL1NsL7ZL7yAL7tMURPgSfmcZfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418660, "uuid": "2102ee2d-18c3-48c0-a26c-14fae00de246", "value": 48576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418660, "uuid": "f2563a8e-2a46-4ecc-982c-4af04b7bd28f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418660, "uuid": "4ad3f977-aaab-4974-9e80-bba365c00466", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15979ea1-c407-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763419515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419515, "uuid": "b4298acf-8e55-49c0-a75e-df02156d77c0", "comment": "Malware payload (PureLogsStealer)", "value": "536a65d8f2157f392962f9ed81550c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419515, "uuid": "6c05fe79-ca4f-49f0-8c23-ecf9cc14df2b", "comment": "Malware payload (PureLogsStealer)", "value": "eb71e28819e2f1c7a84f524b9e39f85b376eca36d3b6428f1edbe8e9d80227e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419515, "uuid": "7f3e9e39-8909-4177-bbcf-8c112de72f62", "comment": "Malware payload (PureLogsStealer)", "value": "0bdbd96ec6ed2b2141699afc9317f6d6206a5f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419515, "uuid": "966cc72d-7f0f-4e97-afb1-a9b6ef0f8c99", "comment": "Malware payload (PureLogsStealer)", "value": "a1f4d0de39f48bc38991000cf37ad2c5989165602a2dbca207d865d4d3567f656c33b7aa7a61831c3ee8bb4c1692e771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419515, "uuid": "c6a0e65a-f7c4-4eec-8ff3-6db6b693612c", "value": "T146C423D4F18B4AB6C78257F3F10B121B1675D3C6027BDB49649B638F011AB8ECAA7781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419515, "uuid": "657c57d9-0788-4516-9b4b-2e16ea8a3948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419515, "uuid": "3650249e-d3c7-4bb1-9af6-c47908e0b236", "value": "12288:2eGCinWceCTToeunTrrjeh5sA5jey6d9J0/ExMO9D7o:2ebinWce6f/jt6dP0AZ9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763419515, "uuid": "3ffdfe64-8b44-4843-a883-083c5d37def2", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763419515, "uuid": "7292e2e5-c799-49a5-ad98-14507559a865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419515, "uuid": "1b1d893f-8aa9-4af3-a050-febed200bc00", "value": "ZiBamZM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58601d37-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763372812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372812, "uuid": "bda39d6b-82bd-4719-82e2-24dbe61738c4", "comment": "Malware payload (Mirai)", "value": "a37175f18ffa7ed5ace08086d04cd2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372812, "uuid": "8d91f0d4-a316-4c8a-968e-9f497b9d42ea", "comment": "Malware payload (Mirai)", "value": "eb987b84aab194ca9df34b2e294c806227ec4e51b91016ddb4061d80da2178e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372812, "uuid": "c629762a-2c62-4a2c-881e-092a18a98718", "comment": "Malware payload (Mirai)", "value": "3c014bafe10ae4d473e25124f201a5acf5ffff1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372812, "uuid": "5a2945c4-7507-4f92-bb2d-27603e43ea83", "comment": "Malware payload (Mirai)", "value": "37927877d10fe8921322996f16dd40eee1c73f80e513a68abff5eb3f5e70201354ade51accb7ec5ec502a2b90ddda8d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372812, "uuid": "57a67261-ef69-48e5-83d9-d4ea770e1177", "value": "T157230262D8DEF2D8C1F8323154DDEB562112C138B69C52AAF9F4E06F4896F7EB1251C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372812, "uuid": "1552426e-a10c-476e-a189-47542fb5d2ce", "value": "768:kDpRDKGHe56zu5P0ylM+iXrQ/dzp/q4ZvwcHnT9/2cFShfB70I2m54TJvSn5CWNv:CHD1+EC+gMa/Z5bz9khfeS54TpBOounf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372812, "uuid": "90e3724e-108c-49c3-8988-223315747f12", "value": 48028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372812, "uuid": "01c00913-36d9-401c-8def-c24d37001a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372812, "uuid": "481d8c95-7d5d-4f48-9f21-cf641137aed0", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5ce8b9-c38b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763366537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366537, "uuid": "61ada57f-2a96-4594-ad30-a50a2077624b", "comment": "Malware payload (Vidar)", "value": "a4d3c70dba0475b4e42a0cd468bce1be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366537, "uuid": "145ae27c-0433-493d-9ff5-a3b207ee2ddd", "comment": "Malware payload (Vidar)", "value": "eda16363d421e98eff599f034b8f3bf310c6a104d30b14718f5e7beb79024695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366537, "uuid": "741ba00a-da1f-48bd-a442-8ea204bccb49", "comment": "Malware payload (Vidar)", "value": "8b0a6106de479b65cbc4efc8cfa1bead21dcbe06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366537, "uuid": "c1c84097-b717-4fc3-a9c7-257bdfdf116d", "comment": "Malware payload (Vidar)", "value": "637a2db74b3379c51f5febae8a7453ef147f851401ba404e6ffe3ca05e1694305b61b6d58ea0dbe7407929861bf9c456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366537, "uuid": "29167666-373a-4224-b827-7a454d078233", "value": "T166F61770A351A565C197C0308FC74FF461A1A13B41352E0E6BC4D92A6EBBF71AB9D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366537, "uuid": "4df5fdaa-d038-4467-b28d-e26ea16059ff", "value": "1e97b178768c2f28e0e97347bc3c12ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366537, "uuid": "739fc684-31a4-401d-8ecd-3e04ad7b2b30", "value": "98304:RCp/Bs2gF56stuartzkQkpGV/+2Yt3bYDyXe73pBh3qn:Qu6stwFpGV43wyXedP3qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366537, "uuid": "220f64fd-f201-4bc2-be35-d94955d678c6", "value": 16360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366537, "uuid": "f4166aaf-5aa5-4a86-befc-bc91e73295f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366537, "uuid": "e16259c5-76f8-482e-bd52-2c7d0ffd0450", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5aa465-c3f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763412685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412685, "uuid": "81868c33-9d03-4f69-9277-630496590493", "comment": "Malware payload (Mirai)", "value": "358834462e64b90884bfdd8ea0f4c9fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412685, "uuid": "3de64844-d56a-48a2-af06-510728b264d9", "comment": "Malware payload (Mirai)", "value": "edc4df341bea11c358e0e7854678a5838781fb8651830b58688da6ce6f6e872d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412685, "uuid": "053f07e3-b22d-43fd-92eb-c1366a318038", "comment": "Malware payload (Mirai)", "value": "e78e4f311a6400a0da57479a32e0970fd94801b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763412685, "uuid": "237f1fb8-ecca-401d-8f53-a9bd9b4e87cb", "comment": "Malware payload (Mirai)", "value": "69765b767b18af2ee3dabf5a5bdcb664d94ff34ed4fd0c667fe026cadbbdf2d94dd164328a57ed3656cf142a37cc142f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763412685, "uuid": "1acba23d-7063-46c9-be57-ae132c69760e", "value": "T121639709EF554EBBEC6FCD3706E9070235CCA51A11A93B3A3578C82CF65A54B46E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763412685, "uuid": "176cd65f-b2ac-4c08-8ed5-e5faa5e1de95", "value": "1536:7N0l/gFQSel9tZP55WgIQZVkWB4a7EnrY:7AgFCPzWgIQLurY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763412685, "uuid": "03674121-dae6-4ddc-85e0-ef56232bda3a", "value": 68376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763412685, "uuid": "6156e655-0532-4426-8711-1a2dfeb9df56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763412685, "uuid": "67e1f97b-d085-4de5-9a3d-5082021dab95", "value": "nigger", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299117cf-c40b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763421266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421266, "uuid": "cfd974cd-2c18-41da-8c8b-29b2716ab8c4", "comment": "Malware payload (Mirai)", "value": "128ef9f8d3eb09fb50b1901435996288", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421266, "uuid": "c24c9af6-79d5-41fa-a687-60c0abef92ec", "comment": "Malware payload (Mirai)", "value": "ee8200e0f93703b4da47d018afb25a5d326ffa0da3e1b7e1f701217b1a1651a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421266, "uuid": "b66b29e9-98f0-4c66-8a41-2298955b562f", "comment": "Malware payload (Mirai)", "value": "226feaf2e5924bc2e1f6e0881f42ab70a68477db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421266, "uuid": "e9595a72-a818-432f-bdff-7389b59751d8", "comment": "Malware payload (Mirai)", "value": "3b852ea55c5e6b9948f081cdadffe90528666f35184ea0aadc83f01ed10dad5c7b2a8cf84770f9fb33949656b7a421ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421266, "uuid": "18c87db8-b7fe-4ba7-bcab-266eacd6fcc0", "value": "T15953A45A6E218FEDF76D823447B74E21A39833C627E1D784E29CD5005F6038E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421266, "uuid": "d44b97c4-804e-4a94-be29-78a7cd61b2b5", "value": "768:zwnZFwBtTz8hXmfb7jWdY6lqZ8egGMrj1PCIoYttEQWypYFeT7Q4cIqV:kvwsFs7YY3irIynqe3Q4cVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763421266, "uuid": "66578f05-7402-4d24-b423-5ac2198c017b", "value": 64760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763421266, "uuid": "a92015ef-4a68-4b76-b298-dc04b5788d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421266, "uuid": "4c189354-ce9b-4427-a9c7-a62516e090f7", "value": "wewe2.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9940ee17-c3c6-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763391819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391819, "uuid": "87428391-6f33-4e8f-b276-9e3e1dea26e9", "comment": "Malware payload (RemcosRAT)", "value": "578cbe9b900fc9f69d63277f43df451b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391819, "uuid": "5b42f5ff-a012-4caf-874c-6953c7d7b98f", "comment": "Malware payload (RemcosRAT)", "value": "f0897cfd849935fa8e4174994bedf6feddd9ebdeca7860e37ed4153468e443eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391819, "uuid": "83a0e5c1-46b1-49a0-a187-018ca4dfa24c", "comment": "Malware payload (RemcosRAT)", "value": "eca64823692582c8b4a9e2837cac804a2dd16b99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763391819, "uuid": "495e177c-5c9c-475c-bdf4-234334f306c6", "comment": "Malware payload (RemcosRAT)", "value": "3124a8a8a4e21b825b8b5bb21cd6d11c4c5ae440ea01114ef784231e621d4c1b682eca8bec8413b95f355a4c06db53e9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763391819, "uuid": "cf3c40fe-e4e5-41b1-bfef-0ec493ec0b59", "value": "T14996C71567E4D09BC6A7EEB5EA2D2690AC0E3D2728C20C5BF539756B306F85CE630D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763391819, "uuid": "2b6d2552-8cac-42e8-b2d4-f72755eadc2d", "value": "98304:e33MYZxWLS+SQMw6AonyQxmm82R4Pzudc41e09A0ZuZ:23MYZxW2+SQ5onyO3BR46iueCA0ZuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763391819, "uuid": "5a772e3b-8759-4056-9e3a-f3f03262b659", "value": 9234208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763391819, "uuid": "bcb78081-991d-4229-86f4-9cc77008658a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763391819, "uuid": "ac1afa1e-b9f5-4450-8516-43f1025749c7", "value": "f0897cfd849935fa8e4174994bedf6feddd9ebdeca7860e37ed4153468e443eb.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e79beea-c3d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763396874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396874, "uuid": "118eb59d-a66c-4c3d-8eb4-74cb1de732ae", "comment": "Malware payload (Mirai)", "value": "03fe7bb4cb92d47ffe13ceb3c3ffd6c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396874, "uuid": "96e52c6b-988d-4c97-af19-83d570b4ef2e", "comment": "Malware payload (Mirai)", "value": "f09ffd5059c0a7ccfdbf69b0e3c370e5f0ccfe5b4a3b5492ed60ca9ce83fc979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396874, "uuid": "2046c150-cd11-4ddb-b113-47d6e605879e", "comment": "Malware payload (Mirai)", "value": "6aa3ba6ca1097f0529a18d40813697e12df34c60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763396874, "uuid": "57375432-c740-4eb0-8235-f464bf8498e3", "comment": "Malware payload (Mirai)", "value": "57d8f13933b9369aaeaf897c0f64a9f1f3b67ca4b10d09eccd3be336979bbbb5b0c9fbe5b4c963fc46ef9f314aa59619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396874, "uuid": "07c231ec-880e-4892-8422-94f2a1cd6e6d", "value": "T15A833B56BD81CA12CAD16677FB1E428D3B2743A8D3EE32079E215F21738652B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396874, "uuid": "e28fce14-7132-4c23-95e0-c7929a89f902", "value": "1536:Ir6Y7CMvc7WaMe2v5fO8yva1GX8M1v76emf:IcMvcCaMeC5fObi60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763396874, "uuid": "793a621d-7969-4da1-a652-48362bf60441", "value": 81660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763396874, "uuid": "0a98cda0-327d-422d-85a4-2bab592f7159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763396874, "uuid": "e8efb887-34b1-43a3-b3f9-8c33d7b8b2ca", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439c7844-c3ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763393393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393393, "uuid": "7308306a-f07d-4f47-b38e-74efab2c59bb", "comment": "Malware payload (Mirai)", "value": "29874fb441748b99a1a8f06f696f5126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393393, "uuid": "daa780f4-7641-44ed-b684-3f4517dcf05e", "comment": "Malware payload (Mirai)", "value": "f0f09db0805e3b397bcdf14abf5e3e19765ab6a90f09481dcdcd1b0032b8b9ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393393, "uuid": "bff8c5bd-099a-4c10-81c0-8da91c8e79ad", "comment": "Malware payload (Mirai)", "value": "db12da64fde9a4a3ad88fbaf753c0b3cce522d5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763393393, "uuid": "963fb5ff-6b2e-405a-bbac-16b56a931791", "comment": "Malware payload (Mirai)", "value": "d8e9c20a7fffb2a9f749541215c1d9cf5629f2c4c0d83f68c655f35da258c2ecf4b953416162b11b103849f52d91be87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393393, "uuid": "6deb6ef0-7a92-47eb-9f31-519d1f788f8c", "value": "T14CA3D60D7E628FADF2AC863443B34F35935837862BE0D585E2ACD6151FB428D581FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393393, "uuid": "b149bb51-73c4-4097-9ccf-dbc34b0e4c93", "value": "3072:sp3MzsLffumo8kksYwB+Bt8BfuJViZlfh:CffuvxYwBoC9UqlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763393393, "uuid": "966660a1-f843-4dfd-ab10-3a7fe41b350c", "value": 102936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763393393, "uuid": "b3d59f9c-4e36-4c8c-9944-cb53bc86b7dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763393393, "uuid": "ec92ff37-57df-497a-b79e-e847a4ba8dbf", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce9a3a-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763372955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372955, "uuid": "e5271327-f567-412e-9379-ca232e036bce", "comment": "Malware payload (CoinMiner)", "value": "4d648af4ae7ec56350571db5fd4f0009", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372955, "uuid": "3401ee45-74b9-41b5-96e5-7296403439a4", "comment": "Malware payload (CoinMiner)", "value": "f29d673b032f7ff763dec032aefd6c5759a1583b211625f7f770017bedf03689", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372955, "uuid": "a4305afe-5eb9-4338-a953-b20af281a477", "comment": "Malware payload (CoinMiner)", "value": "2786c144b232e5ae17411409395565ed6dcb064b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372955, "uuid": "30631c3a-e5ad-4865-8eb4-03928ac18a64", "comment": "Malware payload (CoinMiner)", "value": "cc39520a310f5fa385f9eb8376a8fb50db669d43039291b0491c12cc2973e416ca5790d53933b7c39c22481e27c4a7e1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372955, "uuid": "481e6b6a-4086-4d70-a10b-2c3402bb5fe1", "value": "T124569D26B7A400E8C87EC53CC6469513F7B2B81653B0A7DB27B4566A1F33AD41E3EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372955, "uuid": "9609b648-a73a-471d-8483-a74dc80e955d", "value": "3a3643ded1fedfee82a3324c3db3bf43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372955, "uuid": "b6560033-0035-4055-bbd0-98bf32696ef8", "value": "98304:mvI6UZN6/6QLxQrB68h5omxmGVOpksstMQXfhXjnJFD2a7d/atkSxQ7rapEZ650P:m/II/6aYXdFD22VatktKpEEd1Qi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372955, "uuid": "3083a74a-2ac5-4d4a-ba20-fa0d24062571", "value": 6455296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372955, "uuid": "0ab80263-2ccc-46e9-afbd-bceac7267b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372955, "uuid": "ed039f0f-ad87-45a7-bccc-71d34b700348", "value": "SystemRuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111158b2-c382-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763362384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362384, "uuid": "46a05807-4bc0-4608-8a55-c9842e490b31", "comment": "Malware payload (PureLogsStealer)", "value": "936528cd7efdb6c8b56a3f6abb93de38", "object_relation": "md5", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362384, "uuid": "89669e14-46de-40cd-9a65-3b8efb43ffa5", "comment": "Malware payload (PureLogsStealer)", "value": "f45eacbb78e0e712bc38c0bd7ba50b8311f3f198d0488d002b2831b943245c4a", "object_relation": "sha256", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362384, "uuid": "a0f5d543-5522-4f58-aef8-0b5146935dec", "comment": "Malware payload (PureLogsStealer)", "value": "af1c20e167d13d1b857a14305a3268433eb17067", "object_relation": "sha1", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763362384, "uuid": "9b7ad9ab-b019-4d5c-8222-c6c9e9b45541", "comment": "Malware payload (PureLogsStealer)", "value": "c605ab2de2c15cc5c39ea681f77d44b80f61d23e025875d4203cc125237bf8a2634a32c0dd56a3cd4c450e81a8bd0066", "object_relation": "sha3-384", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362384, "uuid": "b3e526a4-7593-40b5-a2d5-2cddbbf71691", "value": "T1CDF423129D8D958CF513FFFBCC9A900122E4F237A891CE0BD2191E165C9E787D816EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362384, "uuid": "1fcdd5fb-94cf-4eea-957c-4d213f9a21c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362384, "uuid": "81ab9138-cfa9-4b88-a07e-0792538a5ba0", "value": "12288:RKHQYqvMpMEpuwfqfM6ws1DMm5cPPgwiLW7aM0FZCS7d4qYnssAdjma:RKHQNvMrpUfggZHLg50FBtYnsnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763362384, "uuid": "2cca8bf3-b844-4323-a797-f43841596f7d", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763362384, "uuid": "226007f8-ddc3-43b1-9863-f814f627b98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763362384, "uuid": "bb9db97b-1760-4830-a2fb-46db3239a64a", "value": "17633196655fe3ff1ae467d4c4c0cbff0b47d2ee0dad730c1038104d797503bf74a8dd333e888.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c61caa4-c405-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763418721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418721, "uuid": "aec292ff-fd4f-47d7-b21d-bc723420df0f", "comment": "Malware payload (njrat)", "value": "9ece38dcd2362f9476263fad64f49b50", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418721, "uuid": "34bdf473-3bfa-4788-b019-87604bd7578e", "comment": "Malware payload (njrat)", "value": "f4e4d9cc74ac2b174a5e3bc41c29eea3fbcbea79ff32f49535bb6a56c6523860", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418721, "uuid": "ecd168ce-3af1-416a-9406-3bf970894513", "comment": "Malware payload (njrat)", "value": "f825ebd2682f13782c50c37a447e13a43f61dd74", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763418721, "uuid": "77d12c79-b930-46d3-9f96-d78c567a47be", "comment": "Malware payload (njrat)", "value": "b09c57a00ec5c01af9178cd7b66e83d809262954c6c7ae24016f4bd9d25312522e927c4960f06327dba315d90b27a6d0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418721, "uuid": "c3a831b8-cc46-40c2-9e61-146d22671b67", "value": "T16F2533DAB2D79C45C1BAB3B13DE4FD6F0AC4391D0A96D27A1FC841D63D43360E9A2618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418721, "uuid": "a3622f28-0905-4656-a489-961649791670", "value": "60559adcf3698c3eb3c69577ebf28413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418721, "uuid": "eaae5093-f19f-4636-ade6-48d7d12b4e36", "value": "24576:9fz79P7T0z/c+Gzu9IGUC5rsHCDwfQ09U4rug:9fn9P7Qjc+gu96C6HeHMzSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763418721, "uuid": "f4d36f82-891a-47df-b145-38933c76df22", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763418721, "uuid": "756b7986-baea-445e-a9e5-bd67d60b0395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763418721, "uuid": "1e5d95f7-f9f7-47a4-8d64-f771c9961fee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eafa120-c3ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763407128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407128, "uuid": "50fec4c0-82b9-47eb-afc7-e5724f61c2dd", "comment": "Malware payload", "value": "ddd1ac87a0fcb90e2168a0ce90402904", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407128, "uuid": "a62bea1f-1ed8-46bb-b0cf-3b118e5df962", "comment": "Malware payload", "value": "f5df5b5dfd15c1325ba35e122c450c77b00a53d528ea6f73c13e2d23aac426d5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407128, "uuid": "f51fc568-cfc8-4dbd-8ffb-a6adf6cfdb88", "comment": "Malware payload", "value": "3c5ab991125bdc866c77165fcaabdfdd3ff515ff", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763407128, "uuid": "4bbbf5b2-c6f8-42a7-a60c-7db1d429197b", "comment": "Malware payload", "value": "7603fa7ae6f1aa974857f6a2e03640238ffe46e9b1bef9c14713d959eb3304701a0a8b04511d979648c2ff6624b36517", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763407128, "uuid": "98e76793-2fcc-4583-b43a-a85a9094a61b", "value": "T110663385F4C05A3EF19ECD350CBAB628041B62135B205ADBF34B0955EE21FE249FE6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763407128, "uuid": "febbefc7-a406-4631-9509-cd2e693bd068", "value": "196608:FEx4kBtzkqeUc0WF8RBS5F6xYmQHRi0Q7zO1wKfLR9I7rwh:FEqkB44BS5sxiRi521lfLRe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763407128, "uuid": "870ad1e9-73af-4d50-ba0c-8a5692017382", "value": 6682112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763407128, "uuid": "1aa574b1-1442-4ef1-b6f9-ff27998e03ca", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763407128, "uuid": "15ddb9a4-3356-4024-a2a2-29e02a1a35e9", "value": "ChrismasIV.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bca4d77-c3d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763397353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397353, "uuid": "03c123e8-644f-4e6b-8780-9679b25b2bf5", "comment": "Malware payload (Formbook)", "value": "e76c19433d6782eb4c42f9c6c1f853db", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397353, "uuid": "6854444f-57a8-4ed4-b2dc-72279df43591", "comment": "Malware payload (Formbook)", "value": "f6051498dc45e053a9edab00f35873c74ecdb2beb450962e3a4b946c2529a4c2", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397353, "uuid": "79212771-9353-40f0-90ac-dd53e1ddc8c7", "comment": "Malware payload (Formbook)", "value": "d8401dbfc4fc2c32f629f7e8b3d8a7e67aad28bd", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763397353, "uuid": "17fe476d-7e04-43f6-90bc-7d1a0da68e5c", "comment": "Malware payload (Formbook)", "value": "e725ed84063435df9edff2deb9a0a2c286606abcaf27b8450dd90971dc809fa97eab47dede995d00f52699a3ca3bf716", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397353, "uuid": "f175603e-2f3c-4bd4-bf77-ffde02eec0c2", "value": "T17CD422BB51D9BD7EE0CC29F35463B9B4B8F92D5A0830B10A14A38BED5E5010E4519AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397353, "uuid": "9948c1f6-0408-4e3d-88df-55484b24ec80", "value": "12288:ziU22X4R2tW2I6Q2DRHOFopSEqCr1wo48hiH3Z:zF2FppeDR9QrG5iHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763397353, "uuid": "9c18713c-535f-4d34-a46f-82d29786783f", "value": 618713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763397353, "uuid": "f66840e2-f516-4850-8321-c82f819119f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763397353, "uuid": "1e17bdc2-9e65-4aad-a892-e0d3ea5c85b2", "value": "SIGNED_INVOICE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cedb5d-c35a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763345219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345219, "uuid": "6a5650f9-12fc-4603-bfa3-243d3ee197b3", "comment": "Malware payload (AsyncRAT)", "value": "60957894d3448012de8f23e65b3a7de4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345219, "uuid": "3a71845d-d42a-483c-a2a5-0822e510ec7a", "comment": "Malware payload (AsyncRAT)", "value": "f662e9c4e17bacaeaa8d6c3e7aeb8ba088b8daf5cb9da1e057a70c3e580dfae5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345219, "uuid": "134752f6-e517-4399-8da3-ff35a83fedab", "comment": "Malware payload (AsyncRAT)", "value": "696bbe31c56c67889e6340309fa0f4e1827fc2d0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763345219, "uuid": "47e66db1-d154-4cc0-b0cb-11b385c6d367", "comment": "Malware payload (AsyncRAT)", "value": "7f0a9d7bea98f5b6e301af91417c4c95f2f07e3b17b1deceb48be5bb229be5f2651ba1e676a5908388e792328827f513", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345219, "uuid": "d6611e45-1494-4702-b5c9-aa1b7e5f3d99", "value": "T1604559072EA8AA35E3BA4BBF0920D13007B96D5564DAE206BDDEF9DB3D75F010906713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345219, "uuid": "a97746df-ce75-4b8f-9b03-a469b67ac305", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345219, "uuid": "daf3be7f-d11d-4a6e-93bb-2770a7a793af", "value": "12288:fih96Q0nrqPlcxx/lYEithuihqKU4a8uah8ueEuLEitBKCvxv6x0QM7pM:fXqPlSu6iLvahah3eE8Eiama09p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763345219, "uuid": "37454a2f-7ee0-4fe0-ace6-bb073379dbea", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763345219, "uuid": "195ca283-3011-4d0a-8474-4c1b548f737a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763345219, "uuid": "33deca3c-e9df-4288-97b9-a759f6482375", "value": "Our Company shared mPNGage Dated 171125.TXT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4464a7e2-c34a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763338419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338419, "uuid": "34b12791-6094-4287-96b9-44e8da242c9f", "comment": "Malware payload", "value": "dc12cb4eb00b6b13098a77c4cd1ed039", "object_relation": "md5", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338419, "uuid": "5498589d-b6f7-4053-9148-e691ae98c21e", "comment": "Malware payload", "value": "f6a537143a1a90477b5a33042c773e39b620daa163bc81151f9e34d1b4389189", "object_relation": "sha256", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338419, "uuid": "1355c075-f8eb-450a-b67a-1f32c2c219a2", "comment": "Malware payload", "value": "71947efa5b3f16b3f08819431e9f879ce2ba6e60", "object_relation": "sha1", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763338419, "uuid": "0c26e579-aa01-4928-85e6-5722a126e6a0", "comment": "Malware payload", "value": "4fa0aa1ef7aad9c4dca12f19933d9d1eeaf3fa51edf6f21fa7d7002ee2b2e2a2c81fb25ed849eabaec66cd62a3881bdd", "object_relation": "sha3-384", "Tag": [ { "name": "173-249-197-116", "colour": "#CCD909", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763338419, "uuid": "1dc6fca7-36b9-4262-a304-d949fb35370c", "value": "T116630D45C2FD89A1D40CEE00A25AA221E4DEB1F7727AFE417C590CEE11E41B35BF58DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763338419, "uuid": "1cd1944c-8c8a-416a-ae9e-fb0235db3269", "value": "768:bb/0ATeKja0CPMFaY082jgV0MXjTIEH2fpy:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763338419, "uuid": "c5ba9e5b-e56e-47cb-8c3f-4e8548250bcf", "value": 67266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763338419, "uuid": "1204f294-cc39-4c17-b070-eb1f287f9657", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763338419, "uuid": "78cb0a62-aeb5-4a7f-9850-ca1181aae6e5", "value": "ww.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d2d709-c3f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763410256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410256, "uuid": "bd5be254-a546-46b1-b846-248231996470", "comment": "Malware payload (Mirai)", "value": "a43bab26bc431b422d13d0ed6077ace8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410256, "uuid": "e9616302-ff56-42bb-afae-e810f7281a0b", "comment": "Malware payload (Mirai)", "value": "f806dcaa12c22c0601d7108c8ae529f81577e989bd576221b0feec25c36c10e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410256, "uuid": "e09c0fe5-ff68-4784-b7dc-b6718e82bef6", "comment": "Malware payload (Mirai)", "value": "a354fe08d55802bc2c71e55a305a9cddd9cc16ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410256, "uuid": "5a7d7675-3384-46a9-b379-b5451fc3f9cc", "comment": "Malware payload (Mirai)", "value": "51defe029623dc36c787ad6db228feddbeaa391a4b537288b558eb7e0aa3e1e05b0b960425d69615a274b099cf6f3277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410256, "uuid": "248bbedd-0bba-4bf0-b0bb-e0888ff50901", "value": "T1EF03F12A46D407EAE10FC0BA9C8B011D5440FA1CFD9159E0A6D87612DB8DFD92F2DB97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410256, "uuid": "1f53e41c-f30e-4f76-8f89-86bda22f1341", "value": "768:J5V6RSJhtyULaYeYWStsxULCaHwlHJZA91jyUoUPKaXCnbcuyD7UHQRj4N:bV6SXDdeUOqLCjJCKsCnouy8HyUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763410256, "uuid": "c21045c0-6ea8-4c01-ba64-d6a327b419a3", "value": 39736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763410256, "uuid": "cdba339b-0581-41d0-bfc7-d0fe8510097d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410256, "uuid": "a03a55a3-7815-4fe3-9907-d85fca80ff40", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471fd4a5-c39d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763374071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374071, "uuid": "17228b95-e5ce-4506-a8e0-31727e90e0ba", "comment": "Malware payload (Mirai)", "value": "230ed6f45adf3a882afbb35892379470", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374071, "uuid": "5c972d6b-ee53-421c-ba54-3c1e1ab08daf", "comment": "Malware payload (Mirai)", "value": "f8a2f0bbc7a8946c516ef5474a178a323f1e8802c6cc9452a4fb589f1d542011", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374071, "uuid": "5356cd25-3523-4d15-9baa-44c7d4a61aca", "comment": "Malware payload (Mirai)", "value": "77e80b4fc5c2ae1dc91259c3a174d542cd70afe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763374071, "uuid": "74d2efbf-0ffb-4b4d-9762-24caf29c6f0e", "comment": "Malware payload (Mirai)", "value": "cd253ff4f8f52a5218284ee939f50f9fe66ec821b8080ad9a461fd34a887d933b25334a1a7028433e0745cf44e43161e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374071, "uuid": "a29dcb7e-5517-4bb3-82c2-a2ffc16b71f1", "value": "T19DC34CDAF801DE7DF90FD5B644670D0EB935A3A156830F26625BFDA3AC32194BC02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374071, "uuid": "20b82725-811b-4cb3-a8b4-91d3688568e6", "value": "3072:8g69+S+seeHKSNUkdIrqC37AY2wTJWb3Q:Q+S+seealeCLAsJWb3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763374071, "uuid": "70d8caab-7939-4f5b-b0d7-f4b65877c08a", "value": 118732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763374071, "uuid": "50e2efa0-10d9-445c-90c7-146e2fc0c12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763374071, "uuid": "cf6b643c-59f2-4e00-b91a-06df5419e2dc", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d22fdf1-c399-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763372283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372283, "uuid": "660d2975-5202-41a4-b209-35ff77619633", "comment": "Malware payload (CoinMiner)", "value": "e21de4011ca1b4238479f826ff621489", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372283, "uuid": "893fcf7b-24b5-4824-bf66-8aa6c17e808b", "comment": "Malware payload (CoinMiner)", "value": "f930afd78b0f26099dc7bf8170ebb7c0514e4100f72720ae711bf7251b15377c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372283, "uuid": "0748ad8e-a8e9-4b57-b2a5-4ef18b838fd4", "comment": "Malware payload (CoinMiner)", "value": "46ac1ca384ab72b4689d9eef11d280abe05ad038", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372283, "uuid": "aa4cd09a-746f-488f-ae81-73b6dd99d287", "comment": "Malware payload (CoinMiner)", "value": "c8c41ffc5dd841eb6cca7fcc3a463544c813be4e260b958475f88138b03da1c91366220193dad3abca6a6a64cb27b010", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372283, "uuid": "aba6bfab-dbdf-4e58-b9d3-b7ad9bc9d03e", "value": "T1283623464DF8388AD51159B4047AE2A790FF6D598B3EF1F3B9C2843B6C5CD88D2728D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372283, "uuid": "c4a42b98-a859-4a46-807a-7b29a84c7321", "value": "b237ac2118704db9e7609540658f5790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372283, "uuid": "a31db1ec-7524-4d99-bb75-7051ec91e202", "value": "98304:pdmf4aITt3no9a7mEM7YUNQu0OGYJY6a7u1zbd4biAkKgZS/DLfLL3TwgQ5:p8ITt3naanQNGYJY6a2mxLfLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372283, "uuid": "265ca37e-8842-41da-b8e6-e62c7c5ecf60", "value": 5271040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372283, "uuid": "b5ecc2ef-7d52-450a-ba3f-ae4bd4019529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372283, "uuid": "92088178-20c4-462f-b5c8-f7ac1b6ba26b", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ca4ab9-c38c-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763366716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366716, "uuid": "54fff71b-5af1-4bd3-86b5-16bbe02a90d8", "comment": "Malware payload (Arechclient2)", "value": "847dfe56e763205eeeb66f080e0b1af3", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366716, "uuid": "9e842c9d-9c2f-4006-8852-4a23fd796533", "comment": "Malware payload (Arechclient2)", "value": "f9562b10e77851549de5e57847570c59daa299b88fad92e731fd8a8b57eba781", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366716, "uuid": "5bbab58c-dbef-499b-87df-57ae5c5b9e55", "comment": "Malware payload (Arechclient2)", "value": "796e9009f009b55e0c195c36d37c4daa9e0a25bb", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763366716, "uuid": "cec0d8bd-e6fe-45a6-8197-0d38d8dfa3fb", "comment": "Malware payload (Arechclient2)", "value": "f7f857a2fc9ca92e0be92a72ace0d9afed010fe58163ec99fff2fae4cfac3b814b65e5333bfe0d774f2857b8a03902e3", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366716, "uuid": "104b6e45-a0e1-4964-ab0f-da9ef8668188", "value": "T16AF4CF5BBA6C8B9DE3A94BF03575D5B01268EFE768209805BDD6ED6F31B170C18032D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366716, "uuid": "37a6618c-68ee-4672-b460-4f92f182dcf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366716, "uuid": "109aaf51-06aa-4439-bb76-1fe6db87f01b", "value": "12288:HR2JYHpKUzm6rBTdt6hUByoum0QJgQWff/1P1s:bU6xdtMIgQkTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763366716, "uuid": "cf815bc1-9c4a-4721-83d3-58a7406da491", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763366716, "uuid": "bd63896c-f5b1-4e7e-ac2e-6b2263566cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763366716, "uuid": "1698aa61-9870-4aa4-9282-f7d2e8043378", "value": "Order.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb0dd96-c39a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763372851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372851, "uuid": "723dcae9-6bf4-4471-bfe9-1f78826b21b4", "comment": "Malware payload (Mirai)", "value": "551bd4c71b8ffe0c3ebadad5abd57a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372851, "uuid": "70acb86e-701d-4a7a-8548-32fb6a27e33c", "comment": "Malware payload (Mirai)", "value": "f98650b01e7ea808266bf12d62480f2bee06c72bc58962c27809840c8dfdc33d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372851, "uuid": "389c0711-4df5-44a0-a719-bc36c79c27ad", "comment": "Malware payload (Mirai)", "value": "cc070c2e7c4b5d646194ddd33f5743c2e57def19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763372851, "uuid": "dbb47cdf-ed9c-40ef-b7eb-cddb1c9bfaa9", "comment": "Malware payload (Mirai)", "value": "d04117cf4cd91277ac361a92f13c3f3af70885298336d9d6ffb89bd73d019d14fa1d3bae168350f24450ebea3d42795d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372851, "uuid": "1c8dedd5-281f-4a78-a749-3bbf369a496c", "value": "T138B36DC9F643D0F9DC5605302177FB37AE72E8BA2328DA93D3A59E327C12641D416A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372851, "uuid": "b9b4559c-b3ef-40d5-88f3-857b1a4bdf83", "value": "1536:SdnyMFrn8vPRh6HJb/YVDPvSvBxb3JRGddxrIviEtc/vXR7Zp56UkmVdCnMiBD:iFrnQOpzYVLSvBzkd+3cnXB/5zdCdBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763372851, "uuid": "5c58adbf-f824-47dd-9788-358e0e472318", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763372851, "uuid": "910193c3-6a00-4a47-b769-81b0fd32a29e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763372851, "uuid": "94954ba2-f0d1-4976-8587-ddc36660b30e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1a7f08-c384-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763363420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363420, "uuid": "fe010157-c84d-40be-a654-531c564c2df5", "comment": "Malware payload (MaskGramStealer)", "value": "551bb50f1124ddfb106a414d607a714f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363420, "uuid": "0e572959-cddd-4b12-b8a6-7e8e9d9d86f7", "comment": "Malware payload (MaskGramStealer)", "value": "f9929c5bb18eddbaec3c625a83745ff94459b5878eb5ced09fe372014f7b169d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363420, "uuid": "13e71542-ce4d-4e16-8d1d-cc0f579709a2", "comment": "Malware payload (MaskGramStealer)", "value": "d7247f6ae7a94c19e67d023c8b07dcc393228e9f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363420, "uuid": "9e8eb2d1-159e-4350-afdf-1f29e4b75eba", "comment": "Malware payload (MaskGramStealer)", "value": "4656fd9591e949d250ade518b605773e1eeb05f1a5ae9d10d4de2b527b19d0158729ddcacba4fb45a267fd396caff109", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363420, "uuid": "1eda7d0d-bd5d-4bd8-8381-a1340e842f95", "value": "T16AD523A8AF956E03D95E8E3D4812DEC7A36A4F54204DDF4E1619FEBD493A3F40B801D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363420, "uuid": "51fec0bf-81b6-4715-94ec-c8681a49a899", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363420, "uuid": "3656f867-3712-41a2-aa83-2abdf97b67e2", "value": "49152:5ZR4n64CFO9HKjXqPGvwtUr92WrAAKkBQbbUioLRyHIInMYz2WG:5Po64+O9HAXFb92WMA7BQv/oAoE6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363420, "uuid": "a193aab4-2bcc-4c95-b60b-7e3f7dc9e147", "value": 2764368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363420, "uuid": "5940bf39-3089-4d10-86e7-6f639004ffec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363420, "uuid": "1d6e6ce5-5a30-4c20-8482-84d1ef714b3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115ef4bd-c407-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763419508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419508, "uuid": "33f0c9ee-bd87-434f-b4fb-7c0193a2d07a", "comment": "Malware payload", "value": "fbf592a3d9a66e858a68f2bbbfbb84d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419508, "uuid": "04872741-f43d-4b26-ab6f-1c1393e992e5", "comment": "Malware payload", "value": "fb8688c0a6147fc605cbf4d0459730052381b06ab9e2dd006cf82f270f7fdfb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419508, "uuid": "44196a15-e718-4ffc-8e66-1b10beb3a4eb", "comment": "Malware payload", "value": "4a596c4745911b9d8b8b24a3a2864621a6275313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763419508, "uuid": "2acec725-e207-4b2c-9712-a7c5507cb278", "comment": "Malware payload", "value": "7b69af528767313a908779a0b25ccd22c35aa44a5023c1eb0a8a0145e11c6627b762d83661391ff280802cd2f336ebab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419508, "uuid": "b7844d84-3184-4bce-b7e5-558d42997ceb", "value": "T18C374923E86654D4C6EEE23981667132FDF53C510B2263C76E20ABA87E34FC15E75389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419508, "uuid": "258e3153-153d-423f-9b20-e9beceff8c2c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419508, "uuid": "2875f6c0-67f2-43a9-bef0-b823d6fbafa0", "value": "393216:9vViDm5UjXw5RJSMJrQbJDCCcr7TsibG:9diDm50GFVQbJOVvTFbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763419508, "uuid": "819b09b6-45a1-4f98-8e14-59d9b686c5e6", "value": 24475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763419508, "uuid": "253d90f1-bf04-4ea7-8063-95a79aee4648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763419508, "uuid": "b47064b7-9774-4ceb-964c-6a4644012315", "value": "utilmain5292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6642ab88-c3f1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763410201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410201, "uuid": "0322d92f-63b8-4c0d-b771-9ab9486303d6", "comment": "Malware payload (AsyncRAT)", "value": "457350f9f0aaac15aac9e6022ef4a894", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410201, "uuid": "d7546fd9-dd74-452a-a082-5820489fc6c0", "comment": "Malware payload (AsyncRAT)", "value": "fc3af4e10dfeb575e184ca68aea3214009e95ea651003a55061ea4e3bb53384e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410201, "uuid": "8fd64003-6e34-4aaa-808a-95d872d7d302", "comment": "Malware payload (AsyncRAT)", "value": "2ba6477238bd9d56c3c9b2fd1e24c23ad1d4b697", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763410201, "uuid": "4555e431-f3d7-4057-916c-d9cae9803b41", "comment": "Malware payload (AsyncRAT)", "value": "0655f49d23859a038350e1e198e2c8e315241158489b44039b5c4a0d9b5f843166810869c87a6fe7386b63304b7e172f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RU", "colour": "#08DAA4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410201, "uuid": "112e31bd-eb4a-43f3-93af-104ebceb6ac8", "value": "T12F638C5837F50519E0FEAFF148F12622DB79F5176903C21F68CD02892A27AC9CD617EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410201, "uuid": "0fd9f5b0-4590-4348-adf0-1a99be78757f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410201, "uuid": "2e556c71-9cea-415d-b34d-d99afdd0fac1", "value": "1536:e1GvdtixSQPD7taFieCbPgY2EllQS6OfNhXOfULwd:WsQ7VDbPqwQ49OfHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763410201, "uuid": "3f1389a8-d364-43f1-bc16-7e9ea5d7eb1b", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763410201, "uuid": "fd4e4932-50c7-4c46-8e77-738dd04a51b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763410201, "uuid": "0b39ba9d-5609-4eec-a0c7-ea939e5a0267", "value": "crss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcc08b5-c385-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763363671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363671, "uuid": "bb91ed07-a4bb-4baa-8f28-5fb986ad6d71", "comment": "Malware payload", "value": "95a45f28675677649b43dab4513f1542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363671, "uuid": "954f6a67-fb81-42fd-b6fd-4a5ce6b4518b", "comment": "Malware payload", "value": "fc4a9ba48dd777df1b0cb833484dd888ee6306961244f3789fc618133ec78258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363671, "uuid": "54ec51dd-425e-4dfb-8ebb-48a50c3de5dd", "comment": "Malware payload", "value": "63a193ef1f571fb9687b9097f7a95590e2f1d153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763363671, "uuid": "f1ecb953-9b21-4b7a-8383-6dbdea4336b1", "comment": "Malware payload", "value": "c7cdf3a3b877786de3f6dcad0abd896a79dced29f5cbac118adca84bcaa8851967ee034329e15a1c745e17434d9348a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363671, "uuid": "cd9ac74c-b526-4685-9bef-63271310f676", "value": "T1F20633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363671, "uuid": "6325c89d-1f5f-443f-8a5c-1d586c64e915", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363671, "uuid": "e83adb66-dfa1-4436-a916-8aae35336aa3", "value": "98304:a3T3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:E2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763363671, "uuid": "5b41badc-2a06-449a-a868-e091ddf3ba39", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763363671, "uuid": "a5b40656-3d4a-4b26-aff1-b40934948401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763363671, "uuid": "25109c99-7184-45ae-9ee9-59424801d5ec", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16119051-c40b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763421234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421234, "uuid": "f9679c37-3724-4835-9d2a-2ee447490c13", "comment": "Malware payload (Mirai)", "value": "510d1efbba353bcc245b1d68f599daf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421234, "uuid": "d663b308-958e-4afd-b5c9-5a6e0a70b158", "comment": "Malware payload (Mirai)", "value": "fd43cd285c221153bd79cc46a623a0e7084711f50a3854429e7459b3bba8cc99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421234, "uuid": "8a2016bb-61b8-4490-a5d3-e214695ecfea", "comment": "Malware payload (Mirai)", "value": "8af5cd0b07b850e73b6fbb820de9068982efa895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763421234, "uuid": "1aa06ffc-064d-402d-93d5-f5605e64188c", "comment": "Malware payload (Mirai)", "value": "d937f1b54ea01eed16109943deff4d72a4729f3de5d7245c52e8ec1f4f9d302d7f08b57874cec611d4858d3fc64644e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421234, "uuid": "fb3182ef-6f27-4c9e-8b71-1ec9f4dd1115", "value": "T1F6C2D1A42F668098DBE5D03D0B4743103E7E13B96583AC06305ED9E6CE993B575938EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421234, "uuid": "fd766135-51e4-45cb-a26b-e6aaa514f82d", "value": "768:Q4nM/oI9DaOl4qPp3R+EFnIVf1bSORkOru+JgGlzDpbuR1JR:NMAIUi4qfEflDRXBVJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763421234, "uuid": "a432b333-bdcd-4ef2-9707-f58c9656734e", "value": 26920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763421234, "uuid": "442eaee5-0157-4a65-a472-a154d3f1754b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763421234, "uuid": "16ea1d17-3632-459e-aa38-5fa266a64732", "value": "wewe2.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c09990a-c36d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763353491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353491, "uuid": "f7b3cfb8-fe2c-4f70-85c1-ba815b3b4273", "comment": "Malware payload", "value": "bc4c0c70f2a584d6d574db21f45c0723", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353491, "uuid": "eba8b93d-77fa-49b9-b6e8-04aea4d1c401", "comment": "Malware payload", "value": "ffa3726139fa06d8f3955997c6cef3e04399a07e7f0645b3b02b039f004beb57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353491, "uuid": "131f9673-46af-40fb-9b7e-5bbac3c63c56", "comment": "Malware payload", "value": "9a49d4ec305605ad8b1e5e180d2e7418e744970b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763353491, "uuid": "f2f198b7-034f-4cd4-a678-8c52258fda2f", "comment": "Malware payload", "value": "bcce15ce67374c46d96a125a624efcfdf1c51a6c598ec59f1e94f0ee6b5787713953b544c37720946cc25d92628baeb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353491, "uuid": "ac983faa-743d-423e-b807-57c855735233", "value": "T106A3D709BF631EB3D82BDD370198175624DC530B616D3B3A7938D828FD56A8E4ED38A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353491, "uuid": "054fc43b-3f15-470a-a403-a4f35a9ee4a9", "value": "1536:pQrOFiCe60DWTGPddFl8ZKyJBQ2DCc+Z7OvX1OQipts+MooiOQ0TALEtFR7:pQqFiCeZ7dJ8ZjcROT+jPLEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763353491, "uuid": "7c6c80e0-c8a9-497b-b296-6dce7a247c0c", "value": 105680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763353491, "uuid": "bd896eeb-87ac-419b-9fb8-940a19e09738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763353491, "uuid": "055b6bb4-b06f-4673-814d-b64be79a55ed", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }